Herbert Smith Freehills (Thailand) Ltd

Thai privacy regulator announces enforcement of PDPA breaches

28 November 2023 | Bangkok

On 24 November 2023, the Thai privacy regulator, Personal Data Protection Committee (the “PDPC”) issued a press release for the first time that they are taking enforcement action under the Thai Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”) for non-compliance with the PDPA by a Thai insurance company in relation to its handling of personal data of children and their parents in marketing activities.

The PDPC is still investigating the alleged non-compliance and may impose administrative sanctions against the company.

The investigation was prompted by recent media coverage revealing incidents where insurance agents distributed questionnaires to students and their parents across Thailand to collect their personal data in exchange for gifts. Information requested in the questionnaires includes name, age, address, phone number, monthly income and financial planning details in relation to children.  No privacy notice detailing the purposes of data collection or how their data will be used and processed was provided to parents and children, and no consent was obtained from them. Subsequently, several parents received unsolicited calls from insurance agents offering insurance products for them and their children.

Potential violations under the PDPA include processing of personal data without a lawful basis and failure to inform the data subject of the purposes for processing their personal data and other required privacy information. Such breaches can lead to substantial administrative fines, potentially reaching up to Baht 3 million (approx. USD 85,000) or, if it relates to special categories of data (ie sensitive data such as health data), Baht 5 million (approx. USD 140,000).

This incident is under public scrutiny, indicating heightened awareness and sensitivity on data protection issues in Thailand. From a regulatory standpoint, this incident demonstrates more active enforcement of Thai PDPA by the PDPC.