ป้ายกำกับ: Data Protection

Digital treasure trove threatens privacy

เขมภัทร ทฤษฎิคุณ

First Published in Bangkok Post on Wednesday, August 16, 2023

With the unstoppable digital boom, Thailand faces a critical question: Is the country adequately prepared to shield its citizens’ personal information from potential misuse?

Due to their rapid growth, digital platform businesses have propelled their value to over 900 billion baht in 2021. Their prowess lies in their capacity to compile and process vast data, enabling them to decode consumer behaviour and create sought-after services. Yet, this advantage raises privacy concerns.

Amid escalating data breaches and privacy infringements, swift government action is essential to fortify data protection against influential digital entities before matters spiral.

Although the 2019 Personal Data Protection Act (PDPA) is in effect, challenges persist. It remains unclear how well this law shields individual privacy given the difficulty in finding the right balance between commerce and personal privacy.

The first challenge is unclear communication with consumers on how their personal data is collected and used.

A Thailand Development Research Institute (TDRI) study reveals businesses using perplexing language and legal jargon, hindering consumers’ comprehension of how their personal data are handled. Moreover,  the use of technology to block access to information unless the consumer agrees to be tracked by a “cookie wall” creates consumer annoyance. As a result, many impulsively give consent without fully grasping the data implications.

Given platforms’ typically free services, users rarely pay close attention to the terms of use, unknowingly playing with their personal data and online browsing habits which have an impact on their privacy. Therefore, the government must mandate that digital platform businesses transparently inform users about personal data usage.

Currently, “super apps” grant users an array of services under one roof. Yet these apps are not clear about how they share users’ personal data with other platforms within the same app. This causes consumer frustration and concerns about privacy infringement.

The second concern is that not all digital platforms have adequate standards to protect personal data as required by the Personal Data Protection Committee in 2022, thus putting personal data at risk.

Lacking specific guidelines to protect consumer rights, many platforms fail to fully understand the required procedures. This results in varying security standards. Some do not offer channels for consumers to exercise their rights. Some offer overzealous measures while others forego all security measures, preferring to deal with risks as they arise.

The third challenge involves the transfer of personal information. Since platforms may send data to companies and countries without data protection standards equivalent to Thailand, it raises legality questions. To resolve this issue, platforms have to bear the costs of ensuring proper handling and obtaining consumer consent.

The Personal Data Protection Act’s exemption of state agencies is the fourth problem. To safeguard “national security” and “public interests,” the Cabinet approved a draft royal decree in July 2022 that would exempt state agencies from adhering to the PDPA.

Although the Cabinet has amended the draft decree to narrow the scope of the exemption and provide data protection measures, citizen privacy is still at risk. The government needs to be more aware of the significance of protecting personal data in the digital era. It should not permit exemptions based on broad, ambiguous justifications like “national security” and “public interests” that compromise citizens’ rights to privacy protection.

It cannot be denied that state agencies are also collecting huge amounts of citizens’ personal data on their platforms. Excluding them from the PDPA then endangers citizens’ privacy. It is, therefore, essential to include measures to minimise the repercussions and provide compensation for privacy violations by state agencies. In short, the law should not allow state agencies to violate citizens’ privacy without being held accountable and responsible.

Moreover, international regulations demand equivalent privacy standards for cross-border data transfers. Making exceptions for state agencies regarding personal data protection suggests that Thailand’s standards do not meet global benchmarks. As a result, Thailand’s digital economy may face negative consequences.

On the other hand, the European Union (EU) and the United Kingdom (UK) are taking significant steps to strike a balance between personal data protection and using data for business purposes. The EU, for example, has provided clear guidelines for communication between service providers and platforms, with specific dos and don’ts. These well-defined guidelines lead to better understanding among service and platform providers, going beyond mere enforcement of rules.

In addition, the UK’s Information Commissioner’s Office (ICO), which is in charge of protecting personal data, is urging the private sector to participate in the development of a “business code of conduct” for use in the industry.

Since the government may not fully understand the practices of the business sector, allowing the private sector to contribute to the development of standards and having the government certify their quality is an efficient way to deal with rapid changes in the digital world that the government cannot keep up with.

Realising that state support is essential for the development of the digital economy,  ICO also provides consultation and collaboration with businesses in a sandbox environment to foster innovation with ICO’s legal guidance.

Furthermore, the  European Union has released a whitelist of nations with sufficient data protection standards for the transfer of personal data which boosts confidence in businesses when they transfer personal data for processing in these countries.

Such collaboration between the government and private sector to protect consumers’ personal data and promote innovation offers valuable strategies for Thailand to address the challenges at home.

To strike a balance between citizens’ privacy and business interests, the government and the Personal Data Protection Committee (PDPC) must expedite the following three measures and immediately stop one damaging move.

First and foremost, release personal data protection guidelines for businesses as soon as possible. The guidelines should include concrete examples of clear and transparent communication with consumers and the need to inform them regularly what practices they should or should not engage in.  The use of personal data by the “super apps” should also be closely monitored to prevent privacy violations.

Secondly, expedite collaborations with businesses to formulate a privacy protection code of conduct as well as establish consultations and dialogues on legal aspects of personal data protection between the government and the industry.

Thirdly, speed up the issuance of government directives for cross-border personal data transfers. Also, publish a list of countries with personal data protection standards on par with Thailand’s.

It is the responsibility of the Personal Data Protection Committee (PDPC) to implement these crucial measures, which it must prioritise as its immediate goals.

Finally, the government must stop the efforts to exempt state entities from personal data regulations. If not, Thailand’s standard for personal data protection will fall below international guidelines. As a result, Thailand will miss out on the chance to fully participate in the global platform economy.

Amid the digital revolution, Thailand faces a pivotal choice: act fast to embrace strong personal data protection or succumb to the officialdom’s resistance to change and lag behind. The path chosen today will shape Thailand’s digital future and determine where it will stand in the global digital arena.

Preparing to Deal with Personal Data Protection Measures in Platform Business

เขมภัทร ทฤษฎิคุณ

Preparing to Deal with Personal Data Protection Measures in Platform Business

Published in TDRI Quarterly Review, Vol. 38 No. 2 (June 2023)

Suggested Bibliographic Citation: Trisadikoon, K. (2023). “Preparing to Deal with Personal Data Protection Measures in Platform Business.” TDRI Quarterly Review, 38(2). 3-16.

Summary

This article examines the challenges of personal data protection in digital platform businesses, which have expanded rapidly over the past decade and now play a central role in the modern economy. Platform companies rely heavily on collecting and analyzing large volumes of user data to improve services, target consumers, and generate revenue. However, this intensive use of personal data raises significant concerns about privacy, particularly because users often do not fully understand how their data are collected, used, or shared. The article highlights the problem of information asymmetry between businesses and consumers, which leads individuals to underestimate the true cost of disclosing personal information.

Although Thailand enacted the Personal Data Protection Act B.E. 2562 (2019), modeled largely on the European Union’s GDPR, the article argues that the main challenge lies not in the existence of the law but in its effective enforcement, especially in the platform economy. Key issues include unclear and unfriendly communication with users—such as complex privacy notices or the use of “cookie walls” that pressure users to consent—insufficient data security measures that increase the risk of breaches, cross-border data transfers to countries with lower protection standards, and legal exemptions that may allow government agencies to bypass certain requirements. These factors may weaken overall privacy protection and undermine public trust.

The article also compares three major global regulatory models for personal data protection: a rights-based model prioritizing data subjects’ privacy (exemplified by the EU), a market-oriented model emphasizing business freedom (associated with the United States), and a state-centric model prioritizing national security (illustrated by China). It suggests that Thailand should adopt a balanced approach similar to the GDPR, which seeks to reconcile economic benefits with the protection of individual rights while facilitating international data flows.

Drawing on experiences from the European Union and the United Kingdom, the study emphasizes the importance of “soft law” instruments—such as guidelines, codes of conduct, and self-regulatory mechanisms—in clarifying legal obligations and promoting responsible business practices. It also underscores the need for proactive oversight by regulatory authorities, including monitoring high-risk platforms and providing advisory support through mechanisms such as regulatory sandboxes. Ultimately, the article concludes that protecting personal data in the platform era requires not only formal legislation but also flexible governance tools and active regulatory engagement to balance innovation, business interests, and individuals’ privacy rights.

Download

บรรยายพิเศษ – PDPA กับองค์กรปกครองส่วนท้องถิ่น

เขมภัทร ทฤษฎิคุณ

PDPA กับองค์กรปกครองส่วนท้องถิ่น: ทําความเข้าใจบทบาทขององค์กรปกครองส่วนท้องถิ่นตามกฎหมายคุ้มครองข้อมูลส่วนบุคคล (การอบรมเชิงปฏิบัติการแนวทางการปฏิบัติตาม พ.ร.บ. คุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562 สําหรับองค์กรปกครองส่วนท้องถิ่นในรูปแบบออนไลน์ · วันพฤหัสบดี ที 19 กันยายน 2565)

Download

Personal Data at Risk in Govt Hands

เขมภัทร ทฤษฎิคุณ

First Published in Bangkok Post on Wednesday, August 31, 2022

Only one month after enforcing the law to protect the Thai people’s personal data security and privacy, the government had a change of heart.

Instead of imposing the PDPA law on all organisations that handle data, the government has helped some government agencies to bypass the Personal Data Protection Act (PDPA) in the name of “national security” and “public service”. As a result, government, national security agencies, the courts, public attorneys, police and tax authorities will be permitted to collect, access, and transfer our data with impunity.

In addition, the government can access citizens’ personal data to fulfil those obligations.

A scary scenario indeed.

The Personal Data Protection Act (PDPA) took effect on June 1 this year after a two-year delay. The long-overdue law sets rules and standards for the private and public sectors to follow on collecting and using personal data to protect privacy and security.

While the business community is busy setting up new security mechanisms to comply with the PDPA’s complex rules and avoid legal punishment, the government has hatched a plan to bypass the PDPA altogether.

On July 5, 2022, the cabinet approved the draft of the royal decree by the Ministry of Digital Economy and Society to exempt government agencies from the PDPA law if the data is to be used for public service, national security protection or the inspection of crimes such as narcotics offences, human trafficking and money laundering.

Following cabinet approval, the royal decree can bypass parliament as an urgent piece of law. The legislation will be effective after it is signed by His Majesty the King.

This royal decree will affect citizens’ rights and freedoms for many reasons.

Firstly, the areas of exemption are too broad. Under the drafted royal decree, the PDPA’s stipulations on data protection rights, petition procedures, financial compensation and the punishment for violators will not apply to those state authorities which are exempted by the royal decree.

In short, the officials will freely enjoy legal immunity from prosecution under data protection laws.

Secondly, the exemptions granted to protect “national security” and allow operations of “public service” are too wide-ranging and unclear. This ambiguity allows officials to interpret “national security” and “public service” as they see fit, making it easy for them to abuse power. Allowing all levels of the judiciary — from police and attorneys to the courts — and tax collectors to freely access and transfer the citizens’ personal data creates similar worries.

Public concern over data safety is valid when trust is already so low and power abuse is so widespread.

The public sector has repeatedly failed to protect the personal data of those it should be serving. Government agencies experienced at least five data breaches last year alone. The hacked data involved users’ health records and other sensitive information.

Apart from data breaches from external violators, the government also faces allegations of breaching public privacy and freedom by using spyware to track and record activists’ and journalists’ mobile phone use. Only governments can buy this spyware to hack people’s cell phones.

The government’s alleged violations have raised questions about state responsibility and accountability. Exempting the state from the PDPA further intensifies public concern about abuse of power and political persecution. It also perpetuates a culture of impunity, which aggravates state violence against the citizens.

The exemption may also affect the economy. The PDPA is an important part of a host of digital economic laws to set standards and regulations on the cross-border transfer of personal data, which is essential for digital economic transactions.

Public trust in a secure cross-border transfer of personal data is crucial for the growth of the digital economy. As a result, most international trade agreements, such as the Regional Comprehensive Economic Partnership or Comprehensive and Progressive Agreement for Trans-Pacific Partnership, require members to honour personal data protection. Even China, an economic powerhouse, agreed to pass the law on personal data protection last year.

The core principle of data protection and privacy in international trade is that the data senders’ and receivers’ countries must share similar data protection standards. To safeguard citizens’ rights and freedoms, the General Data Protection Regulation of the European Union, the gold standard on data protection and privacy, prohibits intervention by the government or security agencies.

The government’s attempt to free itself from the PDPA’s legal obligations violates EU standards on data protection. It will backfire economically.

Data transfer to Thailand will become problematic from failure to meet international standards. The local businesses will be hit hard. The private sector will therefore miss the opportunities to grow in the era of the digital economy.

The government must realise the risks of allowing officials to tamper with people’s privacy and threaten people’s safety. The economic loss will be huge. So will the impact on the citizens’ rights and freedoms.

This royal decree effort violates citizens’ rights enshrined in the constitution. It protects the officialdom, not the people. It perpetuates state oppression and a culture of impunity. It risks seeing Thailand slide into becoming a pariah state. It must be stopped before it is too late.

A Study of the Necessity of and Approaches to the Preparation of Personal Data Protection Guidelines

เขมภัทร ทฤษฎิคุณ

A Study of the Necessity of and Approaches to the Preparation of Personal Data Protection Guidelines

Published in TDRI Quarterly Review, Vol. 37 No.2 (June 2022)

Suggested Bibliographic Citation: Trisadikoon, K. (2022). “A Study of the Necessity of and Approaches to the Preparation of Personal Data Protection Guidelines.” TDRI Quarterly Review, 37(2). 23-44.

Summary

This article examines the necessity of developing personal data protection guidelines to support the effective enforcement of Thailand’s Personal Data Protection Act B.E. 2562 (2019). Although the Act establishes fundamental principles, data subject rights, obligations of data controllers and processors, and legal penalties, it lacks detailed practical instructions for real-world implementation. As a result, organizations with legal duties may face uncertainty in compliance, which could undermine the effectiveness of personal data protection. The study argues that practical guidelines are therefore essential as an instrument for translating legal principles into concrete procedures, standards, and operational practices tailored to organizational contexts.

The paper outlines key elements of the Thai legal framework, including the scope of application, rights of data subjects, relationships among data subjects, controllers, and processors, rules governing data processing throughout the data life cycle, and enforcement mechanisms. It then conducts a comparative analysis of personal data protection systems and guidelines in the European Union, the United Kingdom, Japan, Singapore, and the United States. The findings indicate that effective guidance typically exists at multiple levels, including general conceptual guidelines, sector-specific guidelines tailored to particular industries, and topic- or activity-specific guidelines addressing concrete situations. Such multi-layered guidance enables organizations to interpret and apply legal requirements in a manner consistent with actual operational realities.

Based on these insights, the article proposes an approach for developing personal data protection guidelines in Thailand that aligns with the characteristics of different sectors and the life cycle of personal data processing. The recommended structure includes general principles, practical examples of data processing activities, and frequently asked questions to facilitate usability. The study also suggests phased dissemination according to the readiness of each industry and continuous updates to reflect secondary regulations and evolving circumstances. In conclusion, the article emphasizes that clear, context-sensitive guidelines are a critical condition for enabling the Personal Data Protection Act to achieve its intended goal of effectively safeguarding individuals’ privacy rights in practice.

Download