You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

April 30, 2019

Employers Brace Themselves as New Personal Data Protection Act Looms

Subscribe to Updates
Bangkok Post: Human Resources Watch

The draft Personal Data Protection Act (PDPA) was approved by the National Legislative Assembly in February 2019, raising concern among business entities over the the need for increased diligence to ensure adherence to the provisions. Running a business often entails handling the personal data of employees, contractors, suppliers, customers, and others. Any personal data collected could be subject to the provisions of the PDPA, and as employee data falls under the PDPA, all businesses, should be prepare to deal with the impact of the PDPA.

Although this final version of the PDPA has not yet been endorsed by the king and published in the Government Gazette, the endorsement and publication is expected soon.

The majority of the provisions in the PDPA will only come into force a year after its publication in the Government Gazette. This transitional period will allow any entity subject to the PDPA to review and adjust their personal data–related activities.

What is Personal Data?

Personal data is broadly defined as any data about a person that enables the identification of that person, whether directly or indirectly, but specifically excluding data of the deceased. This can include a person’s name, identification card number, email address, mobile phone number, health information, payroll information, or bank account number. 

Data Controller or Data Processor?

The PDPA sets out different duties and obligations for a data controller and a data processor. A data controller is defined as any person or legal entity that has the power and duty to make decisions on whether to collect, use, or disclose personal data. In contrast, a data processor is defined as any person or legal entity that collects, uses, or discloses personal data on behalf of, or pursuant to, the instructions of the data controller. Since employers have the power to determine which categories of personal data should be collected and retained, they are therefore acting as data controllers.

Obtaining Consent

Collection, use, or disclosure of personal data is generally prohibited unless consent from the data subject has been obtained or unless it falls within an exemption prescribed under the PDPA.  The exemptions include, among others, when it is necessary to comply with a contract to which the data subject is a party, or pursuant to the requests of the data subject prior to entering into a contract; and when it is necessary for the legitimate interest of the data controller, other person, or other entity, unless such interest is less significant that the fundamental right of the data subject.

Employers, therefore, should carefully consider whether separate consent must be obtained from their employees or the language of the employment agreement is sufficient for the purpose of possessing their employees’ personal data in compliance with the PDPA.

If separate consent is required, such a request must

  1. be made prior to, or at, the time of collection;
  2. be made in writing or via electronic means;
  3. be clearly separated from other terms;
  4. be in an easily accessible format or use terms which are understandable;
  5. be written in plain language; and
  6. not be misleading or deceptive.

The PDPA, however, does not specifically require that the consent must be made in Thai language.

Sensitive Personal Data

Most companies require their employees to provide information relating to their health, race, religion, or biometric data (e.g., fingerprints). These categories of personal data are considered as sensitive personal data. The PDPA expressly prohibits the collection of such data unless explicit consent from the data subject has been obtained, or unless otherwise exempted.

One of the exemptions is where the sensitive personal data is collected for labour protection, social security, or national health security purposes, and it is deemed as necessary for the data controller or data subject to satisfy his or her rights or obligations.

It is still unclear whether collecting sensitive personal data of employees would fall within the scope of this exemption. Hence, employers should closely observe the PDPA and its subordinate regulations once they come into force.

Use of Personal Data

Personal data can only be used for the purposes for which the consent has been granted. Therefore, if the purpose of use has changed, fresh consent from the employee must be obtained.

Retention Period

Where a request for consent is required, the employer must inform employees about the period for which their personal data will be retained.

As the longest prescription period for various labour disputes, including unfair termination, is ten years from the date the claim could be enforced, employers should consider retaining their employees’ personal data until the period of prescription expires. Regardless of the length of the retention period that the employer ultimately chooses, they must ensure that this retention period is clearly communicated to the employees.

Cross-border Transfer

Companies often transfer employees’ personal data within their group of companies, some of which might be located overseas. If such transfer complies with the company’s internal policy for sharing personal data in accordance with the requirements of the PDPA, it would be exempt from the general PDPA requirement for transferring data international—i.e the employer would not need to ensure that the destination country implements an appropriate standard for personal data protection, or obtain further consent. Whether or not an internal policy renders such a transfer exempt is likely to be a matter of some dispute, and companies wishing to transfer data internationally should be particularly cautious about this exemption.

Grandfather Provision

As for employees’ personal data that has been collected prior to the PDPA coming into effect, employers may continue to use this data without the need to obtain consent, provided such data is used solely for the purpose for which it was originally collected, and that the employer complies with the PDPA when doing so.

Rights of the Data Subject

Employers should ensure that their employees have been clearly informed of their rights under the PDPA, including, but not limited to, right of access, right to data portability, right to withdraw consent, and right to erasure.

Other Obligations

Under the PDPA, the employer, as the data controller, has an obligation to ensure that any other person or entity to whom the personal data is disclosed will not use or disclose such personal data unlawfully or without authorization.

Data processors are also required to implement appropriate security measures to prevent access that would enable the use, alteration, amendment, or disclosure of the personal data unlawfully or without authorization. Therefore, where there are inappropriate security measures, it may prove difficult for an employer to escape liability in the event of a data breach.

Penalties

Non-compliance with the PDPA could lead to severe civil liabilities, administrative liabilities, and criminal penalties—the latter two including fines of up to THB 5 million, and even imprisonment.

How Should Employers Prepare?

  • Review current personal data protection policies, employment contracts, and work rules to ensure the terms will be compliant with the PDPA (and any other relevant laws). 
  • Review agreements with customers, contractors, suppliers, and any other related parties.
  • Ensure that an appropriate, PDPA-compliant system for personal data protection is in place.
  • Identify categories of personal data that are required for a business’s legitimate purposes, and only collect and retain such data.
  • Provide personal data protection training for employees.

It is essential that all employers closely observe and adhere to the PDPA and subordinate regulations once they come into force, and prepare themselves well in advance, in order to ensure their employee personal data–related activities do not violate any applicable laws. Those who fail to do so could find themselves faced with angry employees and severe penalties.

 

This article was originally published in the Bangkok Post on April 29, 2019, and is reproduced here with permission and thanks. The original can be viewed on the Bangkok Post website, or by downloading the pdf below.

Download Full Article
Related Professionals

Practices

Employment

Location

RELATED INSIGHTS​ 

October 28, 2022
Tilleke & Gibbins employment specialists in Myanmar have contributed an updated Myanmar chapter to Employment and Employee Benefits Global Guide, a Thomson Reuters Practical Law online publication that provides an overview of employment and employee benefits in jurisdictions worldwide. The Myanmar chapter was written by members of Tilleke & Gibbins’ Yangon office, including Yuwadee Thean-ngarm, director; Nwe Oo, senior associate; Sher Hann Chua, consultant; and Kyaw Min Tun, consultant. The chapter covers a wide range of key employment topics, including employment status, background checks, regulation of the employment relationship, minimum wage, working hours and holidays, illness and injury of employees, discrimination and harassment, termination of employment, resolution of employer-employee disputes, redundancy/layoffs, employee representation and consultation, business transfer and insolvency, employee relocation, health and safety obligations, taxation of employment income, intellectual property issues, and more. Practical Law, produced by Thomson Reuters, is the world’s leading legal resource for business lawyers, publishing a huge range of guides for hundreds of jurisdictions and practice areas. The Employment and Employee Benefits Global Guide covers 46 jurisdiction around the world, with Tilleke & Gibbins also providing the Vietnam chapter of the guide. To view the latest version of the Myanmar chapter, please visit the Practical Law website.
Read More
October 10, 2022
Thailand’s recent removal of cannabis from the list of narcotics represents a significant development for the country, and it has some human resources teams wondering whether they should prepare certain measures in order to prevent detrimental incidents from happening in their organizations. For example, some employees could still be under the influence of cannabis because they used it before coming to work. In the past, this was rarely a consideration as cannabis was clearly banned. Using cannabis or possessing cannabis inside the employer’s premises subjected employees to criminal liability including imprisonment and fines. However, now that the government has removed cannabis from the narcotics list under the Narcotics Act, such incidents are more likely to occur. This likelihood has led to concern among many employers about how they can prevent or handle these incidents. An employer does have the right to prohibit any employee from bringing cannabis inside its premises, as it is the property of the employer. The employer has the management right to do this, particularly as an employee’s use of cannabis may very well disturb other employees. But if the employer would like to set penalties for breaching the prohibition, the picture is more complicated. Employers’ Work Rules Under the Labour Protection Act (LPA), an employer who has at least 10 employees must have Thai-language work rules. These work rules must include the following items: Specification of working days, regular working hours, and rest periods; Holidays and rules for taking holidays; Rules concerning overtime work and work on holidays; Arrangements for payment of wages (i.e., schedule and location); Overtime pay, holiday pay, and holiday overtime pay; Leave and rules for taking leave; Discipline and disciplinary actions; Submission of grievances; and Termination of employment, severance pay and special severance pay. To issue or amend work rules (e.g.,
Read More
October 7, 2022
On October 3, 2022, Thailand’s Ministry of Labour issued an announcement canceling the prohibition on lockouts and strikes, which had been in place since the onset of the COVID-19 pandemic. While this cancellation does not apply to ongoing labor disputes already being considered under the interim arrangements, it will apply to all other labor disputes from October 5, 2022, when it was published in the Government Gazette. Lockouts and strikes are basic rights of employers and employees under the Labour Relations Act B.E. 2518 (1975). However, these rights can be suspended—as they have been since May 8, 2020, when the Ministry of Labour announced that all labor disputes that could not be resolved through negotiation must be presented to the Labour Relations Committee in lieu of organizing strikes or lockouts. The announcement referred to the necessity of such special administration during the COVID-19 situation in order to prevent possible negative impacts on both employers and employees. On September 30, 2022, Thailand ended its COVID-19 emergency decree and dissolved the country’s Centre for COVID-19 Situation Administration. In light of this, the Ministry of Labour decided to end the requirement that unresolved labor disputes be sent to the Labour Relations Committee. The ministry’s cancellation of the prohibition will once again allow employers and employees to organize lockouts and strikes under the Labour Relations Act, starting October 5, 2022. For more details on this development, or for assistance with employment-related questions or disputes in Thailand, please contact Tilleke & Gibbins at [email protected] or +66 2056 5555.
Read More
August 30, 2022
On August 26, 2022, Thailand’s National Wage Committee voted to raise the minimum wage to THB 328–354 per day (USD 9.01–9.72)—an increase of approximately 5% from the previous range of THB 313–336. The decision to boost minimum wages, which were last increased in January 2020, came after a 14-year-high headline inflation rate of 7.61% in July 2022. The new minimum wages have been submitted to the cabinet for final approval and are expected to take effect on October 1, 2022, following publication in the Government Gazette. The exact minimum wage depends on the province in which the workplace is located, as shown in the table below. These minimum rates are for one working day, which consists of eight hours for normal work, or seven hours for work that may be harmful to the health and safety of the employee. Legal Requirements After the new minimum wages are announced in the Government Gazette, employers may not pay employees wages below the prescribed rates. Violations are punishable by imprisonment for up to six months, a fine of up to THB 100,000, or both. Regarding the question of whether employers can reduce the working hours in order to pay less than minimum wages (e.g., a prorated amount), based on past practice, the National Wage Committee’s announcement is expected to provide that a “day” refers to an employee’s normal working day, regardless of whether it is shorter than the “normal working hours” set by the employer under the Labor Protection Act. For example, an employee in Bangkok who earns the current minimum wage of THB 331 per day for normal working hours of eight hours a day would still be entitled to the full new rate of THB 353 per day in October 2022, even if the employer reduces the working hours. For
Read More