You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 24, 2024

Thailand: Ruling Clarifies “Lawful Basis” for Processing Certain Personal Data

Subscribe to Updates

In March 2024, a Thai court of first instance handed down a decision in a personal data protection case against an insurance company in Thailand. The landmark ruling has important implications for the disclosure of special categories of personal data.

The case concerned an individual, acting as the plaintiff, who filed a claim against an insurance company, as a data controller, and its representatives, for collecting, using, and disclosing the results of the plaintiff’s blood alcohol level test, along with a photo of the plaintiff taking the test, without explicit consent, resulting in his insurance claim being rejected. The company also disclosed the data to the insured party, who is the plaintiff’s family member, causing the plaintiff to suffer reputational damage, discrimination, humiliation, and ill treatment.

Since results of a blood alcohol level test are considered a special category of personal data pursuant to section 26 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the plaintiff filed the claim with the criminal court, requesting that the criminal penalties under the PDPA and the Penal Code be imposed on the defendants, and that the defendants delete or destroy the plaintiff’s personal data. The insurance company argued that it had disclosed the test results and the photograph to the plaintiff’s family member—as the insured under the insurance agreement—for the purpose of informing the insured of the rejection of the insurance claim.

Considering these facts and reasons, the criminal court ruled that the processing of this special category of personal data was necessary for the defense of the insurance company’s legal claims pursuant to section 26(4) of the PDPA, and therefore, explicit consent was not required. As a result, the criminal court dismissed the case.

Key Takeaways

While this case was dismissed, it indicates that explicit consent is not the only legal basis for processing a special category of personal data, and data controllers are able to process personal data as long as there is a lawful purpose and an appropriate legal basis to achieve that purpose. This case also suggests that data subjects are now becoming more aware of their rights in regard to privacy and personal data, which could increase the likelihood of more cases being brought before the courts.

As this ruling was made by the court of first instance, it might be appealed.

For more information on the interpretation of the PDPA, or on any aspect of data compliance in Thailand, please contact Nop Chitranukroh at [email protected], Nopparat Lalitkomon at [email protected], Gvavalin Mahakunkitchareon at [email protected], or Wilin Somya at [email protected].

Related Professionals

RELATED INSIGHTS​ 

August 21, 2025
Although the “passing off” principle has sometimes faced criticism for potentially broadening trademark protection—particularly in cases involving unregistered or unconventional marks like shapes, scents, or sounds—it serves an essential purpose. It safeguards the rights of business owners and shields consumers from deception, ensuring fair competition and reflecting the realities of modern commerce. What is passing off, and why is registrability not required? The passing-off principle is a legal concept rooted in English law, aimed at preventing a person from falsely representing or using a mark similar to another’s in a way that causes consumers to mistakenly believe the goods or services come from the same source. Under Thai law, the passing-off principle is provided under Section 46 of the Thai Trademark Act, which states: No person shall be entitled to bring legal proceedings to prevent or to recover damages for the infringement of an unregistered trademark. The provisions of this Section shall not affect the right of the owner of an unregistered trademark to bring legal proceedings against any person for passing off goods as those of the owner of the trademark. The passing-off principle can be interpreted as a practical legal concept. It does not require proof that the mark is registrable or meets the registrability criteria under trademark law. It is sufficient to show that the mark has established goodwill and that the other party’s use of a similar mark is likely to confuse consumers, making it a straightforward and effective tool for protecting brand assets. Requiring a claimant to prove that an unregistered mark could have been registered would undermine the very function of passing off. The doctrine was conceived precisely to fill the gaps left by the registration system. Imposing registrability criteria would nullify its function and leave many commercially valuable identifiers unprotected. If the
Read More
August 21, 2025
On August 18, 2025, Thailand’s Securities and Exchange Commission (SEC), in collaboration with the Ministry of Finance, the Anti-Money Laundering Office, and the Ministry of Tourism and Sports, announced the launch of TouristDigiPay. The initiative, implemented under the SEC’s Regulatory Sandbox, allows foreign tourists to convert digital assets into Thai baht for use in everyday transactions in Thailand. Foreign tourists who opt to participate in TouristDigiPay must open two accounts once they are in Thailand: An account with a licensed digital asset operator to sell or exchange digital assets for Thai baht; and A tourist wallet account with a licensed e-money operator regulated by the Bank of Thailand. Funds from digital asset sales will be transferred into the tourist wallet, enabling tourists to make payments at participating merchants that accept e-money. Key Regulatory Requirements The TouristDigiPay project will operate for a period of up to 18 months, with the following conditions: Only licensed digital asset brokers, dealers, and exchanges integrated with licensed e-money operators are eligible to participate. Operators must implement anti-money laundering (AML) protocols that are proportionate to the assessed risk level. These include: Conducting know-your-customer and customer-due-diligence (KYC/CDD) checks on all users. For monthly transactions exceeding THB 50,000 per person, verifying the source of the digital assets and assessing AML risk using internationally recognized blockchain forensic tools or equivalent procedures. Suspending or rejecting services if digital assets are transferred from wallets flagged for AML concerns. Ensuring that conversion between digital assets and fiat includes safeguards such as matching account names and returning digital assets only to the original wallet. The following transaction limits apply to participants in the TouristDigiPay initiative: Payments to small vendors are capped at THB 50,000 per month. Payments to vendors who have completed the know-your-merchant (KYM) process are capped at THB 500,000 per
Read More
August 20, 2025
On August 7, 2025, the government of Vietnam promulgated Decree No. 219/2025/ND-CP on foreign workers working in Vietnam (Decree 219), introducing substantial reforms to the management of foreign employees. Taking immediate effect upon issuance, and superseding earlier regulations on foreign employees under Decree No. 152/2020/ND-CP as amended by Decree No. 70/2023/ND-CP (collectively referred to as “Decree 152”), Decree 219 sets out clear timeframes and application requirements for work permit issuance, while adopting more flexible policies to support business operations. The key new provisions are as follows: 1. Relaxed Requirements Regarding Job-Posting Under Decree 152, employers were required to follow a complex process to apply for work permits or work permit exemption certificates for foreign employees. This included posting an advertisement for any position the employer wished to fill with a foreign employee on a designated online portal for a given amount of time, to demonstrate that the company tried, but failed, to find a suitable Vietnamese candidate for the position. This job-posting step now only applies when the foreigner will work in Vietnam under a local labor contract. Foreigners coming to Vietnam as intra-corporate transferees (i.e., as secondees) or working under service contracts are exempt. The job-posting period is also reduced from 15 calendar days to five business days. Employers may also now post the advertisements on multiple websites instead of only the online portal of the Ministry of Labor, Invalids and Social Affairs (now the Ministry of Home Affairs after government restructuring) or the provincial-level employment service center. 2. Work Permit Application Dossier Previously, employers were required to complete a preapproval step, whereby they had to submit a dossier explaining their foreign labor demand that required approval from the labor authority. Once approval for the foreign labor demand was granted, the approval dossier was an integral part of
Read More
August 20, 2025
With the shift in US policy to discourage DEI programs among government and private-sector employers, some companies have been cutting back. But US companies should be cautious in eliminating their DEI programs globally, as some elements of these programs are obligations under local laws in Vietnam, Thailand, and Cambodia.
Read More