You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

October 1, 2019

The Reach and Liabilities of the Personal Data Protection Act

Subscribe to Updates
Bangkok Post: Human Resources Watch

Earlier this year, Thailand enacted its Personal Data Protection Act (PDPA), which was published in the Government Gazette on 27 May 2019. Most parts of the PDPA will become effective one year after this, on 27 May 2020. As the PDPA will have broad impact across multiple aspects of most businesses—including their human resources operations—lawmakers provided this one-year period for those affected to prepare for compliance with the PDPA.

While the definitions and mechanics of the law in relation to HR operations were covered in a previous Human Resource Watch column (29 April 2019), this article will take a closer look at the civil, criminal, and administrative penalties applicable in the event of non-compliance with the PDPA.

It is important for employers to understand that these liabilities apply to them even if they outsource their company’s HR work. Some employers misunderstand that if they turn over their HR functions to an HR service provider, the employer will not have any liability under the PDPA. Indeed, even if HR functions are outsourced, the employer will still have the same liabilities under the PDPA if the HR service provider breaches the PDPA.

For instance, if an employer assigns an outsourced provider to manage the paying of wages and calculation of social security deductions, where the providers must collect, use or disclose the personal information of employees, both the employer and the HR service provider will be acting in roles defined by the PDPA. In this scenario, the employer would be considered a ‘data controller’, while the HR service provider would be considered a ‘data processor.’ Therefore, both the employer and the HR service provider will have potential liability under the PDPA.

If the employer or HR service provider violates a PDPA provision, such as selling employees’ personal information to a financial institution or other third party without the employees’ consent, the employer as data controller would not only be liable for paying compensation to the employees who own the personal information, but could also face criminal penalties and administrative liability under the PDPA. In addition, the HR service provider, as a data processor, could face civil liability.

The PDPA provides for three types of potential liability for violation of its provisions:

1. Civil Liability

Employers or HR service providers who are found to have violated the PDPA must pay compensation to the employees who own the personal information and who received damages from the violation, regardless of whether the violation was done intentionally or negligently, except where the offender can prove that the damages were caused by force majeure or the employees’ own actions. In addition, offenders who can prove that the violation was a result of their compliance with an order of a government officer exercising his or her duties under the law will not be liable. The compensation includes all necessary expenses associated with actual or likely damages, whether for purposes of prevention or mitigation.

In addition, the court is entitled to award punitive civil damages, up to two times the amount of actual damages.

The prescription period for claiming compensation under the PDPA is three years from the date that the employees who own the personal information became aware of the violation and the identity of the offenders, or ten years from the date on which the violation of the personal data took place.

2. Criminal liability

If an employer as data controller violates the PDPA by the use or disclosure of personal information without consent in a manner that is likely to cause the other person to suffer any damages, impair his or her reputation, or other reason, the offender will face imprisonment of up to six months, a fine of up to Baht 500,000, or both.

In addition, if the offender uses or discloses personal information in order to receive unlawful benefits (or secure benefits for others), the criminal penalties that the offender will face include imprisonment for up to one year, a fine of up to Baht 1 million, or both.

The criminal offence under the PDPA is a compoundable offence, which means that it can be settled by negotiation and agreement between the parties before a court issues a final judgment.

In a case where the offender is a juristic person and the offence occurs as a result of the order or act of any director, manager, or other person in a role of responsibility, those persons must be liable for the relevant penalties. Likewise, these persons can also be penalized for their omission of an instruction or act resulting in the commission of the offence by the juristic person.

3. Administrative liability

The PDPA also imposes administrative liability on any offender in the form of an administrative fine from Baht 500,000 to Baht 5 million, depending on the nature of the violation. The PDPA establishes an expert committee with the authority to order offenders to pay an administrative fine, issue an order for rectification, or issue a warning to the offender. In determining whether to impose an administrative fine, the expert committee will consider the severity of the circumstances of the offence, the size of the business of the data controller (e.g., an employer) or data processor (e.g., HR service provider or HR department), or other circumstances.

It is possible that specific classes of data controller could be exempted from the application of all or part of the provisions of the PDPA (in addition to the excepted activities, on which see the previous article on this topic). However, these exemptions would have to be made by royal decree.

As it stands now, though, exceptions for classes of person have not been promulgated, and employers should not expect that they will be automatically exempt from PDPA compliance. Recent news from Europe of companies being heavily fined for their violations of the EU’s General Data Protection Regulation (upon which much of the PDPA is based) underline the dangers of continuing to neglect the protection of personal data. With Thailand only months away from joining the EU and other jurisdictions around the world in implementing a robust data protection regime, businesses must ensure the compliance of all of their operations—including in-house or outsourced HR functions—to avoid such costly penalties.

 

This article was originally published in the Bangkok Post and is reproduced here with permission and thanks. The original story can be viewed on the Bangkok Post website.

Related Professionals

Practices

Employment

Location

RELATED INSIGHTS​ 

March 27, 2024
Cambodia’s Ministry of Labor and Vocational Training issued the Notification on the Compensation for Terminating an Employment Contract on March 21, 2024, clarifying the compensation due to employees upon the termination of their employment contracts. The notification outlines different requirements depending on the nature of the termination and the type of employment contract, as laid out below. Termination without Valid Reason and in Absence of Serious Misconduct If an employment contract has been terminated by an employer without a valid reason and the employee did not commit any serious misconduct as defined under the relevant article of the Labor Law, the employer must compensate the employee as follows: Fixed-Duration Contract: Wages that have not yet been paid; Unused and unpaid annual leave through the termination date; Severance payment equal to at least 5% of the wages paid to the employee during the length of the contract; and Damages for being laid off before the expiration date of the fixed-duration contract, at least equal to the wages the employee would have received had he or she completed the original contracted term of employment. Unspecified-Duration Contract: Wages that have not yet been paid; Unused and unpaid annual leave through the termination date; Compensation in lieu of notice if the employer did not give prior notice in accordance with the Labor Law; Seniority indemnity for the semester that the employee is terminated and total seniority back payments that have not been paid; and Damages for being laid off, in an amount equal to the seniority payment received during the employment contract. Termination in Cases of Serious Misconduct Employees who commit any serious misconduct as defined under the Labor Law (regardless of whether they are under a fixed-duration or unspecified-duration contract) are entitled only to the following compensation: Wages that have not yet
Read More
March 18, 2024
Lawyers from Tilleke & Gibbins’ labor and employment team have contributed a new Vietnam chapter to Thomson Reuters Practical Law’s Employment and Employee Benefits Global Guide. The guide provides a high-level comparative overview of employment laws and regulations across various jurisdictions around the world. Tilleke & Gibbins also contributed the Myanmar chapter of the guide. The Vietnam chapter covers a wide range of typical employment matters, such as limitations on working hours, paid leave requirements, minimum wage, and health and safety obligations. In addition, the guide provides insight on a number of topics of special interest to foreign investors doing business in Vietnam, including the following: Mandatory contents of a labor contract; Visas and permits required for expatriate employees; Employers’ obligations for protecting employees’ privacy and personal data; Procedural requirements for the dismissal of an employee; Employer and parent company liability. To view the latest version of Employment and Employee Benefits, please visit the Practical Law website and enroll in the free Practical Law trial to gain full access.
Read More
February 28, 2024
The Myanmar Investment Commission (MIC) has announced the opening of the trial period for MIC-permitted or MIC-endorsed companies to reenter investment data for using the Myanmar Investment Online (MyInO) system. The trial period is open until June 30, 2024. The MyInO system allows for the submission and recordal of applications for investment under the Myanmar Investment Law. With the implementation of phase 2 from September 1, 2023, applications for the appointment or resignation of foreign experts and employees within MIC-permitted or MIC-endorsed companies can now be submitted manually or through the Investment Monitoring System available on MyInO. To initiate the application process in MyInO, applicants are required to create an account on the platform. Subsequently, companies holding an MIC permit or endorsement must reenter all investment-related data since the obtaining of the relevant permits/endorsements, in compliance with the announcement. Following this data update, applications can be filed through MyInO. After this trial period, the submission of applications for appointments will be available online. The benefit of using MyInO to submit a foreign expert or employee appointment or resignation application is that the application can be submitted within 30 days of the foreign expert’s arrival in Myanmar. In contrast, hard copy applications must be submitted within seven working days of arrival. According to the Myanmar Investment Law, a foreign expert is one who qualifies as a senior manager, technical or operational expert, or advisor in permitted or endorsed companies within Myanmar. For assistance with completing the investment data reentry process or filing applications for appointment or resignation of foreign experts or employees, or for further details on any aspect of the Investment Monitoring System under MyInO, please contact Tilleke & Gibbins at [email protected].
Read More
February 9, 2024
Tilleke & Gibbins employment specialists in Myanmar have contributed an updated Employment and Employee Benefits in Myanmar overview for Thomson Reuters Practical Law, an online publication that provides an overview of employment and employee benefits in jurisdictions worldwide. The Myanmar overview was written by members of Tilleke & Gibbins’ Yangon office, including Yuwadee Thean-ngarm, director; Nwe Oo, senior associate; and Kyaw Min Tun, associate. The chapter covers a wide range of key employment topics, including employment status, background checks, regulation of the employment relationship, minimum wage, working hours and holidays, illness and injury of employees, discrimination and harassment, termination of employment, resolution of employer-employee disputes, redundancy/layoffs, employee representation and consultation, business transfer and insolvency, employee relocation, health and safety obligations, taxation of employment income, intellectual property issues, and more. Practical Law, one of the many legal reference resources from Thomson Reuters, publishes a wide range of guides for hundreds of jurisdictions and practice areas. The Employment and Employee Benefits Global Guide covers 44 jurisdictions around the world, with Tilleke & Gibbins also providing the Vietnam chapter of the guide. To view the latest version of the Employment and Employee Benefits in Myanmar overview, please visit the Practical Law website and enroll in the free Practical Law trial to gain full access.
Read More