You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 24, 2024

Thailand: Ruling Clarifies “Lawful Basis” for Processing Certain Personal Data

Subscribe to Updates

In March 2024, a Thai court of first instance handed down a decision in a personal data protection case against an insurance company in Thailand. The landmark ruling has important implications for the disclosure of special categories of personal data.

The case concerned an individual, acting as the plaintiff, who filed a claim against an insurance company, as a data controller, and its representatives, for collecting, using, and disclosing the results of the plaintiff’s blood alcohol level test, along with a photo of the plaintiff taking the test, without explicit consent, resulting in his insurance claim being rejected. The company also disclosed the data to the insured party, who is the plaintiff’s family member, causing the plaintiff to suffer reputational damage, discrimination, humiliation, and ill treatment.

Since results of a blood alcohol level test are considered a special category of personal data pursuant to section 26 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the plaintiff filed the claim with the criminal court, requesting that the criminal penalties under the PDPA and the Penal Code be imposed on the defendants, and that the defendants delete or destroy the plaintiff’s personal data. The insurance company argued that it had disclosed the test results and the photograph to the plaintiff’s family member—as the insured under the insurance agreement—for the purpose of informing the insured of the rejection of the insurance claim.

Considering these facts and reasons, the criminal court ruled that the processing of this special category of personal data was necessary for the defense of the insurance company’s legal claims pursuant to section 26(4) of the PDPA, and therefore, explicit consent was not required. As a result, the criminal court dismissed the case.

Key Takeaways

While this case was dismissed, it indicates that explicit consent is not the only legal basis for processing a special category of personal data, and data controllers are able to process personal data as long as there is a lawful purpose and an appropriate legal basis to achieve that purpose. This case also suggests that data subjects are now becoming more aware of their rights in regard to privacy and personal data, which could increase the likelihood of more cases being brought before the courts.

As this ruling was made by the court of first instance, it might be appealed.

For more information on the interpretation of the PDPA, or on any aspect of data compliance in Thailand, please contact Nop Chitranukroh at [email protected], Nopparat Lalitkomon at [email protected], Gvavalin Mahakunkitchareon at [email protected], or Wilin Somya at [email protected].

Related Professionals

RELATED INSIGHTS​ 

August 25, 2025
To implement the recently issued Resolution on International Financial Centers in Vietnam (“IFC Resolution”), which is set to take effect on September 1, 2025 (see our previous article), the government of Vietnam is making every effort to formulate and issue guiding decrees—up to eight in total—before the effective date of the resolution. These decrees will establish key principles, define the rights and obligations of stakeholders, and outline permissible business activities within the IFCs, and serve as a foundation for the legal framework of the IFCs. Below are highlights of two draft decrees that have been released for public consultation. Draft Decree on IFC Establishment Ho Chi Minh City: The IFC in Ho Chi Minh City will focus on capital markets integrated with asset management services, fund management, insurance, financial products and financial derivatives; banking systems and money market products; fintech and financial innovation through sandbox mechanisms; specialized exchanges and new trading platforms; commodity markets, commodity and commodity derivatives exchanges linked to domestic and international physical commodity markets; and regional supply chain services, logistics hubs, maritime transport, and seaport infrastructure. Da Nang: The IFC in Da Nang will mainly develop green finance and commercial finance for SMEs and innovative enterprises, non-resident organizations and individuals (i.e., offshore financial services); cross-border trade activities linked to free trade zones, high-tech zones, new economic zones, and industrial zones; pilot control mechanisms for emerging models, such as digital assets, cryptocurrencies, and digital payments and transfers; new exchanges and trading platforms; investment funds, remittance funds, and small and medium fund management companies; startups in financial solutions for consumer services, tourism, e-commerce, logistics, and services within free trade zones; and related support, advisory, development, and legal services. Incentives: The People’s Committees of Ho Chi Minh City and Da Nang will need to decide on their list of
Read More
August 25, 2025
Artificial intelligence (AI), semiconductors, and digital assets are considered critical drivers of Vietnam’s future economic growth and are fundamental to the nation’s digital transformation targets. These sectors form the core of Vietnam’s strategy to build a robust, globally competitive digital economy. This strategic direction gained substantial momentum with the issuance of the Law on Digital Technology Industry (DTI Law) on June 14, 2025. The DTI Law was designed to attract investment, stimulate innovation, cultivate high-quality human resources, and ensure the responsible, secure, and sustainable growth of digital technologies like AI and digital assets, harmonizing Vietnam’s digital industry with international standards while safeguarding public interests and national security. Several key provisions of the DTI Law took effect on July 1, 2025, and the law will become fully effective on January 1, 2026. The government is delegated to provide further necessary guidelines and details for implementation of the law. Artificial Intelligence (AI): Principle-Driven and Risk-Based Regulations Under the DTI Law, there are seven core principles guiding the development, provision, and use of AI which are applicable to AI developers, providers and deployers. These principles favor values-based governance over purely technical prescriptions, and include the following: Taking a human-centered approach that upholds ethical values, inclusivity, flexibility, equality, and non-discrimination. Ensuring transparency, accountability, and explainability, with AI systems remaining under human control. Maintaining cybersecurity and system safety. Adherence to data protection and privacy regulations. Having the ability to control AI algorithms and models. Effective risk management throughout the entire lifecycle of AI systems. Compliance with consumer protection laws and other relevant legal frameworks. AI system management follows a risk-based approach, with the law categorizing systems into high-risk, high-impact, and other groups. High-risk AI systems are those that, in certain applications, may pose significant threats or harm to individuals or the public interest while
Read More
August 25, 2025
Indonesia’s current regulations on franchises, as stipulated under Government Regulation No. 35/2024 on Franchising and its implementing regulation, Ministry of Trade (MOT) Regulation No. 71/2019 regarding Implementation of Franchising, highlight fundamental changes in franchise registration. These changes have introduced additional complexities and challenges in the franchise registration procedure, making it more difficult for franchise owners to navigate the process. New procedure Franchise applications are still submitted through the Online Single Submission (OSS) portal of the Capital Investment Coordinating Board (BKPM). However, the new procedure requires each applicant, including foreign franchisors, to have an OSS account and a business registration number (NIB) issued by BKPM. An application for franchise registration must be submitted under the applicant’s own account—submissions can no longer be made through the account of a consultant. Once a franchise application is submitted, the authority will distribute the submission to the MOT—the authorized ministry for franchise registration. Any notification or decision upon the registration made by the MOT will be available in the OSS system. Applicants should regularly monitor the status of the franchise application because no notifications will be sent to applicants to alert them of any deficiency. Here is the summary of the new procedure for franchisors: Notable Requirements The disclosure document, or prospectus, is the key focus for the MOT in examining a franchise registration for a franchisor. This document is subject to thorough scrutiny by the MOT to ensure that all mandatory information meets the requirements set in the franchise regulations. The current regulations specifically require that the mandatory clause “business system” in the prospectus cover operational standards and procedures, which should include human resource management, administration, operational management, standard operating methods, business location selection, business premises design, employee requirements, and marketing strategies. Other clauses that are equally important to pay attention to are:
Read More
August 22, 2025
On August 12, 2025, Vietnam’s Ministry of Agriculture and Environment submitted a draft law amending several provisions of the Land Law 2024 (“Draft Amended Land Law” or “Draft”) for government consultation and public comment. The Draft primarily aims to address three controversial issues in Vietnam’s land regime concerning (i) land pricing, (ii) land clearance, and (iii) the allocation of land outside auctions, following policy set out by Resolution 18-NQ/TW and the newly adopted Resolution 69-NQ/TW on land governance modernization. Land pricing is potentially one of the most important areas among the proposed reforms. The Draft, however, has notably not addressed a major concern recently raised by the public: When a project has been allocated or leased land, but the relevant authority has not yet issued the land-price decision, a “supplemental charge” continues to accrue for the entire waiting period. Under current rules, this charge is calculated at 5.4% per year on the ultimately determined land-use fee or land rent, materially shifting project economics and pricing risks to developers or end-buyers. Core Reforms on Land Pricing The Draft Amended Land Law sets out a number of reforms on land pricing, including the following: Land price tables: The Draft maintains provincial land price tables but clarifies the scope of application: They are used to determine land-related financial obligations of land users and compensation when the state recovers land; the government will detail the adjustment coefficient regime, ratios for land-use fee calculation by land type/user/form, and deductible infrastructure costs. Provincial people’s committees will continue to issue land price tables every five years, effective from January 1 of the first year in the cycle, with authority to supplement within the cycle as necessary. In provinces with cadastral maps and digital land price databases, the tables may be established down to the land-parcel level,
Read More