Data protection act enforcement may be further delayed in Thailand

“If the public has negative views about the PDPA, which takes effect in two months, the ministry may consider deferring or amending it,” he was quoted as saying by the Bangkok Post.

Chaiwut also acknowledged a delay in appointment of members to the Personal Data Protection Committee, which will approve already-drafted subsidiary legislation for consent procedures, complaints and expert panels.

The ministry’s deputy permanent secretary Putchapong Nodthaisong said four or five associations, including in the travel and automotive sectors, are seeking deferral of the act’s enforcement.

“SMEs are our concern as they lack readiness,” he added. “Some ill-intentioned people may explore legal loopholes to abuse businesses for personal gain and this could cause a broad impact.”

The PDPA was published in the Royal Gazette in May 2019, with one-year grace for parties to adjust. The cabinet extended that for another year in May 2020, to allow more time for preparation and to ease the financial burden during the Covd-19 pandemic.

The act covers collection, use and disclosure, including across borders, of personal data.

Principles in the legislation include data minimisation, data controllers informing data subjects of the purpose of the collection and the data-retention period.

Data subjects have the right to access their personal data, rectify incomplete, inaccurate,misleading or not up-to-date data, request erasure of their personal data, opting out of their data being used for activities such as direct marketing, and withdraw consent.

Penalties for breaching the act could result in civil liabilities with punitive damages, administrative fines of up to THB5m ($159,600), and criminal penalties with up to one year in prison or a fine up to THB1m.

Register to receive the latest data protection and privacy news and analysis straight to your inbox