You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 24, 2024

Thailand: Ruling Clarifies “Lawful Basis” for Processing Certain Personal Data

Subscribe to Updates

In March 2024, a Thai court of first instance handed down a decision in a personal data protection case against an insurance company in Thailand. The landmark ruling has important implications for the disclosure of special categories of personal data.

The case concerned an individual, acting as the plaintiff, who filed a claim against an insurance company, as a data controller, and its representatives, for collecting, using, and disclosing the results of the plaintiff’s blood alcohol level test, along with a photo of the plaintiff taking the test, without explicit consent, resulting in his insurance claim being rejected. The company also disclosed the data to the insured party, who is the plaintiff’s family member, causing the plaintiff to suffer reputational damage, discrimination, humiliation, and ill treatment.

Since results of a blood alcohol level test are considered a special category of personal data pursuant to section 26 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the plaintiff filed the claim with the criminal court, requesting that the criminal penalties under the PDPA and the Penal Code be imposed on the defendants, and that the defendants delete or destroy the plaintiff’s personal data. The insurance company argued that it had disclosed the test results and the photograph to the plaintiff’s family member—as the insured under the insurance agreement—for the purpose of informing the insured of the rejection of the insurance claim.

Considering these facts and reasons, the criminal court ruled that the processing of this special category of personal data was necessary for the defense of the insurance company’s legal claims pursuant to section 26(4) of the PDPA, and therefore, explicit consent was not required. As a result, the criminal court dismissed the case.

Key Takeaways

While this case was dismissed, it indicates that explicit consent is not the only legal basis for processing a special category of personal data, and data controllers are able to process personal data as long as there is a lawful purpose and an appropriate legal basis to achieve that purpose. This case also suggests that data subjects are now becoming more aware of their rights in regard to privacy and personal data, which could increase the likelihood of more cases being brought before the courts.

As this ruling was made by the court of first instance, it might be appealed.

For more information on the interpretation of the PDPA, or on any aspect of data compliance in Thailand, please contact Nop Chitranukroh at [email protected], Nopparat Lalitkomon at [email protected], Gvavalin Mahakunkitchareon at [email protected], or Wilin Somya at [email protected].

Related Professionals

RELATED INSIGHTS​ 

July 31, 2025
The Madrid System for international trademark registration provides the opportunity for a simplified and cost-effective way to register trademarks in multiple countries through a single application. Indonesia joined the Madrid System in 2018, and in 2024 alone, it received over 8,600 applications through this system. Despite the system’s effectiveness, it is important for trademark owners to be aware of the potential risks of refusal that can arise during the process of registration. Trademark applicants must pay close attention to these critical points when designating Indonesia. Appointing a Local Representative to Respond An applicant or representative of an international registration (IR) application that has been provisionally refused must appoint a local Indonesian representative in order to submit a response to the provisional refusal. This appointment is solely for the purpose of responding to the refusal in Indonesia; it is not necessary if the IR has not received any rejection. Furthermore, the local representative should not be registered with WIPO, as doing so would affect representation across all designated countries. Timing When it comes to calculating the deadline for responding to a provisional refusal, there is a discrepancy between the methods used by the DGIP and WIPO. Under the Indonesian Trademark Law, trademark owners can file a response within 30 working days, excluding weekends and national holidays. However, the WIPO cover letter accompanying the DGIP’s provisional refusal notice specifies both the start date and the deadline for responding to the notification, which is calculated as 30 calendar days, including weekends and national holidays. Therefore, a response to the provisional refusal of IR should be submitted in accordance with the WIPO cover letter to prevent any formality issue. Grounds for Refusal After an IR application is published in Indonesia’s Trademark Gazette, it undergoes substantive examination by the Directorate General of Intellectual Property (DGIP) examiners. The
Read More
July 30, 2025
Artificial intelligence (AI) model training and data scraping are essential processes in the development of modern AI systems. AI model training involves using large datasets to teach machine learning algorithms to recognize patterns, make predictions, or generate new content. Data scraping refers to the automated extraction of information from websites or digital sources, often to assemble the vast datasets required for effective AI training. As these practices become more widespread, questions about the legality of using third-party content—especially copyrighted works—have become increasingly important. In Thailand, the legal landscape for AI developers is shaped primarily by the Copyright Act, which presents unique challenges due to the absence of a fair-use exception. This article examines the copyright-related risks and legal uncertainties facing AI developers under Thailand’s current copyright law and practices, offering strategic guidance for navigating this complex environment. Copyright Risks in AI Scraping and Training Thailand’s Copyright Act does not provide a broad fair use or fair dealing exception, unlike some other jurisdictions, such as the United States. This absence has significant consequences for AI developers: No general defense for AI training: Any use of copyrighted material for AI model training is presumed to be infringing unless a specific, narrow statutory exception applies or explicit permission is obtained from the rights holder. There is no general legal basis for using copyrighted works in AI training without authorization. Increased rights clearance burden: Developers must identify and secure licenses for every copyrighted work included in their training datasets. Given the scale and diversity of data required for effective AI models, this process can be both impractical and costly. Legal ambiguity and litigation risk: The lack of clear statutory guidance or case law leaves developers in a legal gray area. There is no established precedent clarifying whether certain uses of copyrighted material for
Read More
July 25, 2025
現代のビジネス戦略が持続可能性が重視されるようになり、ESG原則の影響は商品デザイン、パッケージ、そしてブランド保護に新たな形を与えている。タイにおけるラベルレスボトルから立体商標の法的重要性まで、これらの動向は環境責任と知的財産の結びつきの深まりを浮き彫りにしている。 ESGの台頭 ESG原則は、世界中でビジネス戦略を策定する上で不可欠な要素となっている。企業はESGデータを開示することをますます要求され、これは投資家の意思決定、融資、そして消費者行動に影響を与えている。調査によると、消費者は持続可能なパッケージに対してより多くのお金を払う意思があり、ESGへの取り組みに力を入れている企業は高い成長率を達成する傾向がある。 プロダクト・ミニマイゼーションのトレンド 大きな変革を経験している分野の一つが消費財業界で、世界中のブランドがESG原則に沿ったパッケージを採用している。注目すべき取り組みの一つはパッケージの小型化で、pepsiが2022年に中国で初めてラベルレスPETボトルを導入したことがその好例である。同様にタイでは、SPRINCLEの飲料水「Redesign to Reduce」および同様のイニシアチブをはじめ、複数のボトル・ウォーターのブランドがラベルレス・デザインを採用している。 こうした変化はブランドイメージの向上だけでなく、消費者やビジネスパートナーからも温かく歓迎されている。例えば、キャセイパシフィック航空は、機内リサイクル活動の強化に向けた継続的な取り組みの一環として、一部のフライトと客室でラベルフリーのボトル・ウォーターを導入した。 立体商標でデザインから識別性へ パッケージはブランド・アイデンティティの重要な要素へと進化し、機能性と識別性を融合させることで消費者の認知度とロイヤルティを高める。この変化は知的財産に大きな影響を及ぼしている。これらのデザインは、その高い商業的価値を考えると、もはやオプション的なものではなく、不可欠な要素である。意匠権や立体商標などを介して法的保護を確保することは、戦略的に不可欠な要素となっている。持続可能性とイノベーションが重視される時代において、識別可能なパッケージを保護することは、単なる予防措置ではなく、競争優位性を維持し、ブランドの永続的な成功を確保するための基本的なステップである。 タイでは、商標法により、幅、高さ、奥行きを含む物体の立体的な形状を表す立体商標を登録することができる。立体商標が登録されるためには、識別性、つまりある事業者の商品またはサービスを他の事業者の商品またはサービスと区別できる特徴を示すことが必要がある。ただし、その形状は、単に商品の本質的な形状を反映したもの、または技術的機能を実現するために不可欠なデザインであってはならない。 その構成に固有の識別力が欠けているとしても、継続的かつ広範囲な使用を通じて消費者の幅広い認知を得ている場合は、登録が認められる可能性がある。このような場合、企業は、そのデザインが商品の出所を強く識別する役割を果たしていることを証明する必要がある。このプロセスでは通常、マーケティング資料、広告記録、流通データなど、消費者の認知を効果的に裏付ける包括的な証拠を収集する必要がある。注目すべき例として、イタリアの高級ブランドであるBulgariは、独自の円形状物が勘合する香水瓶のデザインをタイで立体商標として登録することに成功した。 重要なポイント 企業がパッケージ戦略やブランディング戦略に持続可能性を組み込む傾向は、ますます強まっている。環境に配慮した取り組みの一環として、ミニマルでラベルレスなデザインが世界中で人気を集めている。個性的なパッケージデザインは、ブランド・アイデンティティを定義する上で重要な役割を果たし、商標法の下、法的に保護され得る。タイでは、立体商標として保護されるためには、デザインが識別性または消費者の認知度の高さを示す必要があり、多くの場合、マーケティング記録や流通データなどのたくさんの証拠によって裏付けらる。これらの法的要件を早期に理解することで、企業はブランド・アイデンティティを守るための積極的な対策を講じることができる。商品の出所を自然に伝えるデザインについては、ESG（環境（Environment）、社会（Social）、企業統治（Governance））が重視される今日の環境において、法的保護を求めることが最優先事項である。   備考：本和文は英文記事を翻訳したものです。原文については、以下のリンクをご参照ください。 The Rise of ESG and Its Implications for 3D Mark Protection in Thailand            
Read More
July 25, 2025
On June 17, 2025, the National Assembly of Vietnam adopted Law No. 76/2025/QH15 (Amended LOE) amending and supplementing the 2020 Law on Enterprises, which aims to reshape the legal framework to enhance transparency and alignment with international standards. The Amended LOE took effect from July 1, 2025. Below are key notes on the Amended LOE. Recognition of Beneficial Owners The beneficial owner (BO) concept was previously addressed under Vietnam’s anti-money laundering framework. However, the formal recognition of a BO in the Amended LOE marks a pivotal advancement in embedding ownership transparency into corporate governance, in line with the G7 Financial Action Task Force’s standards on anti-money laundering and counter-terrorism financing. Under the Amended LOE and Decree No. 168/2025/ND-CP of the government dated June 30, 2025, on enterprise registration (Decree 168), a BO is identified through either equity ownership or control rights. Equity ownership: Individuals holding 25% or more of a company’s charter capital or voting shares, either directly or indirectly, qualify as BOs. Indirect ownership is further defined as ownership of at least 25% of charter capital or voting shares through an intermediary organization. Control rights: Individuals with the authority to make or influence major decisions are considered BOs. The actual control over a company includes the power (i) to appoint or remove most or all members of the board of directors or the members’ council or the general director of a company; (ii) to amend the charter; or (iii) to decide other key matters specified in the company’s charter. Notably, individuals representing state ownership in state-owned enterprises are excluded from the scope of the BO concept. Companies are responsible for collecting, updating, and retaining information about BOs and cooperating with authorities when requested to identify BOs, among other obligations. Additionally, any companies registered before July 1, 2025, must
Read More