Section 19 - The Data Controller shall not collect, use, or disclose Personal Data, unless the data subject has given consent prior toSection 20 - In the event that the data subject is a minor who is not sui juris by marriage or has noSection 21 - The Data Controller shall collect, use, or disclose Personal Data according to the purpose notified to the data subject priorSection 22 - The collection of Personal Data shall be limited to the extent necessary in relation to the lawful purpose of theSection 23 - In collecting the Personal Data, the Data Controller shall inform the data subject, prior to or at the time ofSection 24 - The Data Controller shall not collect Personal Data without the consent of the data subject, unless:Section 25 - The Data Controller shall not collect Personal Data from any other source, apart from the data subject directly, except where:Section 26 - Any collection of Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminalSection 27 - The Data Controller shall not use or disclose Personal Data without the consent of the data subject, unless it isSection 28 - In the event that the Data Controller sends or transfers the Personal Data to a foreign country, the destination countrySection 29 - In the event that the Data Controller or the Data Processor who is in the Kingdom of Thailand has put
Section 43 - There shall be an Office of the Personal Data Protection Committee, whose objectives are to protect Personal Data, encourage andSection 44 - In addition to the Office’s duty to carry out its operations to achieve the objectives as set out in sectionSection 45 - In carrying out the Office’s operation, apart from those stipulated under section 44, the Office shall also have the powerSection 46 - The fund and properties used in the Office’s business operations shall consist of the following:Section 47 - The immovable properties that the Office acquires by the purchase or exchange using the Office’s revenue in section 46 (4)Section 48 - There shall be a commission supervising the Office of Personal Data Protection Committee consisting of a Chairperson, who is selectedSection 49 - There shall be a selection committee of eight members, consisting of the persons appointed by the Committee, having the dutySection 50 - In selecting the Chairperson and the honorary director in section 48, the selection committee shall select the persons who haveSection 51 - The Chairperson and the honorary director in section 48 shall hold office for a term of four years.Section 52 - n the case where the Chairperson or the honorary director in section 48 vacates office before the expiration of theSection 53 - At a meeting of the commission supervising the Office of Personal Data Protection Committee, the presence of not less thanSection 54 - The Commission Supervising the Office of Personal Data Protection Committee shall have the following powers and duties:Section 55 - The commission supervising the Office of Personal Data Protection Committee shall have the power to appoint a sub-committee to performSection 56 - The Chairperson and members of the commission supervising the Office of Personal Data Protection Committee, advisers of the commission supervisingSection 57 - There shall be a Secretary-General who is appointed by the commission supervising the Office of Personal Data Protection Committee andSection 58 - A person to be appointed Secretary-General must have the qualifications as follows:Section 59 - Any person holding any of the following prohibiting characteristics shall not be Secretary-General:Section 60 - The Secretary-General shall hold office for each term of four years and may be reappointed. However, the Secretary-General shall notSection 61 - In each year, the performance of the Secretary-General shall be evaluated in accordance with the period and method prescribed bySection 62 - In addition to vacating office upon the expiration of the term in section 60, the Secretary-General shall vacate office upon:Section 63 - The Secretary-General shall have the following duties andSection 64 - In the Office’s affairs related to the third party, the Secretary-Section 65 - The commission supervising the Office of Personal Data Protection Committee shall be responsible for determining salary rate and other benefitsSection 66 - In the interests of administration of the Office, the Secretary- General may request a civil official, staff, officer, or employeeSection 67 - For the civil official or government official who is working in compensation for the scholarship granted to him or herSection 68 - Accounting of the Office shall be made in accordance with international standards according to the forms and rules prescribed bySection 69 - The Office shall prepare financial statements and accountingSection 70 - The Office shall prepare an annual operation report and submit to the commission supervising the Office of Personal Data Protection
Section 79 - Any Data Controller who violates the provisions under section 27 paragraph one or paragraph two, or fails to comply withSection 80 - ny person who comes to know the Personal Data of another person as a result of performing duties under thisSection 81 - In the case where the offender who commits the offense under this Act is a juristic person and the offenseSection 82 - Any Data Controller who fails to comply with section 23, section 30 paragraph four, section 39 paragraph one, section 41Section 83 - Any Data Controller who violates or fails to comply with section 21, section 22, section 24, section 25 paragraph one,Section 84 - Any Data Controller who violates section 26 paragraph one or three, or section 27 paragraph one or paragraph two, orSection 85 - Any Data Processor who fails to comply with section 41 paragraph one, or section 42 paragraph two or three, shallSection 86 - Any Data Processor who fails to comply with section 40 without appropriate reasons, or fails to send or transfer theSection 87 - Any Data Processor who send or transfer the Personal Data under section 26 paragraph one or three, by not complyingSection 88 - Any representative of the Data Controller or of the Data Processor who fails to comply with section 39 paragraph oneSection 89 - Any person who fails to act in compliance with the order given by the expert committee, or fails to provideSection 90 - The expert committee shall have the power to render the punishment a s an administrative fine prescribed in this Part.
(4) two persons appointed by the National Human Rights Commission.
In addition to the Office’s duty to carry out its operations to achieve the objectives as set out in section 43 paragraph one, the Office shall have the duty to perform academic and administrative tasks for the Committee, the commission supervising the Office of Personal Data Protection Committee, the expert committee, and the sub-committee. The Office shall also have the following duties and power:
(11) to carry out other duties as assigned by the Committee, the commission supervising the Office of Personal Data Protection Committee, the expert committee, or the sub- committee, or as specified by law.
(4) to impose fees, maintenance fees, compensation, or service fees for the Office’s operations according to the Office’s objectives, in accordance with the criteria and at the rate specified by the Office, with the approval of the commission supervising the Office of Personal Data Protection Committee;
(5) to carry out any o ther acts that the law specifies to be the duties and powers of the Office, or as assigned by the Committee, the commission supervising the Office of Personal Data Protection Committee, the expert committee, or the sub-committee.
There shall be a commission supervising the Office of Personal Data Protection Committee consisting of a Chairperson, who is selected and appointed from a person having distinguished knowledge, skills and experience in Personal Data protection, the Permanent Secretary of the Ministry of Digital Economy and Society, and the Secretary-General of Office of the National Digital Economy and Society Commission as directors, and six honorary directors which, at least three persons, are selected and appointed from persons having distinguished knowledge, skills and experience in Personal Data protection, and other related areas which will be useful for the operation of the Office.
The substances of section 11 and section 13 shall apply to the Chairperson and the honorary director of the Commission mutatis mutandis.
n the case where the Chairperson or the honorary director in section 48 vacates office before the expiration of the term, the commission supervising the Office of Personal Data Protection Committee shall consist of all the existing members until the new Chairperson or the new honorary director is appointed. In the case where the Chairperson vacates office before the expiration of the term, the Permanent Secretary of the Ministry of Digital Economy and Society shall temporarily perform the duties of the Chairperson.
At a meeting of the commission supervising the Office of Personal Data Protection Committee, the presence of not less than one-half of all the members is required to constitute a quorum.
The meeting of the commission supervising the Office of Personal Data Protection Committee may be undertaken by electronic means, as prescribed by the Committee.
The Commission Supervising the Office of Personal Data Protection Committee shall have the following powers and duties:
(8) to perform any other duties prescribed by this Act or other related laws as the duties and power of the Commission Supervising the Office of Personal Data Protection Committee or as assigned by the Committee or the Cabinet.
The commission supervising the Office of Personal Data Protection Committee shall have the power to appoint a sub-committee to perform any duties or act as assigned by the commission supervising the Office of Personal Data Protection Committee.
The commission supervising the Office of Personal Data Protection Committee may appoint persons having skills or experience that will be useful for the duties performed by the commission supervising the Office of Personal Data Protection Committee as its advisers.
The performance of duties and numbers of the sub-committee in paragraph one or persons in paragraph two shall be in accordance with those prescribed by the commission supervising the Office of Personal Data Protection Committee.
The Chairperson and members of the commission supervising the Office of Personal Data Protection Committee, advisers of the commission supervising the Office of Personal Data Protection Committee, Chairperson and members of the sub- committee appointed by the commission supervising the Office of Personal Data Protection Committee shall receive a meeting allowance or other benefits according to the rules prescribed by the Committee with the approval of the Ministry of Finance.
There shall be a Secretary-General who is appointed by the commission supervising the Office of Personal Data Protection Committee and the Secretary- General has the duty to administer the affairs of the Office.
The appointment of the Secretary-General in paragraph one shall be made in accordance with the rules and methods of recruitment, as prescribed by the commission supervising the Office of Personal Data Protection Committee.
Not less than thirty days but not over sixty days before the end of the office term of the Secretary-General or within sixty days from the date that the Secretary-General vacates office before the end of the office term, the commission supervising the Office of Personal Data Protection Committee shall appoint a selection committee to select a new Secretary- General. The selection committee shall nominate not more than three appropriate persons to the commission supervising the Office of Personal Data Protection Committee.
In each year, the performance of the Secretary-General shall be evaluated in accordance with the period and method prescribed by the commission supervising the Office of Personal Data Protection Committee.
(4) being dismissed by the commission supervising the Office of Personal Data Protection Committee due to failure to pass the performance evaluation, disgraceful behavior, negligence or dishonesty in the performance of duties, or incapability.
(1) to manage the works of the Office for the achievements according to the Office’s missions and in accordance with the national policies and plans, strategic plans, policy of the Cabinet, o f the Committee and o f the commission supervising the Office of Personal Data Protection Committee and according to the rules, regulations or resolutions of the commission supervising the Office of Personal Data Protection Committee;
(2) to establish regulations with respect to the operations of the Office which are not contrary to or against the laws, the Cabinet resolutions and the regulations, rules, requirements, policies, resolutions or notifications prescribed by the commission supervising the Office of Personal Data Protection Committee;
(4) to appoint the Deputy Secretary-General and the Assistant Secretary- General by the approval of the commission supervising the Office of Personal Data Protection Committee in order to act as the Secretary-General’s assistant as assigned by the Secretary- General;
(5) to recruit, appoint, promote, decrease or deduct the salary of, and to take disciplinary action against the staffs and employees of the Office, as well as to dismiss the staffs and employees of the Office according to the rules or regulations of the commission supervising the Office of Personal Data Protection Committee;
(6) to perform any act according to the regulations, rules, requirements, policies, resolutions or notifications prescribed by the Commission Supervising the Office of Personal Data Protection Committee.
The Secretary-General shall be responsible for the administration of the Office and shall directly report to the commission supervising the Office of Personal Data Protection Committee.
General shall act as the Office’s representative. In this connection, the Secretary-General may grant the power to any person to perform any specific work on his or her behalf according to the rules prescribed by the commission supervising the Office of Personal Data Protection Committee.
The commission supervising the Office of Personal Data Protection Committee shall be responsible for determining salary rate and other benefits of the Secretary-General according to the rules prescribed by the Cabinet.
Accounting of the Office shall be made in accordance with international standards according to the forms and rules prescribed by the commission supervising the Office of Personal Data Protection Committee.
The Government Audit Office or a certified public accountant approved by the Government Audit Office shall be the Office’s auditor and shall evaluate the Office’s expenditures and property on an annual basis and report the auditing results to the commission supervising the Office of Personal Data Protection Committee for certification.
The Office shall prepare an annual operation report and submit to the commission supervising the Office of Personal Data Protection Committee and the Minister within one hundred and eighty days from the date of the fiscal year-end and shall disseminate this report to the public.
The evaluation of the Office’s performance under paragraph two must be undertaken by a third party approved by the commission supervising the Office of Personal Data Protection Committee.
A commission supervising the Office of the Personal Data Protection Committee shall be set up within ninety days from the date when the Chairperson and the honorary director are appointed in accordance with section 91.