What is PDPA or Personal Data Protection Act?

Who likes to take pictures in public? or live in a crowded place, be careful because of the law PDPA (Personal Data Protection Act) or the Personal Data Protection Act. It is forbidden to take photos and video clips with faces. or publish other people’s personal information without permission will have a civil penalty Criminal and Administrative Fines up to 5 million baht

What is PDPA or Personal Data Protection Act?

PDPA (Personal Data Protection Act) is a law that protects and gives rights to our own personal data subjects according to the Personal Data Protection Act. It applies not only to individuals but also to companies. Service providers must also maintain their data. And the disclosure of other people’s personal information must be authorized by the owner of the information only. which the owner of the information has the right in various personal data as follows:

  • right to withdraw consent In the case of giving consent
  • The right to receive detailed notice

  • Right to request access and obtain a copy of personal data

  • Right to object to the collection, use or disclosure of personal information
  • Right to request removal or destruction or make personal information non-personally identifiable
  • Right to request to suspend the use of personal information
  • Right to request correction of personal data

What constitutes a violation of personal data rights?

from the definition Personal data means Information about an individual by which an individual is identified. whether directly or indirectly which can be divided as follows

  • First name Last name Nickname
  • Identification Number, Passport Number, Social Security Card Number, Driver’s License Number, Tax Identification Number, Bank Account Number, Credit Card Number (keeping a photocopy of an ID card or a copy of any other card that holds personal information)
  • Address Email Phone
  • Device or tool information such as IP Address, MAC Address, Cookie ID
  • Bio-metric data such as face images, fingerprints, X-ray films iris scan data audio identity information genetic information
  • Personal property identification information such as car registration, land title deeds
  • Information that can be linked to the above information, such as date of birth, place of birth, ethnicity, nationality, weight, height, location information. medical information educational information financial information employment information
  • The reference number information stored in the microfilm.
  • Information about the employee’s performance evaluation or opinion of the employer on the employee’s performance.
  • Various log data used to track individual activities such as Log Files
  • Information used to search for other personal information on the Internet.

The subject of photography can be divided into 4 topics as follows:

  1. Taking pictures for personal gain such as posting on social media which is not intended to be photographed for commercial profit Classified in the exception of this Act, but if such images cause trouble for others or society, including the intention, gestures, descriptive text of the user’s image or even comments that are inappropriate may be at risk of being sued for infringement
  2. photography to make money For example, hiring for a photo shoot for a wedding, graduation ceremony, or making content on YouTube, which is different from the first item. because in the event of receiving a return Operators should follow the necessary extent of the contract/consent. If someone who is a photographer wants to upload the work that they took. Then, incidentally, it was not in the specified contract with the person who was taken. The person who is the photographer must obtain permission from the owner of the image before using it only. Making content for Youtube video is not considered under the enforcement of the PDPA if the reasons are as stated above.
  3. Mass media events or photography exhibitions Whether it’s news photos or art works, they are not subject to the Personal Data Protection Act. Persons entrusted with these activities must comply with professional ethics.
  4. photography of government officials trying to find evidence in the investigation Such cases can be made in accordance with the requirements and scope of the law.

If there is a violation, what will be the penalties?

civil liability

  • The injured person can claim compensation. and the court ordered an increase of no more than 2 times the compensation

administrative penalty

  • Not asking for consent is correct. not informing the details to the owner of the information Preventing the owner from requesting access to information according to rights, etc., fined not more than 1 million baht
  • Collecting, using or disclosing personal information without legal basis, a fine of not more than 3 million baht
  • Collect, use, disclose or transfer sensitive personal information. Unlawful fine not exceeding 5 million baht

criminal penalties

  • cause damage to others dishonor Imprisonment for not more than 6 months or a fine of not more than 5 hundred thousand baht.
  • To seek unlawful benefits for oneself or others, imprisonment for not more than 1 year or a fine of not more than 1 million baht.
  • Knowing the personal information of others due to the performance of duties under this Act must not be distributed to others. (Unless there is a legal authority) Imprisonment for not more than 6 months or a fine of not more than 5 hundred thousand baht

In the event that the offender be a legal entity If the managing director or the person in charge to order or act or refrain from ordering or not acting until causing the juristic person to commit an offense must be punished in that criminal case as well

In conclusion, if it is someone else’s information, whether it is their name, address, telephone number, picture, video, or other information that the company has kept, they should not be published or forwarded to others without their permission. In the event that the service provider makes our various information come out, such as identity card information. or phone number We have the right to sue the company after the PDPA law comes into force. We also have the right to request that the service provider delete the information we have previously provided.

Source : Office of the Personal Data Protection Commission, PDPC Thailand