A Study of the Necessity of and Approaches to the Preparation of Personal Data Protection Guidelines
Published in TDRI Quarterly Review, Vol. 37 No.2 (June 2022)
Suggested Bibliographic Citation: Trisadikoon, K. (2022). “A Study of the Necessity of and Approaches to the Preparation of Personal Data Protection Guidelines.” TDRI Quarterly Review, 37(2). 23-44.
Summary
This article examines the necessity of developing personal data protection guidelines to support the effective enforcement of Thailand’s Personal Data Protection Act B.E. 2562 (2019). Although the Act establishes fundamental principles, data subject rights, obligations of data controllers and processors, and legal penalties, it lacks detailed practical instructions for real-world implementation. As a result, organizations with legal duties may face uncertainty in compliance, which could undermine the effectiveness of personal data protection. The study argues that practical guidelines are therefore essential as an instrument for translating legal principles into concrete procedures, standards, and operational practices tailored to organizational contexts.
The paper outlines key elements of the Thai legal framework, including the scope of application, rights of data subjects, relationships among data subjects, controllers, and processors, rules governing data processing throughout the data life cycle, and enforcement mechanisms. It then conducts a comparative analysis of personal data protection systems and guidelines in the European Union, the United Kingdom, Japan, Singapore, and the United States. The findings indicate that effective guidance typically exists at multiple levels, including general conceptual guidelines, sector-specific guidelines tailored to particular industries, and topic- or activity-specific guidelines addressing concrete situations. Such multi-layered guidance enables organizations to interpret and apply legal requirements in a manner consistent with actual operational realities.
Based on these insights, the article proposes an approach for developing personal data protection guidelines in Thailand that aligns with the characteristics of different sectors and the life cycle of personal data processing. The recommended structure includes general principles, practical examples of data processing activities, and frequently asked questions to facilitate usability. The study also suggests phased dissemination according to the readiness of each industry and continuous updates to reflect secondary regulations and evolving circumstances. In conclusion, the article emphasizes that clear, context-sensitive guidelines are a critical condition for enabling the Personal Data Protection Act to achieve its intended goal of effectively safeguarding individuals’ privacy rights in practice.
For the past two years, Thailand’s tourism industry has been in a coma due to the Covid-19 pandemic. To revive the economy, the government has now relaxed Covid-19 control measures to reopen the country. Big hotels now have a chance to recover but for a majority of small hotels, however, it is already too late — many of them had their fate sealed by outdated laws regulating hotels that made it near impossible for them to gain an operating licence.
Ask operators of small hotels and hostels, and they will pour out the same grievances; the laws regulating hotels not only favour big hotels and discriminate against small operators, but they also prevented small players from receiving state assistance during the pandemic.
For example, when the government launched the Sandbox Programme to revive the tourism industry last year, small hotel operators cried foul with only big hotels eligible for the programme. Small hotel operators petitioned Prime Minister Prayut Chan-o-cha for intervention for they, too, desperately needed help.
The state authorities argued that most small hotels were not eligible because they did not have an operating licence. But not having the licence is not their fault, smaller operators claimed. The crux of the problem is that the laws regulating hotels make it next to impossible for small operators to obtain a licence.
For starters, laws governing hotels do not differentiate between big and small businesses. They have fixed, uniform standards that require high investment for all hotels regardless of business size. While big hotels with money can meet such requirements, most small hotels and those run by local communities cannot.
“Without an operating licence, they cannot get emergency assistance from the government when hit by the pandemic. Worse, they are considered illegal businesses.”
The smaller operators’ requests for more flexible and timely regulations to fit local conditions and adapt to changes have been rejected. Without an operating licence, they cannot get emergency assistance from the government when hit by the pandemic. Worse, they are considered illegal businesses.
At present, hotel operators are governed by the 2004 Hotel Act, the 1990 Town and Country Planning Act and the 1979 Building Control Act. Apart from being outdated, the standards required by these laws are based on the operations of large hotels. When small operators cannot meet the legal requirements more suited for big hotels such as noise control, the size of a water treatment system, and parking spaces, they are denied the licences.
Similarly, the building law is designed for the construction and safety of large buildings. Many small hotels, meanwhile, are renovations of old homes or commercial buildings. Although the authorities at the Department of Public Works and Town and Country Planning have adjusted some requirements to accommodate small buildings, the changes still do not cover many types of accommodation such as boathouses or treehouses.
The tourists’ increasing preference for cosy accommodations with quaint charms has led to the mushrooming of boutique hotels and small hotels across the country. The locals finally have a chance to benefit from tourism, not only big investors. The outdated laws, however, make it very difficult for them to obtain an operating licence.
According to the Department of Provincial Administration, there are 30,000 registered hotels nationwide. Meanwhile, over 60,000 hotels are listed on the Online Travel Agency website.
Apart from specifying the size and structure of the buildings, hotel laws also require a separation between the operators’ homes and hotel areas. They also prohibit homestays to have more than four rooms and receive more than 20 customers.
These rules affect homestay businesses where the owners live on the same premises. It also prevents homestays from growing, thus making it difficult for the owners to improve their venues and services.
Furthermore, hotel laws specify in detail what services must be provided. When small hotel customers only need clean rooms to stay in, this rule on mandatory services has put an extra financial burden on small hotel operators.
In 2019, the government initiated a temporary solution for small hotels, giving them two years to improve their premises so they comply with the laws and file for a licence. The grace period expired in August last year.
The reprieve was no use, however, because it came when the country was hit by Covid which almost wiped out the whole tourism industry. Small hotels, struggling to survive, simply have no resources to develop their operations and file for the licence within the deadline.
Instead of forcing small operators to comply with outdated laws, the government must overhaul the laws that prevent small players and local communities from benefiting from the tourism industry.
True, the hotel and building laws aim to protect customers and the public but the situation has changed and the laws are now out-of-date. They must be modernised to help small hotels conduct business.
Changing the rules and regulations here and there does not suffice, however. The laws governing the tourism industry must be comprehensively revamped.
First, since the grace period for applying for the operating licence is over, the government should consider issuing an emergency decree to extend the reprieve. This will give the operators more time to develop their premises and apply for the licence.
For a long-term solution, the government must overhaul the laws and ministerial regulations that affect small hotel operations and licensing. Building standards and other requirements should accommodate a wide range of accommodations, especially small hotels and special categories such as boathouses and treehouses.
With tourism markets becoming more niche, hotel laws should support the operations of small hotels to answer the customers’ particular needs. Unnecessary requirements and rules should be lifted. Importantly, the laws on hotel operations and building control should not be implemented separately, not combined in one package to govern the hotel industry as it is now.
Importantly, the oversight authority should be in the hands of local governments instead of being centralised by the Department of Provincial Administration. The local administration bodies understand better local conditions and can provide faster remedies when problems occur. Also, local governments have more incentives to support tourism in their jurisdictions much more so than the officialdom based in Bangkok.
Such a legal overhaul will help small hotels develop and expand their businesses. For not having to meet large hotel standards will give them more resources to improve their venues and services in other ways. The customers will then have more high-quality choices for their different tastes and needs.
Modernising the laws is necessary if Thailand wants to recover from the pandemic quickly. Importantly, the legal overhaul will ensure that tourism benefits will be distributed fairly to all players, especially local communities. After all, it is the duty of the government to ensure fair play and prevent the law from aggravating injustices.
Khemmapat Trisadikoon 