Individuals’ Rights
Concerning the right to be informed, Thailand PDPA and GDPR have three specific differences in their provisions;
Thailand PDPA does not spell out the right of consumers to be informed about the existence of automated decision-making and profiling. This aspect differs from the GDPR, which requires consumers to be made aware of automated decision-making, inclusive of profiling at the point of data collection.
Thailand PDPA does not make it clear whether consumers can be informed about their rights orally. On the other hand, GDPR is explicit about consumers being informed orally alongside written and electronic formats.
Concerning legitimate interest, Thailand PDPA does not provide specific instances when it is applicable whereas, GDPR outlines circumstances that can be regarded as ‘legitimate interest.’
Regarding the right to access;
Thailand PDPA does not state what needs to provided in response to an access request. Meanwhile, the GDPR explicitly states that data controllers must provide inform consumers about the purposes of processing their data, the categories of personal information involved, the third parties to whom the data was disclosed.
Under the right to erasure, Thailand PDPA does not provide a specific timeline within which the data controller needs to address a request, although it allows consumers to notify enforcement authorities about a data controller’s failure to respond to an erasure request. Additionally, under the PDPA, a data controller is not required to institute strategies to identify a data subject that requests the deletion of their data.
In contrast, the GDPR states explicitly that consumer requests in line with this privilege must be addressed without ‘undue delay and in any event within one month from the receipt of the request.’ Furthermore, data controllers are obliged to have measures in place to verify the identity of the data subject making the request.
Both the GDPR and Thailand PDPA guarantee the right of users to object to the processing of their information as well as the ability to withdraw their consent to the processing at any time. However, Thailand PDPA does not state explicitly define the required duration for a data controller to address a request to limit the processing of personal data. On the other hand, the GDPR makes it clear that data controllers need to address requests for restricting the processing of personal data within 30 days. However, this duration can only be extended for a maximum of two months depending on the complexity and volume of requests.
In terms of individual rights, the last difference between Thailand PDPA and the GDPR is connected to the right to data portability. On the one hand, Thailand’s PDPA imposes an obligation on data controllers to keep the justification of objection to a data portability request for the verification of consumers and the competent authority. In contrast, the GDPR, does not explicitly impose this requirement.
