Noppparat Lalitkomon, head of Tilleke & Gibbins’ data protection team in Thailand, has prepared the Thailand contribution for the Data Privacy Trends and Topics Report, published by Lex Mundi. The report provides brief overviews of recent and upcoming regulatory and legal developments concerning data privacy in the jurisdictions of Lex Mundi member firms in 53 jurisdictions around the world. Drawing on the expertise of Lex Mundi member firms from around the world, the report features local insights to help businesses handle cross-border data and cybersecurity challenges. Lex Mundi has also compiled a global overview of how firms in each region assess the likelihood of significant changes to the data protection landscape in 2023. Notably, Asia and the Pacific is identified as the region most likely to undergo changes, with 73% of reporting firms expecting significant developments in their jurisdictions. The report containing all 53 contributions—grouped by world region—is available on the Lex Mundi website or through the button below.

On December 28, 2022, the Ministry of Health of Laos issued Decision No. 3789/MOH on the Control of Hemp for Medication and Products (the “Decision”). The Decision approves the regulated cultivation, extraction, production, processing, storage, distribution, utilization, import-export, and transport of hemp. The Decision also authorizes the use of hemp and hemp-related products by the general population, although use of certain products is limited to those with medical prescriptions. Background In 2019, the Lao government established an ad hoc committee to consider the legalization of cannabis, as reported previously. The government permitted certain local companies to grow cannabis in specific zones under pilot programs, although it continued to strictly prohibit the use and commercialization, as well as consumption, of cannabis-related products, regardless of the level of psychoactive tetrahydrocannabinol (THC) in the products. Overview of the Decision The Decision was issued by the Ministry of Health (which led the ad hoc committee) and permits authorized companies to engage in certain activities involving the use of hemp and the consumption of hemp and hemp-related products. The Decision defines hemp (“porkeo” in Lao) as a “plant that belongs to the same family as ganja and bears the scientific name Cannabis Sativa L. (Cannabis sativa L. subsp. sativa var. sativa) which is a subspecies of ganja (Cannabis Sativa L.).” This definition aims at differentiating hemp from the general definition of ganja or marijuana, which continues to be listed as a prohibited narcotic in Laos. The Law on Narcotics (2007) and the Penal Code (2017) still prohibit the production, trade and use of all types of cannabis. These laws will need to be amended to ensure that they are aligned with changes set out in the Decision.  Authorized Hemp Activities The Decision allows approved companies to engage in the cultivation, extraction, production, processing, storage,

On December 20, 2022, the Notification re: Rules, Procedures, and Conditions on Transfer of Energy Licenses of the Thailand Energy Regulatory Commission (ERC) became effective. The notification sets out the new standard and procedure for transferring licenses for energy industry operation. The notable changes in the notification are provided below. Anti-Competition Consideration and Impact Assessment Report In considering the transfer of a license, in addition to ensuring the transferee meets all the qualifications for an applicant for the license, the ERC will consider if the transfer would (1) create a monopoly, reduce or restrict competition, or result in market dominance; (2) affect the contracting parties of the transferors or energy users; or (3) affect energy security or the public interest. In this respect, the vetting process for an application for license transfer would be separated into two different approaches. If the ERC believes that the transfer of the energy license would affect competition, energy users, energy security, or the public interest, the transferor will need to submit an impact assessment report on the license transfer to the ERC. In this regard, the ERC may establish a sub-committee or an independent consultant to contemplate the transfer at the transferor’s expense. However, if the ERC believes that the transfer of license would not lead to any impact, the transferor will not be required to submit the impact assessment. Also, if the license transfer is related to any transactions specified under the ERC’s Regulation re: Rules and Procedures on Merger and Cross-Shareholding in Energy Businesses, B.E. 2565, the ERC can combine the license transfer application with the M&A application. After approval, the ERC might require the transferee to periodically report to the ERC and comply with measures stipulated by the ERC. Therefore, an energy license holder which plans to carry out M&A

Thailand has issued a Royal Decree on the Supervision of Regulated Digital Identification Authentication and Verification Service Businesses B.E. 2565 (2022) (the “Royal Decree”), aimed at regulating business operators that provide digital identification authentication and verification services (“Digital ID Services”). The Royal Decree was published in the Government Gazette in December 2022, and will take effect 180 days from the publication date, i.e., on June 21, 2023. The key details and requirements of the Royal Decree are as follows: Regulated Digital ID Services Under the Royal Decree, the provision of the following Digital ID Services requires prior approval from the Electronic Transaction Development Agency: Identity verification service – Services for collecting and identifying information relating to the identity of a person, and verifying the connections between the person and the identity. Authenticator issuance and management service – Services relating to the connection between a person who has passed the identification process with an authenticator, and managing actions which are used to identify a person. Authentication service – A process to authenticate a person by inspecting his/her authenticator. Digital ID networks/systems – Provision of networks or systems used to exchange information for digital identification purposes, excluding services provided by an intermediary. Exempted Digital ID Services The Royal Decree also specifies a list of Digital ID Services that are exempted from supervision under the Royal Decree, as follows: Issuance of certificates to support the use of electronic signatures in accordance with the Electronic Transaction Act. Digital ID Services conducted for use within the operator’s own business only, and which do not involve the provision of such services to third parties. Other Digital ID Services as prescribed by the Electronic Transaction Committee. Qualifications of Business Operators The types of business operators qualified to operate Digital ID Services include (i) private limited companies;