New measures for protection and suppression of technology crimes

The Royal Decree on Measures for Protection and Suppression of Technology Crimes B.E. 2566 (2023) (“Cybercrime Decree”) was published in the Government Gazette on 16 March 2023, and took effect as of the following day. The Cybercrime Decree was legislated in response to problems arising from false online sales, call centre scams and money laundering. Thailand has experienced a dramatic increase in the number of technology crimes recently. According to various media sources, the Royal Thai Police reported that 163,091 online crime-related complaints were lodged last year, which caused an estimated Baht 27.3 billion in damages. Meanwhile, over 200 mobile apps were identified as apps created to steal mobile users' information or control their mobile phones remotely.

We have summarised the Cybercrime Decree for ease of reference, as follows: 

•    A committee has been set up to oversee the guidelines for protection and suppression of technology crimes, as well as to provide advice to competent authorities regarding compliance with the Cybercrime Decree;
•    Duties are imposed on financial institutions, i.e. commercial banks and governmental financial institutions, and business operators governed under the law on payment systems (Payment Systems Act B.E. 2560 (2017)), e.g. payment service providers for goods or services; to disclose and exchange information on suspicious transactions of their customers, and provided services through the designated system/procedure;
•    The Royal Thai Police, Department of Special Investigation and/or Anti-Money Laundering Office are empowered to order telephone network operators, other telecommunications service providers or other service providers involved with the offence to, in the case of necessity, disclose users’ registration information or computer data traffic to them;   
•    Financial institutions and business operators are empowered to freeze the bank account or electronic bank account suspected to be used for a fraudulent transaction for seven days from the date upon which such transaction is found or a complaint is received from the account holder. The account holder shall be informed of such account freeze and file a compliant about the said offences with the inquiry official within 72 hours.
•    excludes disclosure, exchange, access, collection, compilation and use of personal information under the Royal Decree from the Personal Data Law.
•    Penalties of imprisonment up to three years and a fine of not over Baht 300,000 are imposed upon any person who: (i) opens or allows others to open a bank account or electronic bank account without the aim of their own use or use in relation to their business; or (ii) allows anyone to use their mobile phone or mobile phone number, knowing that or having ought to have known that it will be used for technology crimes or another criminal offence. Breach of other offences under the Cybercrime Decree, such as provision of bank account, electronic bank account or telephone number, will be punished by severe penalties of imprisonment up to five years and a fine up to Baht 500,000, or both. 

For further details of the Cybercrime Decree or other issues on cybercrime in Thailand, please do  not hesitate to contact p.bunyamissara@nishimura.com.

Authors