As many are already aware, following the change of government in Myanmar on February 1, 2021, a draft Cyber Security Law was proposed which attracted widespread criticism. However, less attention has been paid to significant amendments to two existing laws, some of which have a similar effect to parts of the draft Cyber Security Law. In other words, while the draft Cyber Security Law has not progressed further and is under public scrutiny, significant elements of it have found their way into law in Myanmar by other routes. Because these amendments are already law, it is very important that individuals and businesses in Myanmar understand their implications. Amendments to the Law Protecting the Privacy and Security of Citizens The Law Protecting the Privacy and Security of Citizens (2017), or the “Privacy Law,” was amended on February 13, 2021, less than two weeks after the military government came into power. These amendments chiefly address the power of the government to conduct searches, seizures, and arrests; to extend detention without judicial oversight; and to carry out broad surveillance and investigation activities that could intrude on individual privacy. The amendments accomplish this by suspending various sections of the Privacy Law for as long as the State Administration Council (the military body now governing Myanmar) is in power. The suspended sections include the following: Section 5: Search, seizure, and arrest without civilian observation The relevant part of Section 5 of the Privacy Law states, “The responsible authorities shall … when acting in accordance with existing law, not enter into a person’s residence or a room used as a residence, or a building, compound or building in a compound, for the purpose of search, seizure, or arrest, unless accompanied by minimum of two witnesses who should comprise Ward or Village Tract Administrators…”. The suspension of this section means that government

Following the recent imposition of sanctions on Myanmar individuals and companies by the US, the UK and Canada have now imposed new sanctions. As with the US sanctions, these new measures impact UK and Canadian citizens and companies, and non-UK and non-Canadian companies and citizens with interests in those jurisdictions. The EU has indicated that it is planning to issue similar sanctions in the near future. New UK Sanctions In addition to the 16 individuals already sanctioned by the UK government, on February 18, 2021, the UK government announced that three individuals have been sanctioned for serious human rights violations and are now subject to asset freezes and travel bans. The full list of Myanmar individuals and companies sanctioned by the UK is available on the website of the Office of Financial Sanctions Implementation. Breaches of UK financial sanctions are criminal offences punishable in the UK by up to 7 years imprisonment and heavy fines. New Canadian Sanctions Also on February 18, timed to coincide with the UK sanctions, new Canadian sanctions were imposed on nine individuals. As with the UK, Canada already had a number of individuals in the Myanmar military on its sanctions list, and the new additions bring the total number of individuals sanctioned by Canada to 54. All assets of these individuals in Canada are now frozen, and they are banned from travelling to Canada. Canadian businesses or entities may not do business with any of the 54 individuals. Full details of the impact of the sanctions are available on the Government of Canada’s website, as is a database of the Myanmar individuals and companies subject to them. Breach of Canadian sanctions carries with it up to 5 years’ imprisonment in Canada and/or a large fine. Other Countries The EU is reportedly drawing up sanctions to be issued in the near future, and other countries such

Insurance specialists from Tilleke & Gibbins’ Bangkok office have provided an update to the Thailand chapter of Thomson Reuters’ Practical Law guide to insurance and reinsurance. The guide is a Q&A-style overview of insurance and reinsurance law in 41 jurisdictions worldwide. The Thailand contribution opens with a detailed overview of the insurance and reinsurance market in Thailand, including information on market trends, the available corporate structures, and relevant regulations. The Q&A is then separated into three main sections: Operating restrictions: licensing, ownership restrictions, ongoing requirements (compliance) and penalties for noncompliance, selling restrictions, and monitoring and disclosure requirements. Insurance and reinsurance policies: establishing an insurance claim, third party insurance claims, time limits, enforcement, remedies, and punitive damage claims. Other business concerns for insurance and reinsurance providers: insolvency, taxation, insurance and reinsurance dispute resolution, and legal reform. Practical Law produces a numbers of guides to key legal practice areas around the world for business lawyers. Tilleke & Gibbins contributes many overviews to these guides for all of the firm’s jurisdictions in Southeast Asia. To read the full Thailand insurance and reinsurance chapter, please visit the Practical Law website.

As you will no doubt know, on February 1, 2021, the Myanmar military declared a state of emergency in Myanmar for a period of one year. State Counsellor Daw Aung Sang Su Kyi was detained, as were the president and various significant political and civil leaders. Min Aung Hlaing, commander-in-chief of the Tatmadaw (Myanmar armed forces) has installed himself as chairman of the State Administration Council, the current administration. New sanctions The reaction of the Biden administration has been swift. On February 10, 2021, President Biden issued Executive Order 14014, which provides bases to impose sanctions on individuals and companies deemed by the US to, among other things: operate in the defense sector of Myanmar; be responsible for policies that undermine democratic processes in Myanmar; have taken actions to undermine democratic processes or institutions, or prohibit, limit, or penalize the exercise of free speech, in Myanmar; or be a spouse or child of the foregoing. On the next day, February 11, the US Office of Foreign Assets Control (OFAC), imposed sanctions under the new executive order on ten individuals—including General Min Aung Hlaing—and three companies, including Cancri Gems & Jewelry Co, Myanmar Imperial Jade Co, and Myanmar Ruby Enterprise.  All such individuals and companies have now been designated on the US list of specially designated nationals (SDNs). Effect of sanctions As a result of such sanctions, the property of these individuals or companies that is located in the US or is under the possession or control of US companies and citizens is frozen, and US companies and citizens are generally prohibited from dealing deal with any such property.  Reportedly, roughly USD 1 billion of funds belonging to the individuals and companies blocked on February 11 are located in the US and thus now frozen. The SDN list As many will know, various Myanmar nationals were already blocked under US sanctions

The Bank of Thailand (BOT) has amended foreign exchange (FX) controls, as part of its roadmap toward a “new Thai FX ecosystem,” to further relax limitations and restrictions on outbound investments remitted by investors in Thailand. This latest move follows a prior relaxation of foreign trading and exchange regulations in November 2019. The new developments primarily relate to the thresholds for outbound investment, types of foreign investment products that investors may participate in, and foreign currency deposit accounts. These are detailed below.   Outbound Investment Thresholds The new measures ease the individual and group limits for outbound investment as shown in the table below.   Types of Investment Products The previous FX measures allowed investors to process FX transactions for investment in various types of inbound and outbound products; however, inbound products were limited to only debt instruments (e.g., bonds and structured notes) issued in foreign currency. The new FX measures expand the scope of products to include all types of investment products that reference foreign variables, such as foreign stocks, exchange traded funds, commodities, gold futures, and foreign indexes. FX derivatives and other investment products (e.g., endowment life insurance, unit-linked life policies, and universal life insurance) are still open to outbound investment.   Foreign Currency Deposit (FCD) Accounts The BOT also amended the requirements pertaining to foreign currency deposit (FCD) accounts. Previously, an FCD account for investment (i.e., portfolio foreign currency deposit) had to be separated from investors’ other FCD accounts. Separation of FCD accounts is no longer required, and a single FCD account can now be used for any transaction permitted by the BOT.

On January 29, 2021, Thailand’s Revenue Department published the Notification of the Director-General of the Revenue Department Re: Income Tax (No. 400), which prescribes the criteria, methods, and conditions for Revenue Department officials on how to assess income and adjust expenses for transactions between related parties (as defined in Section 71 bis of the Revenue Code) that engage in intercompany transactions where conditions between the two parties in their commercial or financial relations differ from those that would be made between independent parties (i.e., where the transaction is not an “arms length” transaction). Those who are familiar with international transfer pricing standard practices will note that the measures under the notification generally follow the concept of chapters II, III, VI and VII of the OECD Transfer Pricing Guidelines for Multinational Enterprises and Tax Administrations. The key elements of the notification are summarized below. Accepted Transfer Pricing Methods The notification recognizes the following as accepted transfer pricing methods: Comparable Uncontrolled Price Method Resale Price Method Cost Plus Method Transactional Net Margin Method Transactional Profit Split Method The notification also requires that the arm’s length result of an intercompany transaction (i.e. the controlled transaction) must be determined using the most appropriate transfer pricing method. If none of the above transfer pricing methods is appropriate for the tested controlled transaction, the company may apply an alternate pricing method to the transaction by notifying the Director General of Revenue in writing, within the relevant accounting period, and describing the reason for doing so. Selection of the Most Appropriate Transfer Pricing Method  There is no formal order of preference for the use of the five accepted pricing methods. However, the notification requires the selection process to take account of the following factors: The respective strengths and weakness of the recognized methods; The appropriateness of the method considered in view of the nature of the controlled transaction, determined

From September 1, 2021, foreign e-Service providers and e-Platform operators must register for and pay VAT in Thailand.

After approximately a decade drafting general personal data protection laws and formulating a regime to protect personal data and privacy rights, Thailand finally issued the country’s first unified personal data protection legislation in 2019. The public was surprised when the draft Personal Data Protection Act (PDPA) was published for the final round of hearings. The draft PDPA largely adopted the preeminent personal data protection standards as expressed in the European Union’s General Data Protection Regulation (GDPR). The government expressed its objective to enhance personal data protection standards in Thailand to meet international standards, which would permit cross border transfers of personal data to Thailand, without any material limitations. The PDPA, which was finally published in the Government Gazette in May 2019, also established a new independent regulator, the Personal Data Protection Commission (PDPC), tasked with enforcing the PDPA. All members of the commission must possess the qualifications required by the PDPA. The PDPA was enacted with a grace period of one year for the requirements relating to the processing of personal data—which would provide businesses with sufficient time to adjust their practices to ensure compliance with the new requirements. It is a significant undertaking for businesses to adjust from having no general law on data protection to being required to meet high international data protection standards comparable to those in the GDPR. GPDR concepts that were incorporated into the PDPA include (1) purpose limitation, (2) transparency, (3) lawfulness and fairness, and (4) data minimization. When collecting personal data, data controllers are required to establish a lawful basis to allow for such collection and processing of personal data. The lawful bases for general personal data are also similar to those under the GDPR, with concepts such as contractual necessity, legal obligation, legitimate interest, vital interest, and consent. Special types of personal data, such as