You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 30, 2024

Thailand Issues Draft Platform Economy Act

Subscribe to Updates

Thailand has made its draft Platform Economy Act (the “Draft PEA”) available to relevant entities in certain industries. The Draft PEA aims to regulate and standardize digital platform service business operations and protect consumers and other stakeholders.

Once the Draft PEA becomes law, the Royal Decree on the Operation of Digital Platform Service Businesses that are subject to Prior Notification B.E. 2565 (2022) and the relevant provisions under the Electronic Transactions Act B.E. 2544 (2001), as amended, will cease to have effect.

The key provisions of the Draft PEA are summarized below.

Definitions

The definitions of the key terms under the Draft PEA are substantially similar to the definitions of the key terms under the royal decree mentioned above. According to the Draft PEA, “digital platform services” refers to the provision of electronic intermediary services that manage data to facilitate connection, through computer networks, between business users, consumers, or users, regardless of whether remuneration is charged.

Exemption

The Draft PEA does not apply to digital platform services (DPSs) that are regulated by specific laws and have rules guaranteeing transparency and fairness, or that follow operational standards no less stringent than those required in the Draft PEA. Nonetheless, the Electronic Transactions Development Agency (ETDA) can request or link data relating to exempted DPSs from the relevant supervisory authorities.

Extraterritorial Effect

Offshore DPSs with certain characteristics are also subject to the obligations under the Draft PEA and will have to appoint a coordinating person in Thailand. However, offshore DPSs will not have to establish a business in Thailand.

General Responsibilities and Obligations

The Draft PEA sets out the following requirements:

  • DPSs with (1) at least THB 100 million (approx. USD 2.8 million) in annual revenue from providing the DPSs in Thailand before deducting expenses, or (2) more than 10,000 monthly users in Thailand (calculated from the average monthly usage pursuant to the rules of the ETDA) must report their operations to the ETDA within 30 days of becoming aware that they fall within either of the criteria.
  • Upon any changes in the name, type, channel, or other details of a DPS provider or the DPSs, or in the details of the local coordinator, the ETDA must be notified of the relevant information within 30 days from the date of the change. Any changes must also be included in an annual report due 60 days from the end of each calendar year for individuals or from the end of each fiscal year for legal entities.
  • DPS providers are responsible for the lawfulness of their users’ data and any other data transmitted through the DPS, unless it can be proved or evidence can be shown in court that the DPS acts only as an intermediary for the transmission of the data and does not store it, or that the DPS does not have access to the data.
  • DPSs that do not only act as intermediaries for the transmission of data, or for which the provider can access users’ data or other transmitted data, must implement a system, mechanism, or procedure enabling other persons to report illegal acts or noncompliance. Upon receiving such a report, the DPS must delete or block the illegal data. If the DPS determines that there is no illegal data or noncompliance, the finding must be promptly reported to the ETDA.
  • Measures for the alleviation of injuries, compensation, and remediation must be in place.

Additional Obligations for Certain DPSs

Additional obligations are imposed on two categories of DPSs that have specific characteristics.

A “specific type of DPS” is one that provides all of the following services:

  • Sending and receiving data of users and other persons;
  • Storing data of users and other persons; and
  • Matching different categories of users to facilitate electronic transactions or for the benefit of selling and purchasing goods or services through the DPS.

These specific types of DPSs are obligated to notify users of the laws relating to the purchasing of goods or services and the associated risks; implement a notification system for products that are required by law to have an expiry date; monitor and ensure that the DPS will not be used for illegal activities and immediately report any suspicious activities to the ETDA; implement an identity verification system; and submit an annual report to the ETDA on the DPSs’ transparency, among other obligations.

A “large DPS” is one that:

  • Has over THB 1 billion in annual revenue, before deducting expenses, from the provision of a DPS in Thailand;
  • Has over 100,000 monthly users in Thailand; or
  • Poses a high risk to Thailand’s economy and social stability, or a high risk of potential damage to the public.

Large DPSs are obligated to engage external experts to assess risks at least once a year; arrange for IT audits; appoint a chief compliance officer to liaise with the ETDA and other competent authorities; disclose factors and methods used for processing data to offer goods or services as well as the ranking of those goods or services; and implement channels to enable users to exercise the right not to receive advertisements, among other obligations.

DPS Cessation

In cases of DPS cessation, notification of the cessation must be made to the ETDA at least 60 days prior to the date of cessation. For large DPSs, the cessation notification must be submitted at least 120 days in advance, along with a plan and measures for taking care of users after the cessation. A DPS only ceases once a receipt of notification for the cessation has been issued by the competent official.

Blockage of the Transmission of Data

If there is a transmission of illegal data through a DPS, the ETDA may order that the transmission of data by or to a user be blocked. If the order is not complied with, the ETDA may file a petition with the court requesting an order to block the transmission of data on the DPS.

Whistleblowers and Trusted Flaggers

The ETDA has the duty to recruit, examine, and certify whistleblowers or trusted flaggers and announce the list of certified whistleblowers on its electronic channel. Providers of specific types of DPSs or large DPSs must collaborate with the whistleblowers on certain aspects, such as by having a channel for whistleblowers to register their accounts and so on.

Agreements between DPSs and Users

Operators must clearly declare terms and conditions to users before and during service usage, addressing certain required items such as terms of service, suspension or termination of services, and service fees.

Competition Supervision

The ETDA and the Office of Trade Competition Commission (OTCC) will collaboratively establish criteria for determining the list of gatekeeping platforms and will publish it within six months of the criteria coming into effect.

The ETDA and the OTCC may issue regulations on behaviors, service conditions, and any other activities that are deemed to be an unfair exercise of gatekeeping platforms’ business power (ex-ante regulations).

Next Steps

The Draft PEA will be disclosed for a hearing involving relevant stakeholders and the public before the first draft is finalized.

For more details on digital platform services in Thailand, or on other aspects of the country’s technology-related laws, please contact Athistha (Nop) Chitranukroh at [email protected], Gvavalin Mahakunkitchareon at [email protected], Pornpan Wichawut at [email protected], Thammapas Chanpanich at [email protected], or Rada Lamsam at [email protected].

Related Professionals

Industries

Fintech

Technology

Location

RELATED INSIGHTS​ 

March 15, 2024
Vietnam’s fintech industry is booming, and the rapid emergence of tech startups and non-bank institutions offering innovative financial services has been outpacing existing regulations. This regulatory gap not only creates uncertainty for both innovators and consumers, but also poses a number of imminent risks in areas such as consumer protection, data privacy, cybersecurity, and anti-money laundering, among others. The State Bank of Vietnam (SBV) is stepping up to tackle these challenges by accelerating the promulgation of a long-awaited Fintech Sandbox Decree with the issuance of an updated draft (“Draft Fintech Sandbox Decree”) on March 4, 2024. The Draft Fintech Sandbox Decree establishes a controlled environment where fintech companies and financial institutions can test solutions that do not fall squarely within the parameters of existing regulations. The pilot activities will be limited in scope, scale, and duration, with a number of precautionary measures in place. The SBV will supervise this “sandbox” closely, effectively mitigating risks and gathering valuable data to inform future regulations. Who Can Participate in the Sandbox? Traditional financial institutions (credit institutions): Banks and other institutions licensed to provide financial services can participate in the sandbox to test new offerings or refine existing ones. Independent fintech companies: Startups and established companies specializing in fintech solutions can leverage the sandbox to pilot innovative ideas before seeking wider market adoption. Other relevant organizations involved in the pilot: Depending on the specific solution being tested, other entities may also be involved in the sandbox. Geographical scope: Limited to Vietnamese territory; cross-border testing is not allowed. Focusing on Three Solution Categories Earlier versions of the Draft Fintech Sandbox Decree included categories like blockchain technology and other innovative business models, but these were removed in the latest version. To allow the SBV to assess the associated risks and work on the solutions more
Read More
March 12, 2024
Thailand’s Ministry of Finance has issued the Notification re: Criteria, Methods and Conditions for Applying for and Issuing Licenses to Operate Virtual Bank Business, which was published in the Government Gazette on March 4, 2024. This notification opens an opportunity for qualified experts in technology, digital services, and diverse data usage fields to apply for virtual bank licenses to provide financial services through new digital channels. The main goal is to serve the financial needs of target groups that may not have received sufficient or tailored financial services from the traditional banking system. Licensing Timeline Application submission period: 6 months (March 20–September 19, 2024). Announcement of successful applicants: Mid-2025 (approx. 9 months–1 year from the end of the submission period) After the announcement, successful licensees must demonstrate their readiness to commence virtual bank operations within 1 year (extendable for up to 1 additional year) via the following: Having paid-up registered capital of THB 5 billion and plans to increase the paid-up registered capital to at least THB 10 billion after the initial business period; Establishment or adjustment of a financial business group; Procurement of human resources, IT systems, and relevant risk management tools. Number of Licenses to be Issued No written or specified limit, subject to the discretion of the Bank of Thailand (BOT). Key Qualifications Applicants must have the following: Experience and resources to support virtual banking operations according to the business model and plan. Expertise and experience in conducting business that utilizes technology and provides services through digital channels. Experience demonstrating the ability to obtain, access, manage, and utilize data, including development of systems or data connections to facilitate user activities, allowing them to use their data to conduct transactions with other providers. Criteria In assessing applicants’ qualifications for a virtual bank license, the BOT will consider
Read More
February 27, 2024
Thailand’s National Cyber Security Committee (NCSC) released three notifications under the Cybersecurity Act on January 18, 2024, setting cybersecurity-related requirements for key organizations and assets. While one of these notifications already took effect, the two most notable will take effect on January 18, 2025 (i.e., one year from their publication in the Government Gazette). These two are the NCSC Notification Re: Standards for Defining the Security Category for Data or Information Systems B.E. 2566 (2023) (“Notification on Security Category”) and the NCSC Notification Re: Minimum Standards for Data and Information Systems B.E. 2566 (2023) (“Notification on Minimum Standards”). These notifications apply to: State agencies; Supervising or regulating organizations (i.e., state organizations, private organizations, or persons designated by law to regulate or supervise the affairs of state organizations or critical information infrastructure organizations); and Critical information infrastructure organizations (i.e., organizations related to or providing national security, significant public services, banking and finance, information technologies and telecommunications, transportation and logistics, energy and public utilities, and public health). Collectively these are defined as “Organizations” under the notifications. Notification on Security Category The Notification on Security Category sets forth risk-based security classifications—or “security categories”—for Organizations’ data or information systems. For security category assessment purposes, Organizations are required to perform a self-assessment of their data or information systems based on three key security objectives: confidentiality, integrity, and availability. Each of these objectives is further categorized into three risk levels (low, medium, and high), taking into account the assessment of potential impact in the following areas: Organizations’ financial value or reputation; Organizations’ number of service users; Organizations’ ability to perform their duties; State stability or public order. The risk levels for the three objectives are determined by considering whether there are “minimal,” “severe,” or “serious severe” effects, as described below: Confidentiality (not including data classified
Read More
February 2, 2024
The pervasive global issue of illicit personal data trading has extended its reach into Vietnam, where such sensitive information is being sold at minimal costs. A 2023 report from the Ministry of Public Security revealed that over two-thirds of the Vietnamese population has fallen victim to unlawful data collection and distribution. In the past two years, authorities have pressed charges on five criminal cases involving the buying and selling of billions of items of personal data, encompassing a wide range of sensitive information such as names, phone numbers, email addresses, and more. Notably, a person’s profile can be acquired for just USD 1, while profiles of millions of business customers can be obtained for a mere USD 100. Recognizing the severity of the problem, Vietnam has made serious efforts to combat illicit personal data trading by criminal means, encompassing both the legal framework and practical implementation.   Understanding the Criminal Legal Framework Vietnam’s 2015 Criminal Code, as amended in 2017, functions as a pivotal legal instrument delineating offenses and their corresponding punishments. Under Section 2 of Chapter XXI of the Criminal Code (“Offenses Against Regulations on Information Technology and Telecommunications Networks”), individuals engaging in the illicit trading of personal data, depending on the nature of the data (e.g., information about phone number, address, or—more dangerously—bank account) and the nature of the infringing acts, may be charged under different crimes. The sanctions can include monetary fines; non-custodial reform; imprisonment; and/or prohibition from holding certain positions, practicing certain professions, or doing certain jobs. For example, for the illicit trade of private information of an individual on a computer or telecommunications network, Article 288 of the Criminal Code specifies penalties including a monetary fine of up to VND 1 billion (equivalent to around USD 41,000); non-custodial reform of up to three years;
Read More