You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 24, 2024

Thailand: Ruling Clarifies “Lawful Basis” for Processing Certain Personal Data

Subscribe to Updates

In March 2024, a Thai court of first instance handed down a decision in a personal data protection case against an insurance company in Thailand. The landmark ruling has important implications for the disclosure of special categories of personal data.

The case concerned an individual, acting as the plaintiff, who filed a claim against an insurance company, as a data controller, and its representatives, for collecting, using, and disclosing the results of the plaintiff’s blood alcohol level test, along with a photo of the plaintiff taking the test, without explicit consent, resulting in his insurance claim being rejected. The company also disclosed the data to the insured party, who is the plaintiff’s family member, causing the plaintiff to suffer reputational damage, discrimination, humiliation, and ill treatment.

Since results of a blood alcohol level test are considered a special category of personal data pursuant to section 26 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the plaintiff filed the claim with the criminal court, requesting that the criminal penalties under the PDPA and the Penal Code be imposed on the defendants, and that the defendants delete or destroy the plaintiff’s personal data. The insurance company argued that it had disclosed the test results and the photograph to the plaintiff’s family member—as the insured under the insurance agreement—for the purpose of informing the insured of the rejection of the insurance claim.

Considering these facts and reasons, the criminal court ruled that the processing of this special category of personal data was necessary for the defense of the insurance company’s legal claims pursuant to section 26(4) of the PDPA, and therefore, explicit consent was not required. As a result, the criminal court dismissed the case.

Key Takeaways

While this case was dismissed, it indicates that explicit consent is not the only legal basis for processing a special category of personal data, and data controllers are able to process personal data as long as there is a lawful purpose and an appropriate legal basis to achieve that purpose. This case also suggests that data subjects are now becoming more aware of their rights in regard to privacy and personal data, which could increase the likelihood of more cases being brought before the courts.

As this ruling was made by the court of first instance, it might be appealed.

For more information on the interpretation of the PDPA, or on any aspect of data compliance in Thailand, please contact Nop Chitranukroh at [email protected], Nopparat Lalitkomon at [email protected], Gvavalin Mahakunkitchareon at [email protected], or Wilin Somya at [email protected].

Related Professionals

RELATED INSIGHTS​ 

September 4, 2025
With advancements in health technology, telemedicine has taken on a wider online presence in Thailand. Under the Medical Facility Act, licensed clinics and hospitals may now diagnose, prescribe, and issue electronic prescriptions during a video call, provided they maintain patient confidentiality and proper recordkeeping. As a complementary concept, a telepharmacy allows a pharmacist to verify prescriptions, counsel patients, and dispense medication from a remote site. Hospitals, clinic chains, and some retail pharmacy groups have adopted “drive-thru” or “locker” pick-up points where drugs are bagged only after a real-time video consultation with a registered pharmacist. The clear benefits of telehealth include shorter waiting times and broader access to specialists, which is in the public interest. Drug Distribution and Advertising in Thailand The online pharmacy ecosystem creates a legal bridge in that once a teleconsulting doctor issues an e-prescription, a licensed pharmacy can lawfully dispense and deliver the medicine prescribed to the patient’s door. Nonetheless, the critical compliance component remains the advertising of medicinal drugs. It is still not allowed to advertise prescription/pharmacy-dispensed drugs to the public in Thailand. Although Thailand’s Drug Act of 1967 was written more than half a century ago, it still governs the trading of every medicinal drug that makes its way to consumers in Thailand—whether bought at a pharmacy or delivered with a few taps on a smartphone. First and foremost, the pharmacy must hold a license to sell medicinal drugs as a retailer. It is also mandatory that arrangements be made for a pharmacist to be on duty during opening hours. Drugs are classified into three main categories: prescription drugs, pharmacy-dispensed drugs, and over-the-counter (OTC) drugs. The listing of OTC drugs with their prices via an online platform is allowed, as only OTC drugs may be advertised directly to the public. However, naming or showing
Read More
September 4, 2025
On June 6, 2025, the Superior People’s Court in Hanoi overturned a non-use cancellation decision by the Intellectual Property Office of Vietnam, a rare and impactful occurrence. In a ruling that may help clarify the enforcement of Vietnam’s IP Law, the court held that valid trademark use can be established through commercial arrangements where the brand owner maintains actual control over the use of the mark, and is not confined to relationships governed by a so-called “formal license agreement. Background: Cross-Border Use, Local Challenge A Singapore company owns a well-known brand of consumer products that has gained recognition across Southeast Asia. In recent years, the brand has been targeted by several unauthorized trademark filings in Vietnam. In one such instance, a local Vietnamese trading company—previously linked to the production and export of counterfeit goods to neighboring countries—filed a non-use cancellation against the Singapore company’s mark and sought to register it under its own name. If the cancellation had been upheld, it would have enabled a complete hijacking of the brand. The IP holder operates in Vietnam through a structured cross-border supply chain. Under an agreement between two related foreign entities, one of which managed regional operations, production orders were placed through a designated Vietnamese company. While the Vietnamese manufacturer was not a party to the agreement, its role in using the mark was recognized and governed by internal and commercial documentation. The Vietnamese manufacturer lawfully obtained the necessary permits, regulatory approvals, and customs clearances for producing the goods in Vietnam. These activities were supported by banking records and internal communications, evidencing active, continuous use of the mark in Vietnam. However, the IP Office concluded that this use did not meet the statutory criteria because the Vietnamese manufacturer did not have a direct license agreement with the brand owner, as
Read More
September 3, 2025
Liberal cannabis access in Thailand is officially over. On June 26, 2025, the Ministry of Public Health brought the inflorescence of cannabis back under tight control through its new Notification on Controlled Herbs (Cannabis) 2025 (“Notification 2025”). The message is that cannabis may stay in the marketplace, but only if strictly supervised under a cannabis prescription from a medical professional. Two main pillars now define compliance: (1) prescription requirements and mandatory reporting, and (2) Good Agricultural and Collection Practices (GACP). This article aims to summarize each essential element for the relevant parties. 1. Getting a Prescription: Digital Diagnosis vs. Real-World Paperwork? Dispensaries, even those with a license to sell cannabis, can no longer sell cannabis to walk-in customers who don’t have a valid prescription. Sales are lawful only when the buyer duly presents a cannabis prescription issued by one of seven recognized professional practitioners, including medical doctors, Thai traditional medicine doctors, applied Thai traditional medicine doctors, folk healers, Chinese medicine practitioners, pharmacists, or dentists. Notification 2025 does not mention teleconsultations or online prescriptions. Nonetheless, policymakers at this stage opine that an online chat or casual consultation, with the prescription sent via a social media platform or e-mail, would not comply with this latest regulation. In order to be eligible to issue cannabis prescriptions, medical doctors should be working in a clinic or hospital and should issue paper-based prescriptions. The official prescription form, called a PT 33, must be used. The prescriber has the discretion to indicate the cannabis strain (or product type), dosage, and intended duration of use, which cannot exceed 30 days per prescription. This ensures that the product matches the patient’s medical needs and aligns with professional treatment guidelines. In practice, each prescription will be valid for one-time use only and cannot be refilled; a new prescription
Read More
September 2, 2025
Thailand’s Office of the Consumer Protection Board (OCPB) has initiated a sweeping regulatory review of licensed direct sale and direct marketing businesses in Thailand and is in the process of notifying business operators to submit their annual business report and financial statement to the OCPB as part of their postlicensing obligations. This move marks a significant escalation in the government’s efforts to enforce compliance and transparency in the sector, which has faced growing scrutiny in recent years. Key Regulatory Considerations All businesses holding a direct sales or direct marketing license are required to submit their audited financial statement along with their business operation report to the OCPB within 60 days from the end of their fiscal year (extendable for up to 30 days by request, if necessary). The OCPB is currently conducting license audits as part of its enforcement duties. The office aims to complete audits for at least 90% of the 2,983 registered businesses that have obtained their license since 2022. This includes a review of the business conduct of the license holder. New license applications are also under scrutiny. Applicants are currently being subjected to background checks, and the OCPB has signaled a more rigorous vetting process moving forward. Impact of Noncompliance Failure to comply with these reporting obligations may result in escalating enforcement actions, including: Official notice to rectify noncompliance within a specified timeframe. Revocation of business registration, if the operator fails to respond. Revocation of business registration could result in a five-year prohibition on reapplying for a direct sales or direct marketing license following the revocation. The OCPB has already initiated outreach efforts, including SMS and email notifications, and has hosted seminars to raise awareness of these obligations. These measures are part of a broader initiative to enhance transparency and consumer trust in the sector. Businesses operating in the direct selling and
Read More