You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

October 1, 2019

The Reach and Liabilities of the Personal Data Protection Act

Subscribe to Updates
Bangkok Post: Human Resources Watch

Earlier this year, Thailand enacted its Personal Data Protection Act (PDPA), which was published in the Government Gazette on 27 May 2019. Most parts of the PDPA will become effective one year after this, on 27 May 2020. As the PDPA will have broad impact across multiple aspects of most businesses—including their human resources operations—lawmakers provided this one-year period for those affected to prepare for compliance with the PDPA.

While the definitions and mechanics of the law in relation to HR operations were covered in a previous Human Resource Watch column (29 April 2019), this article will take a closer look at the civil, criminal, and administrative penalties applicable in the event of non-compliance with the PDPA.

It is important for employers to understand that these liabilities apply to them even if they outsource their company’s HR work. Some employers misunderstand that if they turn over their HR functions to an HR service provider, the employer will not have any liability under the PDPA. Indeed, even if HR functions are outsourced, the employer will still have the same liabilities under the PDPA if the HR service provider breaches the PDPA.

For instance, if an employer assigns an outsourced provider to manage the paying of wages and calculation of social security deductions, where the providers must collect, use or disclose the personal information of employees, both the employer and the HR service provider will be acting in roles defined by the PDPA. In this scenario, the employer would be considered a ‘data controller’, while the HR service provider would be considered a ‘data processor.’ Therefore, both the employer and the HR service provider will have potential liability under the PDPA.

If the employer or HR service provider violates a PDPA provision, such as selling employees’ personal information to a financial institution or other third party without the employees’ consent, the employer as data controller would not only be liable for paying compensation to the employees who own the personal information, but could also face criminal penalties and administrative liability under the PDPA. In addition, the HR service provider, as a data processor, could face civil liability.

The PDPA provides for three types of potential liability for violation of its provisions:

1. Civil Liability

Employers or HR service providers who are found to have violated the PDPA must pay compensation to the employees who own the personal information and who received damages from the violation, regardless of whether the violation was done intentionally or negligently, except where the offender can prove that the damages were caused by force majeure or the employees’ own actions. In addition, offenders who can prove that the violation was a result of their compliance with an order of a government officer exercising his or her duties under the law will not be liable. The compensation includes all necessary expenses associated with actual or likely damages, whether for purposes of prevention or mitigation.

In addition, the court is entitled to award punitive civil damages, up to two times the amount of actual damages.

The prescription period for claiming compensation under the PDPA is three years from the date that the employees who own the personal information became aware of the violation and the identity of the offenders, or ten years from the date on which the violation of the personal data took place.

2. Criminal liability

If an employer as data controller violates the PDPA by the use or disclosure of personal information without consent in a manner that is likely to cause the other person to suffer any damages, impair his or her reputation, or other reason, the offender will face imprisonment of up to six months, a fine of up to Baht 500,000, or both.

In addition, if the offender uses or discloses personal information in order to receive unlawful benefits (or secure benefits for others), the criminal penalties that the offender will face include imprisonment for up to one year, a fine of up to Baht 1 million, or both.

The criminal offence under the PDPA is a compoundable offence, which means that it can be settled by negotiation and agreement between the parties before a court issues a final judgment.

In a case where the offender is a juristic person and the offence occurs as a result of the order or act of any director, manager, or other person in a role of responsibility, those persons must be liable for the relevant penalties. Likewise, these persons can also be penalized for their omission of an instruction or act resulting in the commission of the offence by the juristic person.

3. Administrative liability

The PDPA also imposes administrative liability on any offender in the form of an administrative fine from Baht 500,000 to Baht 5 million, depending on the nature of the violation. The PDPA establishes an expert committee with the authority to order offenders to pay an administrative fine, issue an order for rectification, or issue a warning to the offender. In determining whether to impose an administrative fine, the expert committee will consider the severity of the circumstances of the offence, the size of the business of the data controller (e.g., an employer) or data processor (e.g., HR service provider or HR department), or other circumstances.

It is possible that specific classes of data controller could be exempted from the application of all or part of the provisions of the PDPA (in addition to the excepted activities, on which see the previous article on this topic). However, these exemptions would have to be made by royal decree.

As it stands now, though, exceptions for classes of person have not been promulgated, and employers should not expect that they will be automatically exempt from PDPA compliance. Recent news from Europe of companies being heavily fined for their violations of the EU’s General Data Protection Regulation (upon which much of the PDPA is based) underline the dangers of continuing to neglect the protection of personal data. With Thailand only months away from joining the EU and other jurisdictions around the world in implementing a robust data protection regime, businesses must ensure the compliance of all of their operations—including in-house or outsourced HR functions—to avoid such costly penalties.

 

This article was originally published in the Bangkok Post and is reproduced here with permission and thanks. The original story can be viewed on the Bangkok Post website.

Related Professionals

Practices

Employment

Location

RELATED INSIGHTS​ 

August 12, 2024
With the growing prominence of ESG (Environmental, Social, and Governance) factors, businesses in Vietnam are increasingly recognizing their importance in driving global demand, societal impact, and economic value. A comprehensive acknowledgment of ESG-related legal requirements is critical for investors and companies operating in Vietnam to meet stakeholder expectations and ensure compliance. Our guide provides a basic overview of the rapidly evolving ESG landscape in Vietnam, covering a range of key issues for companies doing business in the country: What is ESG, and what does the ESG legal framework look like in Vietnam? Who needs to follow ESG regulations in Vietnam? What are the benefits of ESG compliance? How can enterprises enhance ESG best practices in Vietnam? Please click on the link below to view the full article.
Read More
August 2, 2024
On July 17, 2024, Thailand issued the Ministerial Regulation under the Revenue Code regarding Revenue Tax No. 394 (B.E. 2567) to increase the personal income tax exemption amount on severance pay for terminated employees. Under this ministerial regulation, terminated employees are exempt from personal income tax on their severance pay up to a severance pay amount equivalent to their last 400 days’ wages, capped at THB 600,000. This tax exemption does not apply to severance pay relating to retirement or the expiration of a fixed-term employment agreement. Previously, this exemption, which has been in effect since 1998, only applied to an amount equivalent to their last 300 days’ wages, capped at THB 300,000. This aligned with the maximum severance pay rate specified in the Labour Protection Act B.E. 2541 (LPA). However, when the LPA was amended in 2019, the maximum severance pay rate was increased from a rate equal to employees’ last 300 days’ wages for those who have worked for 10 years or more, to a rate equal to employees’ last 400 days’ wages for those who have worked for 20 years or more. The recent ministerial regulation was enacted accordingly to align with the updated severance pay rate and account for Thailand’s rising inflation rate. The new exemption rate applies to assessable income received from January 1, 2023, onward. For any excess severance pay withheld in 2023 and filed in 2024, individuals may request a tax refund from the Revenue Department, according to Revenue Department clarification. This should be done according to the applicable procedure within three years of the income tax return filing deadline. For more information on severance pay exemptions, or any aspect of employment law in Thailand, please contact Pimvimol (June) Vipamaneerut at [email protected], Ketnut Pukahuta at [email protected], Dusita Khanijou at [email protected], or Chomanut
Read More
June 20, 2024
“Forced labor” has many incarnations. Some forms are shocking, such as a case in 2021 where Vietnamese guest workers were brought to a Chinese-owned factory in Serbia that manufactured tires sold to European car companies. The guest workers allegedly had their passports taken away and were subjected to horrible living conditions, including a lack of food, forcing them to resort to hunting small animals in the nearby forest to survive. However, forced labor more often takes subtler forms, so that most people do not even recognize it as such. For example, a factory may receive an order with an extremely short production deadline, and the workers are instructed to work overtime hours. If the employees refuse to do so and stop working when their regular shift ends, they receive warning letters the next day. While less shocking than the situation of the guest workers forced to hunt squirrels to survive, it is also forced labor. ILO Convention No. 29 on Forced Labor defines forced labor as “all work or service…extracted from any person under the menace of any penalty and for which the said person has not offered…[them]self voluntarily.” The ILO names 11 indicators of forced labor: abuse of vulnerability, deception; restriction of movement, isolation, physical/sexual violence, intimidation and threats, retention of identity documents, withholding of wages, debt bondage, abusive working or living conditions, and excessive overtime. Excessive overtime in particular is common in the manufacturing sector in Southeast Asia, and debt bondage is also prevalent. Some companies demand employees provide a “training deposit” when they commence their employment, which they will have repaid provided they continue working for a minimum period. However, these common practices may soon be eradicated due to new supply chain due diligence legislation. Two such examples demonstrating this greater focus on forced labor within
Read More
April 12, 2024
On April 10, 2024, new minimum wage rates for workers in certain hotels in Thailand were published in the Government Gazette, taking effect on April 13, 2024. Under the Notification of the National Wage Committee on Minimum Wage Rate for the Hotel Industry, the new minimum wage rate is THB 400 per day, applicable to employees working in four-star (and above) hotels that have at least 50 employees and are located in the following specific areas: Bangkok: Pathumwan and Wattana districts Krabi: Ao Nang Subdistrict Administrative Organization areas Chon Buri: Pattaya city Chiang Mai: Chiang Mai municipality Prachuap Khiri Khan: Hua Hin municipality Phang-nga: Khukkhak sub-district municipality Phuket: Whole province Rayong: Phe subdistrict Songkhla: Hat Yai municipality Surat Thani: Koh Samui municipality Rationale The increase in the minimum wage is to drive and stimulate the economy in Thailand’s tourism industry, which is critical to the overall economy of the country. The ten areas identified above are those that earn a significant portion of their revenue from tourism. The decision underwent a public hearing process involving stakeholders. Although there were objections from some hotels claiming they were not yet ready to bear the increased costs, the law was enacted, taking effect on April 13, 2024. For more information on Thailand’s minimum wage regulations, or on any aspect of employment law in Thailand, please contact Pimvimol (June) Vipamaneerut at [email protected], Ketnut Pukahuta at [email protected], Dusita Khanijou at [email protected], or Chomanut Arif at [email protected].
Read More