Thailand's Personal Data Protection Act B.E. 2562 (2019), known as the PDPA, has been in force since 1 June 2022. It gives people the right to see, correct and ask for deletion of the personal data that companies and apps hold about them. The European Union's data law, the GDPR, gives broadly similar rights.
Many people call data the "new land" of the AI era, because organisations with lots of data have an edge in analysis, decisions and new services. The comparison is only a metaphor. Land comes with a title deed that shows who owns it. Personal data sits in the systems of many service providers, and its owner may not know where. This article looks at what the law gives you in place of a title deed.
What the law says about who controls your data
Personal data does not automatically belong to the organisation that collects it. Both European and Thai law require organisations that collect and use data to tell users what they collect and why. Data owners also have rights to control that data. For users, the practical questions are which rights they have and how to use them.
Rights under EU law (GDPR)
The General Data Protection Regulation (GDPR) lets you ask an organisation whether it is processing your data. If it is, you can ask for access and a copy. You can also ask why the data is held, what type it is, who it is shared with and how long it is kept (Article 15).
- Correction (Article 16): if the data is wrong, you can ask for it to be corrected without undue delay. If it is incomplete, you can ask for it to be completed, including by adding a supplementary statement.
- Erasure (Article 17): often called the right to be forgotten. It applies in several cases, such as when the data is no longer needed for its original purpose, when you withdraw consent and there is no other legal basis, or when the data was processed unlawfully. There are exceptions, including processing needed for freedom of expression, a legal obligation or legal claims.
- Restriction (Article 18): in some situations you can ask the organisation to limit processing, for example while it checks whether the data is accurate.
- Portability (Article 20): you can ask for the data you provided in a machine-readable electronic format, so you can pass it to another provider. This applies to automated processing based on consent or a contract.
- Objection (Article 21): you can object to certain processing. You can object to direct marketing at any time, and the organisation cannot keep using your data for that purpose.
Article 22 is the closest to AI. It gives you the right not to be subject to a decision based solely on automated processing, including profiling, if the decision has legal effects or similarly significant effects on you. Exceptions apply, such as when the decision is necessary for a contract or you gave explicit consent. Even then, the organisation must put safeguards in place, such as human review, a chance for you to give your view and a way to challenge the decision.
Rights under the Thai PDPA
The PDPA gives data owners these rights:
- withdraw consent
- be informed about how data is collected and used
- access and obtain a copy of the data
- ask for the data to be transferred
- object to collection, use or disclosure
- ask for deletion or for the data to be made non-identifiable
- ask for use to be suspended
- ask for correction
If you believe the law has been broken, you can file a complaint with the expert committee set up under the law.
The law also sets penalties for those who hold data. Processing data without consent can lead to administrative fines, and violators must compensate data owners for damage. Processing sensitive data without explicit consent, in a way likely to cause harm, can carry criminal penalties.
How to use your rights with a service provider
You do not need to wait for a problem. Start by reading the privacy policy of the apps and services you use. Then contact the provider through the channel it lists when you want to exercise a right. Under Thai law, you can:
- ask to see and get a copy of the data the provider holds
- ask for incorrect data to be corrected
- withdraw consent you gave earlier
- ask for data to be deleted or made non-identifiable
- complain to the expert committee if you think the law has been broken
Whether your data is really yours depends on whether you know your rights and use them. The law provides the tools. How well they work depends on how often users and regulators use them.
Source: GDPR Articles 15, 16, 17, 18, 20, 21 and 22 as published on gdpr-info.eu; reports by Thansettakij and Infoquest on Thailand's PDPA.
This article is adapted from ViewNews' Thai-language report.
