Further Update on the Sub-legislation regarding Filing a Complaint with the Relevant Authority under Thailand’s Personal Data Protection Act

In our previous newsletter for August 2022, we informed you that there were five Notifications issued by the Personal Data Protection Committee (the “PDPC”) under the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”). In this newsletter, we would like to provide a further update on a new sub-legislation issued by the PDPC - “Rule of the Personal Data Protection Committee on the filing, rejection, dismissal, consideration and timeframe for consideration of a complaint B.E. 2565 (2022)” (the “Rule”) - which was published in the Government Gazette on 11 July 2022 and has already been enforced.

The essence of the Rule elaborates on the provision of the PDPA, that in the event the Data Controller or the Data Processor, including the employees or service providers of the Data Controller or Data Processor, violates or fails to comply with the PDPA or notifications issued under the PDPA; the data subject has the right to lodge a complaint with the Expert Committee by filing a complaint directly to the Office of the PDPC (the “Office”) in person, by mail, through electronic channels or any other channel as announced by the Office. Furthermore, the Rule sets out the standard particulars and requirements for a complaint to be filed with the Office. For instance, the complaint must be clear and understandable, as well as must include the name, address and contact information of the complainant or his/her attorney-in-fact, together with their ID card, passport or other identification document issued by the relevant governmental authority; details of facts as to how such violation or failure to comply with the PDPA has occurred; details of the damage or impact on the complainant; complaint related documentations such as documentary evidence, physical evidence or statements of the witness; the request that the complainant desires the Data Controller or Data Processor to proceed with; and certification that the complained statements are true. Moreover, such complaint must be prepared in writing or in a reliable electronic format as announced by the Office.

In addition, the Rule stipulates the provisions, which are provided in order to set forth duties and responsibilities of the Competent Official (as appointed by the relevant Minister to perform acts under the PDPA) and Expert Committee in handling the complaints filed by the data subject. The provisions contain details about the rejection, dismissal, consideration and timeframe for consideration of the complaint, particularly details regarding actions to be taken in connection with the complaint by the Competent Official  and by the Expert Committee. In short, when the Competent Official receives the complaint from the complainant, he/she must determine whether it has valid and complete characteristics, particulars and documentation as explained above within 15 days and, upon finding they are all in order, issue a complaint receipt to the complainant. Before referring the matter to the Expert Committee for consideration, the Competent Official must preliminarily review and analyse details of the complaint in essence as to whether or not: the act violates or fails to comply with the laws on personal data protection or notifications issued thereunder; the complaint is well-grounded and reasonable; and the complaint is within the duties and powers of the Expert Committee within 15 days from the issuance date of the complaint receipt, unless there is an event of force majeure or any other necessity. Upon receiving the complaint from the Competent Official, the Expert Committee shall finish its consideration of the complaint within 90 days from the first meeting date, unless there is an event of force majeure or any other necessity; the period of which may be approved to be extended by the PDPC on no more than two occasions of not more than 60 days each.

Currently, there is no official English translation of the Rule. However, since the Rule should help clarify certain particulars and processes of filing a complaint by a data subject as well as actions to be taken in connection with the complaint by the Competent Official and by the Expert Committee, the content of which the Data Controller and/or Data Processor under the PDPA may wish to be aware of; therefore, our lawyer has translated the Rule from Thai into English and we can provide you with the English translation of the Rule for your reference, upon request.

As of today, it can be anticipated that the PDPC will continue to issue more sub-legislations under the PDPA and that there should be more official guidance on other issues from the relevant authority in such regard.

This is intended merely to provide a regulatory overview and not to be comprehensive, nor to provide legal advice. Should you have any questions on this or on other areas of law, please do not hesitate to contact:

Chanakarn Boonyasith
Partner

Pimsiri Harnpanicharoen
Attorney-at-Law

Authors