The Ministry of the Digital Economy and Society (DES) is convinced that there will be no further delay in the full application of the law on the protection of personal data (PDPA), which should take place on the 1st June 2022, while the Personal Data Protection Committee is expected to be finalized this month.
The Deputy Permanent Secretary of DES and Secretary General of the Office of the Personal Data Protection Committee said DES sees no major reasons to postpone full implementation of the PDPA after two years of delay due to the pandemic, the except for a few technical legal issues, although the risk of this happening is minimal.
DES is aware that the PDPA may place some burden on related parties in terms of compliance, but the ministry is trying to ensure that the impact will be minimal with better protection of personal data. The law will create transparency and accountability for the processing of personal data.
The DES ministry sees data as a key part of the country’s development strategy while companies capitalize on data to generate revenue. DES will ensure that PDPA does not become a barrier for businesses.
In the last two years of the postponement of the PDPA, the DES ministry drafted 29 regulations aligned with the PDPA, of which 10 were dealt with as a priority. By the end of the month, the personal data protection committee should be in place, he said.
The list of committee members is expected to be released later this month after cabinet approval. The committee will be responsible for reviewing all related regulations related to the PDPA.
The 10 regulations include the consent format for the use of personal data, the data use process, and data protection measures. There will also be personal data protection guidelines for personal data controllers and personal data processors in seven sectors, covering healthcare, retail and e-commerce, education, logistics, travel, property and asset management as well as public agencies and administration.
A public hearing bringing together up to 4000 stakeholders on the issue was held. In terms of penalties, there could be a reprieve in certain groups, such as those with personal data of less than 100 people, but this needs to be considered by the new committee.
Once the committee is established, there must be a clear practice on how people can file a complaint with the PDPA office when their data is misused. Organizations that process personal data are required to report data breaches within 72 hours and notify the owners of the data.
Organizations responsible for the data breach could face a fine from the PDPA office and civil action from those affected. The PDPA will require minimum security measures to protect personal data.
Under the PDPA, data protection officers must be appointed by organizations as authoritative contact persons and they are required to contact authorities within a specified time frame when the incident occurs. Consumers will have more confidence in using the services while small businesses with small personal data records will get a stay, he added.
In November 2021, the National Committee for the Digital Economy and Society approved plans to develop a platform that supports compliance with the Personal Data Protection Act. The platform will also make government services available online for Thai digital start-ups.
The Thai prime minister said the new government platform will help ease the overall financial burden on the public sector. It will also secure online transactions and promote the development of a digital economy.
“The implementation will be divided into two phases. The first phase will last 18 months and will focus on the development and promotion of the platform. Training will also be provided to 2,000 staff from 200 government agencies. The second phase will promote and evaluate the use of the platform in the private sector, ”said the Prime Minister.
The committee also agreed to instruct the Digital Economy Promotion Agency to set up a digital service account registration system for start-ups and digital suppliers. Digital service accounts will be linked to state mechanisms, such as tax policies, to expand the services provided to Thai digital entrepreneurs.