You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

October 7, 2022

Thailand Opens Public Hearing Period on Measures for Cross-Border Transfer of Personal Data

Subscribe to Updates

Thailand’s Office of the Personal Data Protection Committee (PDPC) has opened a public hearing period on its draft notification regarding cross-border transfer of personal data. The public hearing is open through October 24. The notification, once issued, will supplement the principle of cross-border transfer of personal data outside of Thailand set out in the Personal Data Protection Act (PDPA).

The notification sets out the following key matters:

Definitions

  • “Transfer of personal data” means any sending or transferring of personal data by a transferor of personal data, either by way of a physical transfer or a remote transfer through a computer system or an internet network to the recipient of the personal data. It does not include sending personal data through an intermediary by transiting between computer systems or internet networks, or any storing or retaining of personal data, either permanently or temporarily, by a cloud computing service provider, whereby the personal data transferor and the personal data recipient (1) are not making the order, (2) are not involved with any data selection or the content of the personal data sent and received through the computer systems or internet networks, or (3) have the purpose of entering into an agreement or any juristic act.
  • “Binding corporate rules” means the agreed terms or policy on personal data protection made between the personal data transferor and the personal data recipient to establish appropriate measures for safeguarding personal data within a group of corporations or companies.
  • “Standard contractual clauses” means the contractual terms made between the personal data transferor and the personal data recipient to establish appropriate measures for safeguarding personal data.
  • “Code of conduct” means a code that sets out the obligations of a personal data transferor and a personal data recipient outside of Thailand.
  • “Certification” means an undertaking in relation to safeguarding personal data, in order to establish appropriate personal data safeguarding measures.

Binding Corporate Rules

For cross-border transfers within a group of corporations or companies, binding corporate rules (BCRs) can be established and submitted to the PDPC for approval. The BCRs must adhere to the following minimum standards:

  • The effectiveness and legally binding nature of the BCRs apply to each company or entity within the group, including the data recipient, data processor, and data transferor, and the members belonging to the group, as well as their employees, staff, or persons related to the transfer or receipt of personal data within the group.
  • The BCRs must comply with Thai laws on personal data protection.
  • The BCRs must contain certification of data subject rights under the PDPA and sub-regulations.
  • The BCRs must contain measures on personal data protection in relation to personnel, processes, and security measures in accordance with the required technology standards for personal data protection.

Appropriate Safeguards

In accordance with section 29, paragraph 3, of the PDPA, a personal data transferor may transfer personal data to a recipient outside of Thailand when procuring appropriate safeguard measures by way of “standard contractual clauses,” “code of conduct,” or “certification.” Such appropriate safeguards must at least ensure the enforceability of the data subject’s rights and effective legal remedial actions, as provided in the annexes of the notification.

The appropriate safeguards must at least have the following:

  • Effectiveness and legal enforceability.
  • Compliance with Thai laws on personal data protection.
  • Certification of data subject rights under the PDPA and sub-regulations.
  • Measures on personal data protection in relation to personnel, process, and security measures in accordance with the required technology standards for personal data protection.

The standard contractual clauses must be filed with the PDPC. The appropriate safeguard measures must be enforceable under Thai law, and they must provide data subject rights under Thai law. Such rights must also be enforceable and provide remedial rights for data subjects as stipulated under Thai law.

The notification also sets out standard contractual clauses for controller-to-controller and controller-to-processor international transfers. The clauses primarily stipulate the obligations of the transferor and the recipient, recognize the enforceability of the PDPA provisions on personal data protection, and ensure the ability of data subjects to exercise their rights (in the form of third-party rights).

For more information from Tilleke & Gibbins’ data privacy team regarding the draft notification, or any aspect of compliance with PDPA requirements, please contact Athistha (Nop) Chitranukroh at [email protected], Nopparat Lalitkomon at [email protected], Gvavalin Mahakunkitchareon at [email protected], or Thammapas Chanpanich at [email protected].

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

July 14, 2023
The Bank of Thailand (BOT) has issued new notifications amending regulations for payment businesses that fall under the Payment Systems Act B.E. 2560 (2017) to promote transparency and good governance in the payment industry. Notification No. SorKorChor 2/2566 (“Notification 2”) increases the required qualifications for applicants seeking a license to provide payment services designated as being under the BOT’s supervision, and Notification No. SorKorChor 4/2566 (“Notification 4”) stipulates additional duties and exemptions for certain types of business operators. The notifications were published in the Government Gazette on July 7, 2023, and came into effect the following day. Additional Qualifications Notification 2 expands the list of prohibited characteristics for business operators applying for a license or registration to engage in a designated payment service, and their directors. For example, applicants must not have been ordered to suspend or cease their operations, and their registration or license to engage in financial business or operate a designated payment system or service must not have been revoked. The notification defines “financial business” as including financial institutions, credit card business, personal loan business, securities business, and so on. In addition, applicants’ directors and management must not have prohibited characteristics, such as being involved in the management of a financial business or designated payment system or service that was ordered to suspend or cease its operations. The applicable registration or license also must not have been revoked. Reporting Requirements During the application process, Notification 2 requires applicants to disclose information on shareholders and related parties (including spouses) who hold an aggregate 10 percent or more of the total paid-up shares. Notification 4 imposes this same reporting duty regarding shareholders and related parties but applies it to licensed operators in an ongoing manner. Existing payment service operators must make their first report of this information to
Read More
July 12, 2023
On June 30, 2023, Vietnam’s Ministry of Information and Communications (MIC) issued Circular No. 06/2003/TT-BTTTT to provide implementing guidelines for Decree 71 on editing, ratings, and warnings for video on demand (VOD) sports and entertainment content provided over radio and TV services. Circular 06 will take effect on August 15, 2023. Because Decree 71 allows VOD providers to self-edit and self-rate this type of content, it is important for them to know how the process is regulated in order to fully comply before providing VOD sports and entertainment programs to Vietnamese users. Under Circular 06, radio and TV service providers are required to display ratings and warnings on their programs, following the principles set out in the circular. These service providers must also compile dossiers in a stipulated form on the editing, ratings, and warnings of their programs for reporting to the authority and inspection. The main contents of Circular 06 are as follows. 1. Content Editing The main principles for editing VOD sports and entertainment programs include: Protection of children and other vulnerable people from inappropriate or potentially harmful content. Removal of all illegal/prohibited content, as well as content related to controversial issues or issues not recognized by Vietnamese law. Removal of content or dialogue that disparages the origins of others or makes fun of others’ physical weaknesses, and content that is contrary to Vietnamese culture, morality and fine customs and traditions; Removal of programs if it is discovered during the editing process that in the program or at the venue of the event, there are images or activities violating the prohibitions of the law, violating Vietnamese fine customs and traditions, or containing sensitive political elements. In addition to compliance with the above-mentioned principles, sports and entertainment programs related to health, education, and online gaming must additionally meet
Read More
July 11, 2023
Can computer programs resolve legal disputes? For decades, the answer from much of the legal community has been no. However, developments in artificial intelligence (AI), and in particular natural language processing and machine learning, have led to renewed discussions of this possibility. Increasingly, tools are being developed to assist parties with litigation outcome prediction and judges with litigation outcome determination. However, while some argue that the use of AI in legal disputes can reduce the length of proceedings, cut costs, and improve access to justice, others raise concerns that “black box” AI systems could reduce transparency, entrench bias, and harm the development of the law. Litigation Outcome Prediction The use of computers to predict the outcome of legal cases is not new. As early as the 1980s, researchers developed outcome prediction tools, often in the form of decision-tree algorithms. However, developments in AI have allowed the creation of more sophisticated prediction models. In 2017, a model built by Katz et al. predicted US Supreme Court decisions with an accuracy of 70.2%, while in 2019, a model built by Medvedeva et al. predicted decisions of the European Court of Human Rights with an accuracy of 75%. In various studies, AI tools have been able to predict case outcomes more accurately than expert lawyers. Companies such as Solomonic and Lex Machina, owned by LexisNexis, now provide commercial litigation prediction and analytics tools. Outcome prediction tools can be used by parties and their legal representatives to craft arguments and facilitate settlement negotiations, or by third-party litigation financers to assess the risk of providing funding. More broadly, outcome prediction may be used by the likes of insurance companies to help calculate claim payouts. However, those using such tools must take care to ensure that they do not breach any professional or legal obligations.
Read More
July 10, 2023
One of the more positive outcomes of the COVID-19 pandemic is that telemedicine has become remarkably important as an interactive system between patients and healthcare professionals. Thailand, which ranks near the top as a world medical hub, is a highly favored destination in Asia for expat workers. Currently, the Thai market has both Thai-based and foreign-based platforms with information about healthcare providers and telemedicine readily available. “Doctor Locator,” “Weed Map,” and “Find a Teeth Aligner Dentist” are examples of online platforms connecting patients with medical and telemedicine services. These digital platforms provide information about the location of specialized clinics, cannabis dispensaries, pharmacy stores, and orthodontic practitioners in Thailand. These platforms act as intermediaries between medical care businesses and consumers. As actual medical services are not offered or provided, these digital platforms do not have to be regulated under the Medical Facility Act of Thailand. However, healthcare digital platform services that act as an intermediary or conduit managing information used to connect medical clinics or cannabis dispensaries with patients or customers via a computer network are now regulated under the soon-to-be-implemented Royal Decree on Digital Platforms, regardless of whether payment is actually made via the platform. The regulatory authority for this is the Electronic Transactions Development Agency (ETDA). Under this royal decree, digital platform providers that intend to operate a digital platform service must notify the ETDA prior to initiating operations. The extent of the details to be included in the notification to the ETDA will be more comprehensive if the digital platform: has annual revenue (before expenses) for digital platform services within Thailand exceeding THB 1.8 million (approx. USD 51,200) for an individual operator or THB 50 million (approx. USD 1.42 million) for a corporate or entity operator; or has more than 5,000 users (on average) per month. Apart
Read More