Thailand’s Personal Data Protection Committee (PDPC) has released separate guidelines for data controllers to follow in obtaining data subjects’ consent and notifying data subjects of required information (i.e., regarding collection, use, or disclosure of their personal data). By following the guidelines, data controllers can mitigate the risk of violating the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The Guidelines on Obtaining Consent from the Data Subject according to the PDPA and the Guidelines on Notification of Purposes and Details upon the Collection of Personal Data from the Data Subject according to the PDPA were issued on September 7, 2022. Consent Guidelines The PDPC’s guidelines on obtaining consent list the requirements for consent to be considered valid. These requirements include stipulations on timing of requests, elements that need to be included in requests, and the nature of requests. For instance, consent must be obtained before or at the time of obtaining personal data, and data subjects must be informed of both the purposes and details of the personal data handling, among other specific requirements. In turn, there must be a clear affirmative act of the data subject in giving consent. Obtaining consent from minors is subject to more stringent requirements, and data controllers should implement appropriate identification and age-verification measures when collecting personal data about minors. The guidelines give two sets of requirements, depending on the age of the minor—between 10 and 20, and under 10. In general, with the older age group, parental consent is not required in all circumstances, while for the younger age group, parental consent is compulsory for giving consent on behalf of the minor. For a person deemed to be “incompetent” or “quasi-incompetent,” consent must always be given by the legal guardian. Notification Guidelines The guidelines on notifying data subjects when collecting personal data set forth the two key principles of fairness

Tilleke & Gibbins’ insurance specialists in Cambodia, Laos, Myanmar, Thailand, and Vietnam have contributed to the Subrogated Recoveries – Asia Pacific guide produced by RPC Premier Law Firm. The guide addresses how insurers can recover indemnifiable losses. For each jurisdiction in the Asia Pacific region, the guide addresses the following topics: Local legal framework on subrogation; Insurers’ right to subrogate; Investigations prior to subrogated proceedings; Limitation period for subrogated action; Responsibility for costs in subrogated action; Enforcement of judgements for insurers; and Subrogated actions against co-insured parties. The Subrogated Recoveries – Asia Pacific guide is available below.

Thailand’s Personal Data Protection Committee (PDPC) has issued a regulation establishing procedures for filing and processing data subjects’ complaints under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The Regulation Re: Complaint Filing, Rejection, Termination, Consideration, and the Period for the Consideration of the Complaint B.E. 2565 (2022) was issued in July 2022 and took effect on July 12, 2022. The PDPA entitles data subjects to file complaints against data controllers, data processors, and employees or service providers of either whose operations fail to comply with the PDPA. This article lays out the various requirements and procedures for the filing and processing of such a complaint. Complaint Submission The body designated by the PDPA to be responsible for handling complaints and imposing administrative penalties is called the “Expert Committee.” Data subjects who would like to make a complaint can submit it to the Expert Committee directly at the Office of PDPC, send it to the office by post, or submit the complaint electronically. The written or electronic complaint must use clear, plain, polite, and appropriate language, and must not give an impression of being directly or indirectly extorting or intimidating. The complaint must include at least the following information: Name, address, and telephone number or email address of the complainant (or an authorized representative), together with identification card, passport, or other official identification document (plus a power of attorney if submitted by a representative); Details and facts of the noncompliance with or violation of the PDPA; Details of resulting damages or impact; Supporting evidence (e.g., documentary evidence, physical evidence, witness statements); and Action desired of the offender. The complaint must include a statement certifying its veracity, and must be signed by the complainant or the authorized representative. Complaint Consideration When a complaint is submitted, the receiving official will verify that the complaint is complete and then issue a receipt to

In 2021, Thailand passed the updated Narcotics Act (No. 8) B.E. 2564 (2021), which removed kratom (Mitragyna speciosa) from the list of prohibited substances, eliminated kratom-related offenses on the basis that its consumption is part of traditional Thai cultural norms, and allowed possession and consumption. On August 26, 2022, Thailand published the Kratom Plant Act B.E. 2565 (2022) in the Government Gazette, and the law came into effect the following day. With the aim of encouraging economic activity related to kratom, the act regulates the trade, sale, consumption, study, and advertising of kratom leaves (alone or as an ingredient in food) in Thailand. Importing and Exporting Kratom Leaves Importing and exporting kratom leaves without obtaining a license from the secretary-general of the Narcotics Control Board (NCB) is prohibited under the Kratom Plant Act. Eligible license recipients include: Thai nationals over twenty years old and residing in Thailand; Juristic persons registered under Thai law; Community enterprises under the law; and Government agencies. A license is valid for five years, and importers and exporters must still notify the NCB when importing or exporting kratom leaves. An exception to the licensing requirement is bringing kratom leaves in and out of Thailand for personal consumption, therapy, and treatment of an illness. The amounts allowed for international travel are to be specified in ministerial regulations. If the amount of the kratom leaves exceeds this allowance, the transport will be considered importing or exporting of kratom leaves, triggering the licensing requirements described above. Violation of these requirements is subject to imprisonment for up to one year, a maximum fine of THB 100,000, or both. Selling Kratom The Kratom Plant Act also allows the sale of kratom leaves alone or as an ingredient in food, subject to certain conditions. Under the law, sales of kratom include selling, dispensing, distributing, exchanging, or giving the substance to others. The laws measures

In the course of our work, we often hear about consumers in Thailand lodging complaints with the Office of the Consumer Protection Board (OCPB) about problems with a purchased product or service. The OCPB is a government agency attached to the Office of the Prime Minister. Its main duties are to protect consumers in Thailand with respect to product advertising, product labeling, and contracts, and to handle consumer complaints. However, there are exceptions to the types of consumer complaints that the OCPB can handle. This is because some consumer complaints must by law be handled by certain specialized agencies. Examples of these exceptions include consumer complaints relating to: health products (food, drugs, cosmetics, medical devices, household dangerous substances, and narcotics); medical services; insurance; pricing of consumer products; condominium juristic person; public land; rail, water, and air transportation; tourism; education; banking and finance; telecommunications; and electricity and water consumption. Procedure When a consumer complaint that the office can accept comes to the OCPB, the officers first consider whether the business operator has violated any laws, in which case the relevant authorities, such as the police, should handle the matter. When the officers consider it appropriate, they may ask the parties to mediate the dispute. Complaints in Bangkok are mediated by officers at the Bangkok OCPB. For complaints lodged in other provinces, the governors of the provinces may assign officers or agencies under their supervision to mediate. The OCPB can mediate twice within 90 days. If the parties still want to continue with the mediation, a subcommittee of the Consumer Protection Board (CPB)—the body that directs the OCPB—will then conduct two more mediation sessions within 90 days. If a resolution is still not reached, the subcommittee can conduct one additional mediation session before declaring the mediation failed and ending the complaint process. At this point, if the CPB determines that the case involves a matter of public interest (such

Throughout 2022, the Central Bank of Myanmar (CBM) has implemented a series of rules surrounding the compulsory conversion of foreign currency balances in the country. This began on April 3, when the CBM issued a notification directing foreign currency holders in Myanmar to convert their foreign earnings into Myanmar kyat (MMK), within one day, at the official exchange rate. Since then, the CBM has issued further clarifications and instructions for banks authorized to handle foreign currency, responded to some concerns from foreign investors by exempting certain foreign investment projects from the conversion requirement, and relaxed the currency conversion requirements for trade at the Chinese and Thai borders. The process has not been without some trial-and-error as well, with the CBM walking back some exemptions after they were enacted. Foreign investors and business owners, both in the country and abroad, have raised concerns about this centralized control of foreign currency flow and the depletion of foreign currency in Myanmar’s business community. To help readers understand the sometimes-surprising moves by the CBM over the past months, this article will summarize the key developments in the CBM’s efforts relating to foreign currency conversion. Establishment of Compulsory Exchange Requirement On April 3, 2022, the CBM issued Notification No. 12/2022 and Directive No. 4/2022 requiring nearly all individuals, companies, and other organizations in Myanmar to convert foreign-currency income received from abroad to MMK within one working day of receipt. These requirements took immediate effect for all transfers and applied retroactively to foreign currency balances already in the country. All authorized dealer (AD) banks (i.e., those licensed to exchange foreign currency) were instructed to convert foreign currency held in the foreign currency accounts of “internal residents”—which included locally registered companies, organizations, and offices; Myanmar branches of foreign companies; and individuals residing or established in Myanmar for at least

While much attention has been paid to the data localization requirements for foreign enterprises under Vietnam’s 2018 Cybersecurity Law (“CSL”) and the recently issued Decree 53 guiding its implementation, the corresponding requirements for domestic enterprises are often overlooked, despite being potentially more troublesome. Under Decree 53, “domestic enterprises” are defined to mean enterprises established or registered for establishment under Vietnamese law and having their head offices in Vietnam (Article 2.11), so this designation includes not only Vietnamese companies, but foreign-invested enterprises as well. Background Before analyzing the stipulations in Articles 26 and 27 of Decree 53 further guiding the data localization/storage requirements, it is worth restating the very problematic Article 26.3 of the CSL, which reads: “Domestic and foreign enterprises providing services on telecommunication networks or the internet or value-added services in cyberspace in Vietnam with activities of collecting, exploiting, analyzing, and/or* processing personal information data, data on the relationships of service users, or data generated by service users in Vietnam must store such data in Vietnam for the period prescribed by the government. Foreign enterprises mentioned in this clause must open branches or representative offices in Vietnam.” [* Note: The Vietnamese text simply uses a comma here, without specifying whether this should be “and” or “or,” leading to additional problems in interpretation.] Because of this very broad and ambiguous wording, Article 26.3 of the CSL required further guidance from the government and remained unenforced for more than three years after the CSL took effect on January 1, 2019. Decree 53 guiding the implementation of the CSL was finally issued on August 15, 2022, and provides additional clarity on this matter. But does Decree 53 provide sufficient guidelines for implementation with regard to domestic enterprises? Scope of Application With regard to foreign enterprises, although there remains some ambiguity, Decree 53 provides clearer guidelines by specifying 10 types

「中小企業」 (SMEs: Small and Medium Enterprises) に対する商品価格・サービス料の支払いにおける与信期間の上限等を定めた2021年5月24日付のタイ取引競争委員会 (TCC: Trade Competition Commission)布告は2021年12月から施行されていた。 この布告においては、「中小企業」が製品やサービスを販売する場合の「中小企業」に対する支払いにおいて与信期間の上限を規定していた。法定の期間よりも長い与信期間を設定することは、仏歴2560年（西暦2017年）取引競争法に違反する不公正取引行為に該当するとされた。上記布告においては、「中小企業」の定義を下記の通りに規定していた。   改正前の「中小企業」の定義 製造業: 従業員数200人以下、又は 年間売上高5億バーツ以下 サービス業、卸売業、小売業: 従業員数100人以下、又は 年間売上高3億バーツ以下 この度、2022年７月６日付のタイ取引競争委員会布告においては「中小企業」の定義が以下の通りに改正された。   改正後の「中小企業」の定義 製造業: 従業員数200人以下、且つ 年間売上高5億バーツ以下 サービス業、卸売業、小売業: 従業員数100人以下、且つ 年間売上高3億バーツ以下   改正前においては、従業員数基準又は売上高基準のどちらか一方のみを満たせばよいことになっていた。 改正後の「中小企業」の定義においては、「中小企業」とみなされるためには、従業員数基準と売上高基準の両方の基準を満たすことが必要とされている。この改正により、「中小企業」に該当する事業者が減少することが予測される。 布告に基づく与信期間を要請するためには、「中小企業」は、従業員数基準及び売上高基準を満たすことを証明する書類を取引先に提出しなければならない。 今回改正された「中 小企業」の定義は2022年9月16日から施行された   備考：本和文は英文記事から作成しました。原文については、以下のリンクをご参照ください。 Thailand Tightens Definition of SMEs Eligible for Special Protection from Unfair Credit Terms