You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 30, 2024

Thailand Issues Draft Platform Economy Act

Subscribe to Updates

Thailand has made its draft Platform Economy Act (the “Draft PEA”) available to relevant entities in certain industries. The Draft PEA aims to regulate and standardize digital platform service business operations and protect consumers and other stakeholders.

Once the Draft PEA becomes law, the Royal Decree on the Operation of Digital Platform Service Businesses that are subject to Prior Notification B.E. 2565 (2022) and the relevant provisions under the Electronic Transactions Act B.E. 2544 (2001), as amended, will cease to have effect.

The key provisions of the Draft PEA are summarized below.

Definitions

The definitions of the key terms under the Draft PEA are substantially similar to the definitions of the key terms under the royal decree mentioned above. According to the Draft PEA, “digital platform services” refers to the provision of electronic intermediary services that manage data to facilitate connection, through computer networks, between business users, consumers, or users, regardless of whether remuneration is charged.

Exemption

The Draft PEA does not apply to digital platform services (DPSs) that are regulated by specific laws and have rules guaranteeing transparency and fairness, or that follow operational standards no less stringent than those required in the Draft PEA. Nonetheless, the Electronic Transactions Development Agency (ETDA) can request or link data relating to exempted DPSs from the relevant supervisory authorities.

Extraterritorial Effect

Offshore DPSs with certain characteristics are also subject to the obligations under the Draft PEA and will have to appoint a coordinating person in Thailand. However, offshore DPSs will not have to establish a business in Thailand.

General Responsibilities and Obligations

The Draft PEA sets out the following requirements:

  • DPSs with (1) at least THB 100 million (approx. USD 2.8 million) in annual revenue from providing the DPSs in Thailand before deducting expenses, or (2) more than 10,000 monthly users in Thailand (calculated from the average monthly usage pursuant to the rules of the ETDA) must report their operations to the ETDA within 30 days of becoming aware that they fall within either of the criteria.
  • Upon any changes in the name, type, channel, or other details of a DPS provider or the DPSs, or in the details of the local coordinator, the ETDA must be notified of the relevant information within 30 days from the date of the change. Any changes must also be included in an annual report due 60 days from the end of each calendar year for individuals or from the end of each fiscal year for legal entities.
  • DPS providers are responsible for the lawfulness of their users’ data and any other data transmitted through the DPS, unless it can be proved or evidence can be shown in court that the DPS acts only as an intermediary for the transmission of the data and does not store it, or that the DPS does not have access to the data.
  • DPSs that do not only act as intermediaries for the transmission of data, or for which the provider can access users’ data or other transmitted data, must implement a system, mechanism, or procedure enabling other persons to report illegal acts or noncompliance. Upon receiving such a report, the DPS must delete or block the illegal data. If the DPS determines that there is no illegal data or noncompliance, the finding must be promptly reported to the ETDA.
  • Measures for the alleviation of injuries, compensation, and remediation must be in place.

Additional Obligations for Certain DPSs

Additional obligations are imposed on two categories of DPSs that have specific characteristics.

A “specific type of DPS” is one that provides all of the following services:

  • Sending and receiving data of users and other persons;
  • Storing data of users and other persons; and
  • Matching different categories of users to facilitate electronic transactions or for the benefit of selling and purchasing goods or services through the DPS.

These specific types of DPSs are obligated to notify users of the laws relating to the purchasing of goods or services and the associated risks; implement a notification system for products that are required by law to have an expiry date; monitor and ensure that the DPS will not be used for illegal activities and immediately report any suspicious activities to the ETDA; implement an identity verification system; and submit an annual report to the ETDA on the DPSs’ transparency, among other obligations.

A “large DPS” is one that:

  • Has over THB 1 billion in annual revenue, before deducting expenses, from the provision of a DPS in Thailand;
  • Has over 100,000 monthly users in Thailand; or
  • Poses a high risk to Thailand’s economy and social stability, or a high risk of potential damage to the public.

Large DPSs are obligated to engage external experts to assess risks at least once a year; arrange for IT audits; appoint a chief compliance officer to liaise with the ETDA and other competent authorities; disclose factors and methods used for processing data to offer goods or services as well as the ranking of those goods or services; and implement channels to enable users to exercise the right not to receive advertisements, among other obligations.

DPS Cessation

In cases of DPS cessation, notification of the cessation must be made to the ETDA at least 60 days prior to the date of cessation. For large DPSs, the cessation notification must be submitted at least 120 days in advance, along with a plan and measures for taking care of users after the cessation. A DPS only ceases once a receipt of notification for the cessation has been issued by the competent official.

Blockage of the Transmission of Data

If there is a transmission of illegal data through a DPS, the ETDA may order that the transmission of data by or to a user be blocked. If the order is not complied with, the ETDA may file a petition with the court requesting an order to block the transmission of data on the DPS.

Whistleblowers and Trusted Flaggers

The ETDA has the duty to recruit, examine, and certify whistleblowers or trusted flaggers and announce the list of certified whistleblowers on its electronic channel. Providers of specific types of DPSs or large DPSs must collaborate with the whistleblowers on certain aspects, such as by having a channel for whistleblowers to register their accounts and so on.

Agreements between DPSs and Users

Operators must clearly declare terms and conditions to users before and during service usage, addressing certain required items such as terms of service, suspension or termination of services, and service fees.

Competition Supervision

The ETDA and the Office of Trade Competition Commission (OTCC) will collaboratively establish criteria for determining the list of gatekeeping platforms and will publish it within six months of the criteria coming into effect.

The ETDA and the OTCC may issue regulations on behaviors, service conditions, and any other activities that are deemed to be an unfair exercise of gatekeeping platforms’ business power (ex-ante regulations).

Next Steps

The Draft PEA will be disclosed for a hearing involving relevant stakeholders and the public before the first draft is finalized.

For more details on digital platform services in Thailand, or on other aspects of the country’s technology-related laws, please contact Athistha (Nop) Chitranukroh at [email protected], Gvavalin Mahakunkitchareon at [email protected], Pornpan Wichawut at [email protected], Thammapas Chanpanich at [email protected], or Rada Lamsam at [email protected].

Related Professionals

Industries

Fintech

Technology

Location

RELATED INSIGHTS​ 

November 15, 2023
Four decisions from the Expert Committee under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) indicate that there will no longer be any relaxation of PDPA enforcement. The enforcement of Thailand’s seminal data protection law had been relaxed for more than a year when, on October 18, 2023, the Personal Data Protection Committee (PDPC) published the first decision made by the Expert Committee on the imposition of administrative measures against a company pursuant to authority granted to it under the Notification of the PDPC Re: Rules for the Consideration of the Imposition of Administrative Penalties by the Expert Committee B.E. 2565 (2022), which was one of the first subordinate regulations issued under the PDPA. Shortly thereafter, on October 19, October 25, and November 15, three additional Expert Committee decisions were published. These three decisions made by the Expert Committee are summarized below. October 18 Decision The complainant in this case lodged a complaint with the Expert Committee alleging that an insurance company contacted him to offer the company’s products without his consent. The complaint further claimed that when the complainant requested the company to disclose how his personal data had been acquired and asked the company to stop contacting him through any channel, the company did not take any action on the requests. The insurance company appeared to have obtained the personal data of the complainant from another source prior to the PDPA becoming fully effective (i.e., June 1, 2022). As the Expert Committee explained in its order, the company failed to comply with its obligations under the PDPA regarding the collection of personal data from another source, which requires consent as a legal basis; failed to comply with the grandfather provision by not publicizing opt-out procedures to enable the data subject to withdraw his consent easily; and
Read More
November 7, 2023
Under Thailand’s Royal Decree on Digital Platform Services, domestic and in-scope overseas digital platform operators that are required to notify the Electronic Transactions Development Agency (ETDA) of their operations must do so by November 18, 2023 (or by August 20, 2024, for small or low-impact platforms). This step is one of the essential requirements of the royal decree. Other key information on complying with the royal decree is as follows: The royal decree aims to regulate the operation of “digital platform services,” which refers to the provision of electronic intermediary services that create a connection between consumers, merchants or businesses, or other types of users in order to create an electronic transaction in whole or in part, regardless of whether a service fee is charged. The regulated digital platform services do not include digital platform services intended for offering the goods or services of a single digital platform service operator or an affiliated company that is an agent of the operator, irrespective of whether the goods or services are offered to third persons or to affiliated companies. The royal decree has extraterritorial effect, whereby overseas operators targeting the Thailand market are subject to the royal decree if their services are accessible in Thailand. Overseas operators are required to appoint a local coordinator in Thailand to coordinate with the ETDA. Compliance and Enforcement The ETDA released nine subordinate regulations under the royal decree; these took effect on August 21, 2023 (except for rules on platforms’ terms and conditions, which will take effect on January 3, 2024). Some important points on compliance and enforcement in the subordinate regulations, along with procedural guidance, are listed below. The ETDA has been emphasizing that both domestic and overseas digital platform operators need to notify the ETDA of their operations within the specified timeline (i.e.,
Read More
October 25, 2023
One significant development in the health sector in Indonesia is the use of information technology and communication in the implementation of health efforts—particularly digital health services such as telehealth and telemedicine integrated into the country’s National Health Information System. This development was addressed in a major new piece of legislation for the healthcare sector in Indonesia. Enacted in August 2023, Law No. 17 of 2023 concerning Health (the “Health Law”) provides the updates needed to support the development of healthcare services in Indonesia. Under the Health Law, health information system (HIS) providers must: Carry out processing of data and health information in the territory of Indonesia, except for certain limited and specific processing activities that may be conducted outside Indonesia when permitted by the relevant authorities and in compliance with relevant regulations. Ensure the reliability of its HIS, including availability, security, maintenance, and integration with Indonesia’s National Health Information System. Provide quality health data and information. Process data and health information, which includes planning, collection, storage, inspection, transfer, utilization, and destruction. Record its data- and information-processing history. Protect every person’s data and health information. Obtain approval from the relevant personal data subject or comply with relevant regulations if the processing of data and health information involves an individual’s health data. Inform the data owner if there is a failure to protect data and individual health information. The Health Law’s personal data protection requirements listed above appear to be aligned with the provisions in Law No. 27 of 2022 concerning Personal Data Protection (the “PDP Law”). Under this law, data and information relating to health are identified as “specific personal data,” the processing of which carries a high potential risk of impacting the relevant personal data subject. In the implementation of digital health services, patients’ personal data or medical records
Read More
October 25, 2023
Thailand has released a notification adding new consumer protection provisions related to the collection of prepaid telecom service fees and combining several disparate regulations and resolutions. The Notification on the Criteria Relating to the Collection of Prepaid Telecommunications Service Fees was issued on September 4, 2023, and came into effect on September 21, 2023. The notification will be enforced as a general regulation and guideline for all telecom services other than fixed broadband services, which already fall under a comparable regulation.   Previously, Thailand’s National Broadcasting and Telecommunications Commission (NBTC) had issued several regulations to regulate the collection of prepaid telecom service fees. These include the NBTC Notification on Contract Standards, the NBTC Notification on the Maximum Service Fee Rate and Collection of Prepaid Telecommunications Service Fees, and the NBTC Notification on the Criteria Relating to the Collection of Prepaid Fixed High-Speed Broadband Service Fees. These are now subsumed by the new notification. Key requirements of the new notification on prepaid telecom fee collection are described below. Collection Approval Requirement Before collecting prepaid telecom service fees, service providers (SPs) must apply to the NBTC for approval by submitting the required forms and supporting documents. Changes to the criteria and methods of prepaid telecom service fee collection must also be reapproved. This provision aims to protect against fraud and money-laundering transactions. The NBTC will consider whether to approve an SP’s proposal for the maximum period to be covered by the prepaid service fees on a case-by-case basis. After the collection criteria and methods are approved by the NBTC, SPs must inform their users individually. SPs must also report to the NBTC by the 15th of every month after receiving the NBTC’s approval to collect prepaid service fees. Approvals of prepaid service fee collection granted by the NBTC prior to the
Read More