Legal Issues Relating to the Personal Data Protection Act B.E.2562 : A Case Study on the Duty of Data Controllers According to Section 39

Abstract

The main objective of this Thesis is to study the provisions, concepts, and evolution of the Personal Data Protection Act of B.E. 2562. It also purposes to delve into the spirits of the Act, and to dig up possible legal issues which may arise from the actual application of the Act, as well as to find ways and means to improve the Act. This Thesis is a legal qualitative analysis of the Act. It will employ data from various sources, including text books, articles, journals, theses, information from the Internet, both in Thai and English.

The Thesis finds that the duty of enterprises to record personal data of clients and employees are very onerous since recording processes are very technical, complicated, and prone to legal liability. Therefore, the enterprises, large and small, have to employ both technical and legal specialists to assist them in the recording processes. Although the Act has lenient provisions applicable to small enterprises, some of the provisions are problematic since they are ambiguous, such as the small enterprises “may be exempted” from the duty aforesaid, and they have the duty to record only the “data which are “likely or prone” to affect personal rights and liberty of the owners of the data”. However, the problems may occur as to what the phrases “may be exempted” and “likely or prone” mean. These are the texts of the Act which are ambiguous, and thus they allow subjective appraisal and interpretation by all persons involved. The said texts of the Act also create uncertainty and apprehension on the part of all the enterprises. The Author of this Thesis, therefore, is of the opinion that some provisions of the Acts, including in particular the texts mentioned above, be amended to make them clearer, and thus amendable to their objective application.