You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 22, 2012

Using the Computer Crimes Act to Combat Online Piracy

Informed Counsel

The increase in online shopping has proven lucrative for legitimate retailers. But traders selling counterfeit and pirated products have also taken advantage by selling a wide range of counterfeit products online. In searching for new solutions to battle intellectual property infringement on the internet, recent meetings between government officials and members of the private sector have resulted in an innovative approach that relies on existing legislation. This article will provide an overview of the current regulatory environment and the recommended procedures that will facilitate the shutting down of illegal retail websites, and help to halt the rise in purchases of counterfeit goods on the internet.

Online Piracy Challenges

According to a report by the Department of Intellectual Property (DIP), 40 percent of pirated films, music DVDs, and CDs are offered for sale online. For counterfeiters, there are three key benefits in shifting from traditional brick-and-mortar marketplaces to online retailing:

  1. There is no stall rental fee.
  2. Many of the corrupt activities surrounding the sale of counterfeit goods can be avoided.
  3. Storage of goods is not required, which reduces the chances of being caught in possession of the illegal goods and subsequently arrested.

Since existing IP laws in Thailand do not explicitly sanction the sale of counterfeit goods online, IP owners have, up until now, been unable to take aggressive action against these online sellers. In practice, IP owners have tried to tackle this type of infringement in Thailand by conducting investigations to uncover the source of the fake goods, followed by raid actions at storage facilities, stockrooms, and warehouses.

This investigation-and-raid approach however, is increasingly becoming hampered by the fact that online traders do not typically store their goods on their premises. Instead, traders purchase the counterfeit products from other sellers in the market, after having received purchase orders from their customers.

Existing Legal Framework

In the absence of specific legislation to address these activities, the Thai government has tried to solve this problem by relying on related legislation. When advising IP owners of their enforcement options, one suggestion raised by the DIP is to apply Sections 14 and 20 of the Computer Crimes Act B.E. 2550 (2007).              

Section 14: Whoever commits the following offenses shall be liable to imprisonment for a term not exceeding five years, or a fine of not exceeding THB 100,000, or both:

(1) Entering wholly or partially spurious computer data or false computer data into a computer system, in a manner that is likely to cause injury to other persons or the public. …

Section 20: In the case where the commission of an offense under this Act involves the distribution of computer data that may affect the security of the Kingdom, as prescribed in Book II, Title I or Title I/I of the Penal Code, which may be inconsistent with public order or good morals, the competent official may apply for a motion to the court to order that the distribution of such computer data be blocked.

In 2011, these sections were applied to a case related to food and medical products before Thailand’s Criminal Court. In Red Case Sor. 33/2554, the defendant committed an offense of advertising the sale of food, medicine, and medical equipment by using untrue information that was deceptive to consumers. The court deemed that this act constituted an offense under Section 14(1) of the Computer Crimes Act. The court therefore issued an order to block the distribution activities undertaken by the website, pursuant to Section 20 of the Act.

As this judgment shows, Sections 14 and 20 grant to the court the authority to block the distribution of forged computer data or false computer data, upon the request of an officer, if the court finds that such contents may be inconsistent with public order or good morals. Unfortunately, the content of the Computer Crimes Act is not clear in defining whether offering counterfeit goods for sale on a website can be considered “forged computer data.” Although some government officials claim that this law sets out the right to take action against websites that offer fake goods for sale online, others opine that fake goods offered on a website cannot be deemed “forged computer data” under Section 14.

Proposed New Approach

In seeking a solution to this problem, representatives from the Ministry of Information and Communication Technology (MICT), the DIP, and the private sector met on March 12 and March 20, 2012. During the meeting, the Director-General of the DIP stated that she encouraged IP representatives or IP owners to submit a formal letter to the MICT requesting to shut down these websites under Section 14. When an IP owner proceeds with such a formal letter, this would provide a type of test case to determine whether Section 14 of the Computer Crimes Act can feasibly be used to shut down websites that offer fake goods for sale.

In light of these developments, a new procedure was proposed during the meeting (see graphic below). If all parties implement this procedure, it could enable IP owners to shut down websites selling counterfeit or pirated goods in as little as two weeks. Clearly, this would be a major development for long-suffering IP owners who have battled online piracy for years.

Implementing the Procedure

Although the debate is ongoing, it is evident that the Thai government intends to implement more stringent measures in the near future to inhibit the stream of illicit gains enjoyed by illegal online retailing operations. When an IP owner decides to test the approach proposed by the DIP and a court order is requested, practitioners will eagerly await the outcome for any developments in this area of the law. If the Computer Crimes Act is deemed practicable, it would provide an efficient route for IP owners to shut these websites down, without incurring additional investigation costs.

However, if the court decides that the activities of illegal online retailers—specifically, offering counterfeit goods for sale on a website—do not constitute “forged computer data” under Section 14, it will then be necessary for all stakeholders to push ahead with further amendments to existing IP law.

RELATED INSIGHTS​ 

June 27, 2025
Three American giants are actively protecting their intellectual property rights against generative AI, as two legal battles commence on both sides of the Atlantic. In the UK, Seattle-based media company Getty Images accuses UK-based Stability AI of multiple IP infringements. In the US, The Walt Disney Company and Universal Studios are teaming up against Midjourney, an AI startup, with their main ground being copyright infringement. Both cases are centered around questions legal minds have been posing since the introduction of generative AI: Is the output of generative AI an infringement? And who is ultimately responsible for the output, the platform or the user? Getty Images v. Stability AI Getty initially filed a claim in the High Court in 2023, which resulted in Stability applying for reverse summary judgment on the grounds that Getty had no real prospect of success, arguing that their operations took place outside the UK. However, the High Court judge hearing the case decided that the claims brought by Getty did have a real prospect of succeeding in court. Despite this, Stability saw a small victory when the court ruled that the representative action brought by Getty would not succeed due to the difficulties in identifying who qualified for the class. The proposed class was comprised of 50,000 rightsholders who alleged their rights were also infringed. Stability was successful in arguing that identifying these individuals would be challenging due to the unclear definition of the class. This current trial is centered around four main grounds: Copyright infringement. Getty accuses Stability of using content that Getty owns or has an exclusive license for when training their model, Stable Diffusion, resulting in the generated output containing substantial parts of that content. Getty is also alleging secondary copyright infringement, arguing that Stability is importing an article into the UK
June 26, 2025
Vietnam’s new Personal Data Protection Law (PDPL) was passed by the National Assembly on June 26, 2025, and will enter into force on January 1, 2026. The PDPL introduces several new concepts, exemptions, and obligations in comparison with the current Decree No. 13/2023/ND-CP on personal data protection (PDPD), while other contents remain essentially the same. The relationship between the PDPD and the PDPL has not been clearly addressed; however, it is expected that the government will issue a new decree providing necessary guidance on certain requirements under the PDPL, and the PDPD will remain in effect until it is replaced by this new decree. Some key points of the new PDPL include the following: Personal data will be further defined by lists of basic personal data and sensitive personal data to be issued by the government. The consent-centric approach of the PDPD remains in place, along with additional exemptions for certain data processing activities. The requirements for the data processing impact assessment (DPIA) and transfer impact assessment (TIA) remain unchanged. However, there are new exemptions for the TIA, including for the processing and storing in the cloud of employee data, and when the data subject is the person sending its own data outside of Vietnam. Consent obtained under the PDPD remains valid under the PDPL. DPIAs and TIAs submitted under the PDPD are valid under the PDPL but may need to be updated to be in line with the requirements of the PDPL. Administrative fines depend on the type of violation. The fine for sale and purchase of personal data will be 10 times the revenue from the sale or VND 3 billion (about USD 115,000), whichever is higher. The fine for cross-border transfer violations is 5% of the violator’s revenue of the preceding year or VND 3 billion,
June 25, 2025
Generative artificial intelligence (GenAI) is no longer a distant innovation confined to science fiction and research labs; it has become an integral part of daily business operations worldwide. Employees across industries are adopting GenAI tools at a remarkable pace—including in Southeast Asia, where a tech-savvy workforce and widespread internet and mobile access have driven early adoption. The reality facing organizations today is clear: employees are integrating GenAI into their daily work, often without official approval or clear policies. This phenomenon, often called “Bring Your Own AI,” comes out of a disconnect between organizational governance and employee behavior and reveals the urgent need for proactive AI policies and oversight. For business leaders and legal teams, GenAI is both an opportunity and a challenge. On one hand, these tools can deliver real business value and boost efficiency. On the other, the unsanctioned and unmonitored use of GenAI introduces substantial legal risks, such as data privacy violations, confidentiality breaches, and intellectual property issues. The widespread adoption of GenAI tools by employees, regardless of official organizational stance or guidelines, demonstrates that prohibition is neither practical nor effective. A more strategic approach involves establishing comprehensive governance policies that encourage responsible AI use while managing the risks. Organizations that take the lead in developing GenAI governance policies are better positioned to benefit from its transformative potential. The question isn’t whether GenAI will change how we work, but how quickly organizations can put the right safeguards in place to manage this change successfully. Risks of GenAI Use The use of GenAI in business operations, whether sanctioned or not, exposes organizations to a unique set of risks. The following are particularly relevant: Data security and confidentiality: General GenAI tools in the market may transmit data to external servers, retain conversation histories, and use inputs for model training.
June 19, 2025
The Bank of Thailand (BOT) has released draft guidelines establishing principles for managing artificial intelligence (AI) risks in the financial sector. The draft guidelines provide a structured framework for the responsible adoption of AI technologies. Financial service providers will be able to use the guidelines as a reference to appropriately manage their risks in a manner that aligns with internationally recognized best practices. The BOT is accepting public comments on the draft guidelines until June 30, 2025. Scope and Application The draft guidelines apply to all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. These guidelines supplement existing BOT risk management guidelines covering IT risk management, third-party risk management, data governance, and market conduct. The guidelines define AI systems as systems that mimic human intelligence, including machine learning, deep learning, generative AI (such as large language models), and agentic AI. This definition specifically excludes rule-based automation systems like robotic process automation and condition matching. Key Risk Management Principles The guidelines lay out two main principles in managing AI risk. Governance: Financial service providers should define and establish clear roles and responsibilities for their personnel and AI system supervision structures to uphold FEAT (fairness, ethics, accountability, and transparency) principles as follows: Stakeholder roles and responsibilities. Financial service providers should define roles and responsibilities for boards and executives on AI risk oversight. Responsibilities include establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization. AI system usage policy. The AI system usage policy should be aligned with organizational objectives, regulatory requirements, and FEAT principles. These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles. Risk management