Thailand’s Department of Mineral Fuels (DMF) has developed a framework to regulate carbon capture and storage (CCS) and related activities by introducing “carbon business” to the draft amendment to the Petroleum Act B.E. 2514 (1971). CCS involves the capture, treatment, transport, and underground storage of carbon dioxide produced from industrial power generation. The captured carbon can be used to enhance oil recovery, converted into fuel such as methane or DME (dimethyl ether), or converted to higher-value products. In Thailand, various companies have carried out CCS feasibility studies. Carbon Business and Licensing Under the draft amendment to the Petroleum Act, “carbon business” is defined as exploration for purposes of carbon storage or compression of carbon into carbon storage, while “carbon” is defined as carbon dioxide in the state of gas or supercritical fluid generated as a byproduct or captured from other sources and transported for storage. Any concessionaire, product-sharing contractor, or service contract holder that has been granted permission to explore for or produce petroleum under the Petroleum Act can apply for a carbon business license from the director-general of the DMF with the approval of the Petroleum Committee. Licenses are also available to any other parties who meet the eligibility criteria to be prescribed later by a ministerial regulation. Licenses for these parties will be allocated through competitive bidding according to procedures to be announced by the minister of the Ministry of Energy (MOE). In granting a license, the minister of the MOE and the director-general of the DMF will consider the geological suitability of carbon storage, storage systems, surrounding areas of carbon storage, risk of carbon leakage and movement, environmental impacts, and the applicant’s financial potential and ability in environmental management. Responsibilities of Carbon Business Operators Carbon business operators are required to monitor and inspect their installations, structures,

On 17 April 2023, the Vietnamese government issued the Personal Data Protection Decree, which is set to take effect 1 July 2023 without any transitional period. The PDPD is considered to be the first comprehensive document on data protection in Vietnam. Accordingly, it provides detailed regulations on the rights of data subjects, consent requirements and requirements for data processing impact assessments and outbound transfer impact assessments. In 2024, the adoption of the Law on the Protection of Consumer Rights and the Law on Electronic Transactions will play a vital role regarding data protection. The LPCR will require traders to obtain consent to collect consumer data and establish a mechanism enabling consumers to select the information they consent to traders collecting. Consumers must also be allowed to express consent in a suitable form. For special processing purposes — such as sharing, disclosure, or transfer of personal data to third parties, and use of personal data to send advertisements and to introduce products — the LPCR requires a mechanism which enables data subjects to clearly opt in to give, or not give, their consent. This requirement is similar to procedures currently required for regulated stakeholders under the PDPD. In the same vein, the LET strictly forbids the acts of trading data to protect Vietnamese personal data. The government is anticipated to provide more details relating to data privacy guidelines after the issuance of the Draft Law on Telecommunications. Accordingly, the draft requires enterprises to provide the requisite information — such as service user’s name and address, number and location of transmitting or receiving servers, call times, IP address and other personal information supplied by the service user when entering a contract — to the relevant authority, as per a request which is made in accordance with the law. Amendments to Decree

Thailand’s Personal Data Protection Act came into full effect on 1 June 2022 and various subordinate regulations have since been issued by the Personal Data Protection Committee. These include regulations on security measures to be implemented by data controllers, data breach notification requirements, a mandatory obligation to appoint a data protection officer when the processing activity requires regular monitoring of personal data or a system due to the large scale of personal data, administrative measures and data processors’ record of processing activities. As some areas under the PDPA still require further clarifications, a series of public consultations for the remaining draft subordinate regulations is anticipated in 2024. Potential areas include data protection impact assessments and cross-border transfers of personal data, which are crucial for organizations and particularly for entities with establishments in other jurisdictions. PDPA enforcement by Thai regulators was silent until the last quarter of 2023, when the PDPC published details about complaints that have been lodged to the Expert Committee. The committee is designated by virtue of the PDPA and has the power to make determinations related to imposing administrative fines and other penalties. Enforcement in 2024 is expected to become more active and potentially more serious, which means organizations should pay closer attention to ensure compliance with the PDPA. Similar to the GDPR, the PDPA also has extraterritorial effect. Once the subordinate regulation on international cooperation has been issued by the PDPC, this should clarify how PDPA enforcement against organizations located outside of Thailand will be conducted by Thai regulators. With respect to sector-specific data protection legislation, in September 2023, Thailand’s National Broadcasting and Telecommunications Commission issued the Notification of the NBTC Re: Measures to Protect Telecommunications Service Users’ Rights in regard to Personal Data, Privacy Rights, and Freedom of Telecommunications, which replaces the previous notification.

Tilleke & Gibbins’ insurance specialists in Bangkok provided Thomson Reuters’ latest country update on Thailand’s regulatory framework for the insurance industry. The country update, which is part of Thomson Reuters’ extensive Regulatory Intelligence offerings, contains information and guidance for insurers active in the Thai market. The guide covers the following topics in detail: Permission to operate; Legal and regulatory considerations for domestic and international insurers; Capital reserve requirements; Investment management and markets; The Office of Insurance Commission’s arbitration system for handling complaints; Creditor hierarchy; Rehabilitation of non-life insurance companies; and Personal data protection requirements for insurers. The full PDF of the Thailand insurance country update is available below, or by subscription to Regulatory Intelligence on the Thomson Reuters website.