You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 24, 2024

Thailand: Ruling Clarifies “Lawful Basis” for Processing Certain Personal Data

Subscribe to Updates

In March 2024, a Thai court of first instance handed down a decision in a personal data protection case against an insurance company in Thailand. The landmark ruling has important implications for the disclosure of special categories of personal data.

The case concerned an individual, acting as the plaintiff, who filed a claim against an insurance company, as a data controller, and its representatives, for collecting, using, and disclosing the results of the plaintiff’s blood alcohol level test, along with a photo of the plaintiff taking the test, without explicit consent, resulting in his insurance claim being rejected. The company also disclosed the data to the insured party, who is the plaintiff’s family member, causing the plaintiff to suffer reputational damage, discrimination, humiliation, and ill treatment.

Since results of a blood alcohol level test are considered a special category of personal data pursuant to section 26 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the plaintiff filed the claim with the criminal court, requesting that the criminal penalties under the PDPA and the Penal Code be imposed on the defendants, and that the defendants delete or destroy the plaintiff’s personal data. The insurance company argued that it had disclosed the test results and the photograph to the plaintiff’s family member—as the insured under the insurance agreement—for the purpose of informing the insured of the rejection of the insurance claim.

Considering these facts and reasons, the criminal court ruled that the processing of this special category of personal data was necessary for the defense of the insurance company’s legal claims pursuant to section 26(4) of the PDPA, and therefore, explicit consent was not required. As a result, the criminal court dismissed the case.

Key Takeaways

While this case was dismissed, it indicates that explicit consent is not the only legal basis for processing a special category of personal data, and data controllers are able to process personal data as long as there is a lawful purpose and an appropriate legal basis to achieve that purpose. This case also suggests that data subjects are now becoming more aware of their rights in regard to privacy and personal data, which could increase the likelihood of more cases being brought before the courts.

As this ruling was made by the court of first instance, it might be appealed.

For more information on the interpretation of the PDPA, or on any aspect of data compliance in Thailand, please contact Nop Chitranukroh at [email protected], Nopparat Lalitkomon at [email protected], Gvavalin Mahakunkitchareon at [email protected], or Wilin Somya at [email protected].

Related Professionals

RELATED INSIGHTS​ 

July 25, 2025
Over the first half of 2025, the government of Vietnam has implemented a comprehensive suite of legislative reforms that significantly impact the country’s intellectual property (IP) framework. These amendments, most of which took effect on 1 July 2025, span the criminal, civil, administrative, and judicial sectors, and are part of a broader initiative to modernize Vietnam’s legal infrastructure, strengthen enforcement mechanisms, and harmonize domestic regulations with international standards. A summary of the key legislative changes and their potential implications for IP protection and enforcement across Vietnam is provided below. Criminal Code: Stricter penalties Under the 2025 amendments to Vietnam’s Criminal Code, penalties for offenses involving the manufacturing and trading of counterfeit goods have been significantly escalated. Individuals convicted of such violations now face fines ranging from VND 200 million to VND 2 billion (approximately USD 7,700 to USD 77,000; up from VND 100 million to VND 1 billion). For corporate entities, the penalties are even more severe, with fines ranging from VND 2 billion to VND 40 billion (roughly USD 77,000 to USD 1.54 million; up from VND 1 billion to VND 20 billion). These heightened penalties reflect the government’s intensified efforts to deter counterfeit-related crimes and protect consumer rights. Law on Handling Administrative Violations: Extended statute of limitations and application of electronic procedure The statute of limitations for addressing administrative violations in the IP sector is still two years. However, in cases where such violations are referred by procedural authorities, this period is extended by one year. The time taken by these authorities to process the case is now included within the overall limitation period. In addition, the Law on Handling Administrative Violations facilitates the use of electronic procedures, provided that the necessary infrastructure, technical systems, and information conditions are in place. Specifically, enforcement authorities are now permitted
Read More
July 24, 2025
Thai authorities have escalated efforts to block unlawful cross-border digital asset business operators. On June 19, 2025, the Ministry of Digital Economy and Society (MDES) issued a notification empowering it to ban internet access to operations or services offered by digital asset business operators who lack licenses from the Thailand Securities and Exchange Commission (SEC) under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018). This ban, issued under the 2023 Royal Decree on Measures for the Prevention and Suppression of Technology Crime, particularly aims to block Thai users’ access to services offered by unlicensed offshore digital asset providers via their own apps or websites or through public social media platforms. Compliance Requirements The notification requires internet service providers and social media platforms selected by MDES to immediately impose internet access restrictions on identified apps, websites, and IP addresses of illegal operators upon receiving MDES orders. Takedown Orders There are two tracks for competent officials at MDES to issue orders to operators: If the competent official is notified by the SEC of licensing noncompliance by a particular digital asset business operator, the competent official can issue a takedown order to the operator upon approval from the permanent secretary of MDES. If the competent official independently discovers, or receives a complaint from any third party other than the SEC, that a digital asset business operator may have violated licensing requirements, the competent official can ask the SEC to verify and confirm the relevant facts and noncompliance before seeking approval from the permanent secretary of MDES to issue the takedown order. Streamlined Enforcement Prior to this notification, the SEC could obtain takedown orders only from Thai courts under the 2007 Computer Crime Act to take down or block access to unlicensed digital asset platforms and apps. This was a relatively
Read More
July 24, 2025
Vietnam’s Ministry of Public Security recently released a draft version of the 2025 Cybersecurity Law, which is intended to replace both the existing 2018 Cybersecurity Law and the 2015 Law on Network Information Security (LNIS). This consolidation reflects a broader effort by the Vietnamese government to streamline and centralize the legal framework governing cybersecurity, data protection, and information security to be under the sole authority of the Ministry of Public Security, moving away from the previous sharing of responsibility with the former Ministry of Information and Communications (which ceased operations earlier this year and merged with the Ministry of Science and Technology). This shift aims to eliminate overlaps and improve enforcement efficiency. The draft law is built upon the foundation of principles and provisions of both the 2018 Cybersecurity Law and the 2015 LNIS, while also introducing a wide range of amendments and new regulations. By merging the two laws, the government seeks to reduce legal fragmentation and ensure consistency in definitions, obligations, and enforcement mechanisms across related domains like data protection, IT system classification, and cybercrime prevention. The newly introduced amendments include enhanced obligations for service providers, stricter controls on information transmission, classification of IT systems, designation and protection of nationally important information systems, and sector-specific violations and compliance requirements. Highlights of the draft law are discussed below. Definition and Obligations of Service Providers The draft law clearly defines and significantly broadens the scope of entities considered “service providers” under its jurisdiction. This now includes businesses and individuals offering products or services in cyberspace, including both infrastructure and content online services, such as: Internet service providers (ISPs) and providers of telecommunications, hosting, servers, domain names, VPNs, proxy services, and cloud computing; Providers of social networks, websites, and online gaming; Financial institutions, banks, foreign bank branches in Vietnam, e-wallet
Read More
July 23, 2025
In cross-border disputes, a recurring concern for claimants is whether they can protect respondents’ assets located in jurisdictions other than the seat of arbitration. This article explores whether Thai courts can issue interim measures, such as freezing orders, under Section 16 of the Thai Arbitration Act (2002) to support an arbitration seated outside of Thailand. Requesting Interim Measures Section 16 provides that a party to an arbitration agreement may request that the court impose interim measures, either before or during arbitral proceedings. If the court determines that it would have been able to impose such measures had the proceedings been conducted in court, it may proceed as requested. Notably, Section 16 does not limit its application to arbitrations seated in Thailand. It simply refers to “a party to an arbitration agreement,” which arguably includes both domestic and international arbitrations. Further, it allows for applications even before arbitration is commenced, provided that the arbitration is initiated within thirty days from the issuance of the order (or other period the court prescribes). A Hypothetical Scenario Consider the following scenario: Company A, incorporated in the Netherlands, and Company B, incorporated in the Cayman Islands, have entered into a contract containing a clause requiring arbitration at the Singapore International Arbitration Center (SIAC). A dispute arises, and Company A commences arbitration at SIAC. Company B holds significant assets in Thailand, such as bank accounts or real estate. Concerned that Company B might dispose of its assets before an award is rendered, Company A applies to the Thai court seeking a freezing order over those assets. Can the Thai court issue such an interim measure? The answer is not straightforward. Thai law is silent regarding whether Section 16 applies to arbitrations seated outside Thailand, leaving the door open for argument. Some academic sources suggest that
Read More