This Act is called the "Personal Data Protection Act, B.E.2562 (2019)"

In the event that there is any sector-specific law governing the protection of Personal Data in any manner, any business or any entity, the provisions of such law shall apply, except:

(1) for the provisions with respect to the collection, use, or disclosure of Personal Data and the provisions with respect to the rights of data subjects including relevant penalties, the provisions of this Act shall apply additionally, regardless of whether they are repetitious with the above specific law;

(1) the collection, use, or disclosure of Personal Data by a Person who collects such Personal Data for personal benefit or household activity of such Person only;

(3) a Person or a juristic person who uses or discloses Personal Data that is collected only for the activities of mass media, fine arts, or literature, which are only in accordance with professional ethics or for public interest;

(4) The House of Representatives, the Senate, and the Parliament, including the committee appointed by the House of Representatives, the Senate, or the Parliament, which collect, use or disclose Personal Data in their consideration under the duties and power of the House of Representatives, the Senate, the Parliament or their committee, as the case may be;

The Data Controller under paragraph one (2), (3), (4), (5), and (6) and the Data Controller of the entities that are exempted under the Royal Decree in accordance with paragraph two shall also put in place a security protection of Personal Data in accordance with the standard.

This Act applies to the collection, use, or disclosure of Personal Data by a Data Controller or a Data Processor that is in the Kingdom of Thailand, regardless of whether such collection, use, or disclosure takes place in the Kingdom of Thailand or not.

In the event that a Data Controller or a Data Processor is outside the Kingdom of Thailand, this Act shall apply to the collection, use, or disclosure of Personal Data of data subjects who are in the Kingdom of Thailand, where the activities of such Data Controller or Data Processor are the following activities:

“Personal Data” means any information relating to a Person, which enables the identification of such Person, whether directly or indirectly, but not including the information of the deceased Persons in particular;

“Data Controller” means a Person or a juristic person having the power and duties to make decisions regarding the collection, use, or disclosure of the Personal Data;

“Data Processor” means a Person or a juristic person who operates in relation to the collection, use, or disclosure of the Personal Data pursuant to the orders given by or on behalf of a Data Controller, whereby such Person or juristic person is not the Data Controller;

“Committee” means the Personal Data Protection Committee;

“Office” means the Office of the Personal Data Protection Committee; “Secretary-General” means the Secretary-General of the Personal Data Protection Committee;

There shall be a Personal Data Protection Committee, consisting of:

(1) a Chairperson who is selected and appointed from persons having distinguished knowledge, skills, and experience in the field of Personal Data protection, consumer protection, information technology and communication, social science, law, health, finance, or any other field that must be relevant to, and useful for the protection of Personal Data;

(4) honorary directors as nine members, selected and appointed from the persons having distinguished knowledge, skills, and experience in the field of Personal Data protection, consumer protection, information technology and communication, social science, law, health, finance, or any other field that must be relevant to, and useful for the protection of Personal Data.

(1) to make the master plan on the operation for the promotion and protection of Personal Data, which are consistent with policies, national strategies and relevant national plans, in order to propose to the committee of the national digital economy and society, in accordance with the law governing development of the digital economy and society;

(3) to determine measures or guidelines of the operation in relation to Personal Data protection in order to comply with this Act;

(5) to announce and establish criteria for providing protection of Personal Data which is sent or transferred to a foreign country;

(6) to announce and establish guidance for the protection of Personal Data as guidelines which the Data Controller and the Data Processor shall comply;

(7) to recommend the Cabinet on the enactment, or revision, of the existing laws or rules applicable to the protection of Personal Data;

(9) to provide advice or consultancy on any operation for the protection of Personal Data of the government agency and private agency, in acting in compliance with this Act;

(11) to promote and support learning skills and understanding on the protection of Personal Data among the public;

(12) to promote and support research for the development of technology relating to the protection of Personal Data;

The Data Controller shall not collect, use, or disclose Personal Data, unless the data subject has given consent prior to or at the time of such collection, use, or disclosure, except the case where it is permitted to do so by the provisions of this Act or any other laws.

In requesting consent from the data subject, the Personal Data Controller shall also inform the purpose of the collection, use, or disclosure of the Personal Data. Such request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an easily accessible and intelligible form and statements, using clear and plain language, and

In requesting consent from the data subject, the Data Controller shall utmost take into account that the data subject's consent is freely given. Also, the entering into the contract, including any provisions of the service shall not be a condition to obtaining consent for the collection, use, or disclosure of Personal Data that is not necessary or not related to such contract entering, including the provisions of the service.

The data subject may withdraw his or her consent at any time. The withdrawal of consent shall be as easy as to giving consent, unless there is a restriction of the withdrawal of consent by law, or the contract which gives benefits to the data subject. However, the withdrawal of consent shall not affect the collection, use, or disclosure of personal data that the data subject has already given consent legally under this Chapter.

The request for the data subject’s consent which is not in accordance with those prescribed in this Chapter shall have no binding effect on the data subject and shall no longer enable the Data Controller to collect, use, or disclose the Personal Data.

The Data Controller shall collect, use, or disclose Personal Data according to the purpose notified to the data subject prior to or at the time of such collection.

The collection, use, or disclosure of Personal Data shall not be conducted in a manner that is different from the purpose previously notified to the data subject in accordance with paragraph one, unless:

The collection of Personal Data shall be limited to the extent necessary in relation to the lawful purpose of the Data Controller.

In collecting the Personal Data, the Data Controller shall inform the data subject, prior to or at the time of such collection, of the following details, except the case where the data subject already knows of such details:

(1) the purpose of the collection for use or disclosure of the Personal Data, including the purpose which is permitted under section 24 for the collection of Personal Data without the data subject's consent;

(2) notification of the case where the data subject must provide his or her Personal Data for compliance with a law, or contract, or where it is necessary to provide the Personal Data for the purpose of entering into the contract, including notification of the possible effect where the data subject does not provide such Personal Data;

(3) the Personal Data to be collected and the period for which the Personal Data will be retained. If it is not possible to specify the retention period, the expected data retention period according the data retention standard shall be specified;

(4) the categories of Persons or entities to whom the collected Personal Data may be disclosed;

The Data Controller shall not collect Personal Data without the consent of the data subject, unless:

(5) it is necessary for legitimate interests of the Data Controller or any other Persons or juristic persons other than the Data Controller, except where such interests are overridden by the fundamental rights of the data subject of his or her Personal Data;

The Data Controller shall not collect Personal Data from any other source, apart from the data subject directly, except where:

(1) the Data Controller has informed the data subject of the collection of Personal Data from other source without delay, but shall not exceed thirty days upon the date of such collection, and has obtained the consent from the data subject;

(2) it is a collection of Personal Data which falls within the exceptions to request consent under section 24 or section 26.

The provisions with respect to notice of the new purpose in section 21, and the notice of information details in section 23 shall apply mutatis mutandis to the collection of the Personal Data which requires consent in paragraph one, except for the following circumstances:

(2) the Data Controller can prove that the notice of such new purposes or information details is impossible or will obstruct the use or disclosure of the Personal Data, in particular for achieving the purposes in relation to scientific, historical, or statistical research purposes. In such cases, the Data Controller shall take suitable measures to protect the data subject 's rights, freedoms and interests;

(3) the use or disclosure of the Personal Data shall be carried out on an urgent basis as required by law, and suitable measures have been implemented to protect the data subject's interest;

(4) the Data Controller is aware of or acquires such Personal Data from his or her duty or occupation or profession, and shall maintain new purposes or certain information details as prescribed in section 23 with confidentiality as required by law.

To notify the information detailed in paragraph two, the Data Controller shall provide such information to the data subject within thirty days after the date of collection such of Personal Data, unless the Personal Data are to be used for communication with the data subject, the notice of information details shall be provided at the time of the first communication to that data subject. If a disclosure to another Person is envisaged, the notice of information details shall be provided prior to the time of the first disclosure.

Any collection of Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner, as prescribed by the Committee, is prohibited, without the explicit consent from the data subject, except where:

it is carried out in the course of legitimate activities with appropriate safeguards by the foundations, associations or any other not-for-profit bodies with a political, religious, philosophical, or trade union purposes for their members, former members of the bodies, or persons having regular contact with such foundations, associations or not-for-profit bodies in connection with their purposes, without disclosing the Personal Data outside of such foundations, associations or not-for-profit bodies;

The biometric data in paragraph one shall mean the Personal Data arising from the use of technics or technology related to the physical or behavioral dominance of Person, which can be used to identify such Person apart from other Persons, such as the facial recognition data, iris recognition data or fingerprint recognition data.

In the case of the collection of the Personal Data relating to criminal record, such collection shall be carried out under the control of authorized official authority under the law, or the data protection measure has been implemented according to rules prescribed by the Committee.

The Data Controller shall not use or disclose Personal Data without the consent of the data subject, unless it is the Personal Data which is collected without requirement of consent under section 24 or section 26.

The Person or juristic person who obtains Personal Data as a result of the disclosure under paragraph one shall not use or disclose such Personal Data for any purpose other than the purpose previously notified to the Data Controller in the request to obtain such Personal Data.

In the event that the Data Controller uses or discloses the Personal Data which is exempted from consent requirement in paragraph one, the Data Controller shall maintain a record of such use or disclosure in the record under section 39.

In the event that the Data Controller sends or transfers the Personal Data to a foreign country, the destination country or international organization that receives such Personal Data shall have adequate data protection standard, and shall be carried out in accordance with the rules for the protection of Personal Data as prescribed by the Committee in section 16(5), except in the following circumstances:

(2) where the consent of the data subject has been obtained, provided that the data subject has been informed of the inadequate Personal Data protection standards of the destination country or international organization;

In the event that there is a problem with regard to the adequacy of Personal Data

protection standards of the destination country or international organization, such problem shall be submitted to the Committee to decide. The decision made by the Committee may be reviewed when there is a new evidence convincing that the destination country or international organization that receives such Personal Data has developed adequate Personal Data protection standards.

In the event that the Data Controller or the Data Processor who is in the Kingdom of Thailand has put in place a Personal Data protection policy regarding the sending or transferring of Personal Data to another Data Controller or Data Processor who is in a foreign country, and is in the same affiliated business, or is in the same group of undertakings, in order to jointly operate the business or group of undertakings. If such Personal Data protection policy has been reviewed and certified by the Office, the sending or transferring of Personal Data to a foreign country, which is in accordance with such reviewed and certified Personal Data protection policy, can be carried out and shall be exempt from compliance with section 28.

The Personal Data protection policy, the nature of the same affiliated undertaking or affiliated business in order to jointly operate the undertaking or business, and the rules and methods for the review and certification in paragraph one shall be as prescribed and announced by the Committee.

In the absent of a decision by the Committee in accordance with section 28, or the Personal Data protection policy referred in paragraph one, the Data Controller or the Data Processor may send or transfer the Personal Data to a foreign country in exemption to compliance with section 28, if the Data Controller or the Data Processor provides suitable protection measures which enable the enforcement of the data subject’s rights, including effective legal remedial measures according to the rules and methods as prescribed and announced by the Committee.

The data subject is entitled to request access to and obtain copy of the Personal Data related to him or her, which is under the responsibility of the Data Controller, or to request the disclosure of the acquisition of the Personal Data obtained without his or her consent.

The Data Controller shall perform as requested in paragraph one. The request can be rejected only where it is permitted by law or pursuant to a court order, and such access and obtaining a copy of the Personal Data would adversely affect the rights and freedoms of others.

The Committee may prescribe rules for the access to and request to obtain a copy of the Personal Data in paragraph one, including the extension of the period under paragraph four, or other rules as appropriate.

The data subject shall have the right to receive the Personal Data concerning him or her from the Data Controller. The Data Controller shall arrange such Personal Data to be in the format which is readable or commonly used by ways of automatic tools or equipment, and can be used or disclosed by automated means. The data subject is also entitled to:

(1) request the Data Controller to send or transfer the Personal Data in such formats to other Data Controllers if it can be done by the automatic means;

(2) request to directly obtain the Personal Data in such formats that the Data Controller sends or transfers to other Data Controllers, unless it is impossible to do so because of the technical circumstances.

The Personal Data in paragraph one must be the Personal Data that the data subject has given consent for the collection, use, or disclosure of such Personal Data according to the rules under this Act, or the Personal Data that is exempted from consent requirements under section 24 (3), or any other Personal Data referred to under section 24 as prescribed by the Committee.

The exercise of rights of the data subject in paragraph one shall not apply to the sending or transferring of Personal Data by the Data Controller which is the performance of a task carried out in the public interest, or for compliance with law, or such exercise of rights shall not violate the rights and freedoms of others. In the event that the Data Controller rejects the request by such reasons, the Data Controller shall make a record of such rejection of the request together with reasons in the record as prescribed in section 39.

The data subject has the right to object the collection, use, or disclosure of the Personal Data concerning him or her, at any time, in the following circumstances:

(1) Where the Personal Data is collected with the exemption to consent requirements under section 24 (4) or (5), unless the Data Controller can prove that:

(2) the collection, use, or disclosure of such Personal Data is for the purpose of direct marketing;

(3) the collection, use, or disclosure of the Personal Data for the purpose of scientific, historical or statistic research, unless it is necessary to performance of a task carried out for reasons of public interest by the Data Controller.

In the event that the data subject exercises his or her right to object in paragraph one, the Data Controller shall no longer be able to collect, use, or disclose such Personal Data, and the Data Controller shall immediately distinguish such personal data clearly from the other matters at the time when the data subject gives the notice of objection to the Data Controller.

he data subject shall have the right to request the Data Controller to erase or destroy the Personal Data, or anonymize the Personal Data to become the anonymous data which cannot identify the data subject, where the following ground applies:

(1) the Personal Data is no longer necessary in relation to the purposes for which it was collected, used or disclosed;

(3) the data subject objects to the collection, use, or disclosure of the Personal Data referred in Section 32 (1), and the Data Controller cannot reject to such request as referred in section 32 (1) (a) or (b), or where the data subject exercise his or her right to object as referred in section 32 (2);

(4) the Personal Data have been unlawfully collected, used, or disclosed under

Paragraph one shall not apply to the extent that such Personal Data retention is necessary for the purpose of freedom of expression, the purpose under section 24 (1) or (4) or section 26(5) (a) or (b), the purpose of establishment, compliance or exercise of legal claims, or defense of legal claims, or the purpose for compliance with the law.

Where the Data Controller has made the Personal Data disclose to public and is requested to erase or destroy the Personal Data, or make the Personal Data become the anonymous data which cannot identify the data subject pursuant to paragraph one, the Data Controller shall be responsible for the course of action, both the implementation of technology and the expenses to fulfil the request, and inform other Data Controllers in order to obtain their responses regarding the action to be taken to fulfil such request.

The Committee may announce the rules for the erasure or destruction of Personal Data, or anonymization of the Personal Data to become the anonymous data which cannot identify the data subject pursuant to paragraph one.

The data subject shall have the right to request the Data Controller to restrict the use of the Personal Data, where the following applies:

(2) when it is the Personal Data which shall be erased or destroyed pursuant to section 33 (4), but the data subject requests the restriction of the use of such Personal Data instead;

(3) when it is no longer necessary to retain such Personal Data for the purposes of such collection, but the data subject has necessity to request the retention for the purposes of the establishment, compliance, or exercise of legal claims, or the defense of legal claims;

The Data Controller shall ensure that the Personal Data remains accurate, up-to-date, complete, and not misleading.

(1) provide appropriate security measures for preventing the unauthorized or unlawful loss, access to, use, alteration, correction or disclosure of Personal Data, and such measures must be reviewed when it is necessary, or when the technology has changed in order to efficiently maintain the appropriate security and safety. It shall also be in accordance with the minimum standard specified and announced by the Committee;

(2) in the circumstance where the Personal Data is to be provided to other Persons or legal persons, apart from the Data Controller, the Data Controller shall take action to prevent such person from using or disclosing such Personal Data unlawfully or without authorization;

(3) put in place the examination system for erasure or destruction of the Personal Data when the retention period ends, or when the Personal Data is irrelevant or beyond the purpose necessary for which it has been collected, or when the data subject has request to do so, or when the data subject withdraws consent, except where the retention of such Personal Data is for the purpose of freedom of expression, the purpose under section 24 (1) or (4) or section 26 (5) (a) or (b) , the purpose of the establishment, compliance or exercise of legal claims, or defense of legal claims, or the purpose of compliance with the law. The provision in section 33 paragraph five shall be used to govern the erasure or destruction of Personal Data mutatis mutandis;

(4) notify the Office of any Personal Data breach without delay and, where feasible, within 72 hours after having become aware of it, unless such Personal Data breach is unlikely to result in a risk to the rights and freedoms of the Persons. If the Personal Data breach is likely to result in a high risk to the rights and freedoms of the Persons, the Data Controller shall also notify the Personal Data breach and the remedial measures to the data subject without delay. The notification and the exemption to the notification shall be made in accordance with the rules and procedures set forth by the Committee;

(5) in the event of being the Data Controller pursuant to section 5 paragraph two, the Data Controller shall designate in writing a representative of the Data Controller who must be in the Kingdom of Thailand and be authorized to act on behalf of the Data Controller without any limitation of liability with respect to the collection, use or disclosure of the Personal Data according to the purposes of the Data Controller.

(2) the Data Controller which engages in the profession or business of collecting, using, or disclosing Personal Data, that does not have the nature pursuant to section 26, and does not have a large amount of Personal Data as prescribed by the Committee in section 41 (2).

(1) the collected Personal Data;

(2) the purpose of the collection of the Personal Data in each category;

(4) the retention period of the Personal Data;

(5) rights and methods for access to the Personal Data, including the conditions regarding the Person having the right to access the Personal Data and the conditions to access such Personal Data;

The provisions in (1), (2), (3), (4), (5), (6) and (8) may not apply to the Data Controller who is a small organization pursuant to the rules as prescribed by the Committee, unless the collection, use, or disclosure of such Personal Data is likely to result in a risk to the rights and freedoms of data subjects, or not a business where the collection, use, or disclosure of the Personal Data is occasional, or involving in the collection, use, or disclosure of the Personal Data pursuant to section 26.

The Personal Data Processor shall have the following duties:

(1) carry out the activities related to the collection, use, or disclosure of Personal Data only pursuant to the instruction given by the Data Controller, except where such instruction is contrary to the law or any provisions regarding Personal Data protection under this Act;

(2) provide appropriate security measures for preventing unauthorized or unlawful loss, access to, use, alteration, correction or disclosure, of Personal Data, and notify the Data Controller of the Personal Data breach that occurred;

(3) prepare and maintain records of personal data processing activities in accordance with the rules and methods set forth by the Committee.

The Data Processor, who fails to comply with (1) for the collection, use, or disclosure of the Personal Data, shall be regarded as the Data Controller for the collection, use, or disclosure of such Personal Data.

The provisions in (3) may not apply to the Data Processor who is a small organization pursuant to the rules as prescribed by the Committee, unless the collection, use, or disclosure of such Personal Data is likely to result in a risk to the rights and freedoms of data subjects, or not a business where the collection, use, or disclosure of the Personal Data is occasional, or involving in the collection, use, or disclosure of the Personal Data pursuant to section 26.

(2) the activities of the Data Controller or the Data Processor in the collection, use, or disclosure of the Personal Data require a regular monitoring of the Personal Data or the system, by the reason of having a large number of Personal Data as prescribed and announced by the Committee;

(3) the core activity of the Data Controller or the Data Processor is the collection, use, or disclosure of the Personal Data according to section 26. In the event that the Data Controller or the Data Processor are in the same affiliated business or are in the same group of undertakings, in order to jointly operate the business or group of undertakings as prescribed and announced by the Committee according to section 29 paragraph two, such Data Controller or Data Processor may jointly designate a data protection officer. In this regard, each establishment of the Data Controller or the Data Processor in the same affiliated business or in the same group of undertakings must be able to easily contact the data protection officer.

The Data Controller and the Data Processor shall have an obligation to provide the information of the data protection officer, contact address, and contact channels to the data subject and the Office. The data subject shall be able to contact the data protection officer with respect to the collection, use, or disclosure of the Personal Data and the exercise of rights of the data subject under this Act.

The Committee may prescribe and announce the qualifications of the data protection officer by taking into account the knowledge or expertise with respect to the Personal Data protection.

The personal data protection officer may be a staff of the Data Controller or the Data Processor, or a service provider under the contract with the Data Controller or the Data Processor.

(2) investigate the performance of the Data Controller or the Data Processor, including the employees or service providers of the Data Controller or of the Data Processor with respect to the collection, use, or disclosure of the Personal Data for compliance with this Act;

(3) coordinate and cooperate with the Office in the circumstance where there are problems with respect to the collection, use, or disclosure of the Personal Data undertaken by the Data Controller or the Data Processor, including the employees or service providers of the Data Controller or of the Data Processor with respect to the compliance with this Act;

(4) keep confidentiality of the Personal Data known or acquired in the course of his or her performance of duty under this Act.

The Data Controller or the Data Processor shall support the data protection officer in performing the tasks by providing adequate tools or equipment as well as facilitate the access to the Personal Data in order to perform the duties.

There shall be an Office of the Personal Data Protection Committee, whose objectives are to protect Personal Data, encourage and support the country’s development regarding Personal Data protection.

In addition to the Office’s duty to carry out its operations to achieve the objectives as set out in section 43 paragraph one, the Office shall have the duty to perform academic and administrative tasks for the Committee, the commission supervising the Office of Personal Data Protection Committee, the expert committee, and the sub-committee. The Office shall also have the following duties and power:

(1) to draft the master plan on the operation for the promotion and protection of Personal Data, which are consistent with policies, national strategies and relevant national plans, and to draft the master plan and corrective measures regarding the difficulties in carrying out such policies, national strategies and national plans in order to propose to the Committee;

(2) to promote and support the research for the development of technology relating to the protection of Personal Data;

(3) to analyze and certify the compliance with and accuracy of the standards or measures, or the supervision mechanism in connection with Personal Data protection, as well as to review and certify the Personal Data protection policy according to section 29;

(4) to conduct surveys, collect information, and follow the latest updates and trends on Personal Data protection, as well as to conduct analysis and research on Personal Data protection issues that affect the country’s development, to propose to the Committee.

(5) to liaise with the public sector, state enterprises, local government administration, public organizations, or other organizations of the country regarding Personal Data protection;

(7) to act as the center to provide academic services or services related to Personal Data protection to the government agency, private agencies, and the public, including to promote and provide knowledge and understanding regarding Personal Data protection;

(11) to carry out other duties as assigned by the Committee, the commission supervising the Office of Personal Data Protection Committee, the expert committee, or the sub- committee, or as specified by law.

(4) to impose fees, maintenance fees, compensation, or service fees for the Office’s operations according to the Office’s objectives, in accordance with the criteria and at the rate specified by the Office, with the approval of the commission supervising the Office of Personal Data Protection Committee;

(5) to carry out any o ther acts that the law specifies to be the duties and powers of the Office, or as assigned by the Committee, the commission supervising the Office of Personal Data Protection Committee, the expert committee, or the sub-committee.

There shall be a commission supervising the Office of Personal Data Protection Committee consisting of a Chairperson, who is selected and appointed from a person having distinguished knowledge, skills and experience in Personal Data protection, the Permanent Secretary of the Ministry of Digital Economy and Society, and the Secretary-General of Office of the National Digital Economy and Society Commission as directors, and six honorary directors which, at least three persons, are selected and appointed from persons having distinguished knowledge, skills and experience in Personal Data protection, and other related areas which will be useful for the operation of the Office.

n the case where the Chairperson or the honorary director in section 48 vacates office before the expiration of the term, the commission supervising the Office of Personal Data Protection Committee shall consist of all the existing members until the new Chairperson or the new honorary director is appointed. In the case where the Chairperson vacates office before the expiration of the term, the Permanent Secretary of the Ministry of Digital Economy and Society shall temporarily perform the duties of the Chairperson.

At a meeting of the commission supervising the Office of Personal Data Protection Committee, the presence of not less than one-half of all the members is required to constitute a quorum.

The meeting of the commission supervising the Office of Personal Data Protection Committee may be undertaken by electronic means, as prescribed by the Committee.

The Commission Supervising the Office of Personal Data Protection Committee shall have the following powers and duties:

(8) to perform any other duties prescribed by this Act or other related laws as the duties and power of the Commission Supervising the Office of Personal Data Protection Committee or as assigned by the Committee or the Cabinet.

The commission supervising the Office of Personal Data Protection Committee shall have the power to appoint a sub-committee to perform any duties or act as assigned by the commission supervising the Office of Personal Data Protection Committee.

The commission supervising the Office of Personal Data Protection Committee may appoint persons having skills or experience that will be useful for the duties performed by the commission supervising the Office of Personal Data Protection Committee as its advisers.

The performance of duties and numbers of the sub-committee in paragraph one or persons in paragraph two shall be in accordance with those prescribed by the commission supervising the Office of Personal Data Protection Committee.

The Chairperson and members of the commission supervising the Office of Personal Data Protection Committee, advisers of the commission supervising the Office of Personal Data Protection Committee, Chairperson and members of the sub- committee appointed by the commission supervising the Office of Personal Data Protection Committee shall receive a meeting allowance or other benefits according to the rules prescribed by the Committee with the approval of the Ministry of Finance.

There shall be a Secretary-General who is appointed by the commission supervising the Office of Personal Data Protection Committee and the Secretary- General has the duty to administer the affairs of the Office.

The appointment of the Secretary-General in paragraph one shall be made in accordance with the rules and methods of recruitment, as prescribed by the commission supervising the Office of Personal Data Protection Committee.

Not less than thirty days but not over sixty days before the end of the office term of the Secretary-General or within sixty days from the date that the Secretary-General vacates office before the end of the office term, the commission supervising the Office of Personal Data Protection Committee shall appoint a selection committee to select a new Secretary- General. The selection committee shall nominate not more than three appropriate persons to the commission supervising the Office of Personal Data Protection Committee.

In each year, the performance of the Secretary-General shall be evaluated in accordance with the period and method prescribed by the commission supervising the Office of Personal Data Protection Committee.

(4) being dismissed by the commission supervising the Office of Personal Data Protection Committee due to failure to pass the performance evaluation, disgraceful behavior, negligence or dishonesty in the performance of duties, or incapability.

(1) to manage the works of the Office for the achievements according to the Office’s missions and in accordance with the national policies and plans, strategic plans, policy of the Cabinet, o f the Committee and o f the commission supervising the Office of Personal Data Protection Committee and according to the rules, regulations or resolutions of the commission supervising the Office of Personal Data Protection Committee;

(2) to establish regulations with respect to the operations of the Office which are not contrary to or against the laws, the Cabinet resolutions and the regulations, rules, requirements, policies, resolutions or notifications prescribed by the commission supervising the Office of Personal Data Protection Committee;

(4) to appoint the Deputy Secretary-General and the Assistant Secretary- General by the approval of the commission supervising the Office of Personal Data Protection Committee in order to act as the Secretary-General’s assistant as assigned by the Secretary- General;

(5) to recruit, appoint, promote, decrease or deduct the salary of, and to take disciplinary action against the staffs and employees of the Office, as well as to dismiss the staffs and employees of the Office according to the rules or regulations of the commission supervising the Office of Personal Data Protection Committee;

(6) to perform any act according to the regulations, rules, requirements, policies, resolutions or notifications prescribed by the Commission Supervising the Office of Personal Data Protection Committee.

The Secretary-General shall be responsible for the administration of the Office and shall directly report to the commission supervising the Office of Personal Data Protection Committee.

General shall act as the Office’s representative. In this connection, the Secretary-General may grant the power to any person to perform any specific work on his or her behalf according to the rules prescribed by the commission supervising the Office of Personal Data Protection Committee.

The commission supervising the Office of Personal Data Protection Committee shall be responsible for determining salary rate and other benefits of the Secretary-General according to the rules prescribed by the Cabinet.

Accounting of the Office shall be made in accordance with international standards according to the forms and rules prescribed by the commission supervising the Office of Personal Data Protection Committee.

The Government Audit Office or a certified public accountant approved by the Government Audit Office shall be the Office’s auditor and shall evaluate the Office’s expenditures and property on an annual basis and report the auditing results to the commission supervising the Office of Personal Data Protection Committee for certification.

The Office shall prepare an annual operation report and submit to the commission supervising the Office of Personal Data Protection Committee and the Minister within one hundred and eighty days from the date of the fiscal year-end and shall disseminate this report to the public.

The evaluation of the Office’s performance under paragraph two must be undertaken by a third party approved by the commission supervising the Office of Personal Data Protection Committee.

(2) investigate any act of the Data Controller or the Data Processor, including the employees or the contractors of the Data Controller or the Data Processor in connection with the Personal Data that causes damage to the data subject;

(3) settle disputes in connection with Personal Data;

The expert committee shall have the power to order any person to submit documents or information in connection with the subject matter of a complaint, or any other matter related to the protection of the Personal Data under this Act. The expert committee shall also have the power to request any person to make a statement of facts.

The Data Controller or the Data Processor, whose operation in relation to Personal Data violates or fails to comply with the provisions of this Act which causes damages to the data subject, shall compensate the data subject for such damages, regardless of whether such operation is performed intentionally or negligently, except where the Data Controller or the Data Processor can prove that such operation was a result of:

The claim for compensation from the wrongful act against the Personal Data under this Act shall be barred by prescription after the lapse of three years from the date that the injured person know of the damages and the identity of the Data Controller or the Data Processor who is to be liable, or after ten years from the date of which the wrongful act against the Personal Data took place.

Any Data Controller who violates the provisions under section 27 paragraph one or paragraph two, or fails to comply with section 28, which relates to the Personal Data under section 26 in a manner that is likely to cause other person to suffer any damage, impair his or her reputation, or expose such other person to be scorned, hated, or humiliated, shall be punished with imprisonment for a term not exceeding six months, a fine not exceeding Baht five hundred thousand, or both.

Any Data Controller who violates the provisions under section 27 paragraph one or paragraph two, or fails to comply with section 28, which relates to the Personal Data under section 26 in order to unlawfully benefit himself or herself, or another person, shall be punished with imprisonment for a term not exceeding one year, a fine not exceeding Baht one million, or both.

ny person who comes to know the Personal Data of another person as a result of performing duties under this Act and discloses it to any other person shall be punished with imprisonment for a term not exceeding six months, a fine not exceeding Baht five hundred thousand, or both.

Any Data Controller who violates or fails to comply with section 21, section 22, section 24, section 25 paragraph one, section 27 paragraph one or two, section 28, section 32 paragraph two, or section 37, or who obtains consent by deceiving or misleading the d ata subject about the purposes, or fails to comply with section 21 which applies mutatis mutandis according to section 25 paragraph two, or fails to send or transfer the Personal Data in accordance with section 29 paragraph one or paragraph three, shall be punished with an administrative fine not exceeding Baht three million.

Any Data Controller who violates section 26 paragraph one or three, or section 27 paragraph one or paragraph two, or section 28 in relation to the Personal Data under section 26, or fails to send or transfer the Personal Data under section 26 to be in accordance with section 29 paragraph one or paragraph three, shall be punished with an administrative fine not exceeding Baht five million.

Any Data Processor who fails to comply with section 40 without appropriate reasons, or fails to send or transfer the Personal Data in accordance with section 29 paragraph one or three, or fails to comply with section 37 (5) which applies mutatis mutandis according to section 38 paragraph two, shall be punished with an administrative fine not exceeding Baht three million.

Any Data Processor who send or transfer the Personal Data under section 26 paragraph one or three, by not complying with section 29 paragraph one or three, shall be punished with an administrative fine not exceeding Baht five million.

A commission supervising the Office of the Personal Data Protection Committee shall be set up within ninety days from the date when the Chairperson and the honorary director are appointed in accordance with section 91.

For Personal Data that has previously been collected by a Data Controller before the effective date o f this Act, the Data Controller shall be entitled to continue to collect and use such Personal Data for the original purposes. However, the Data Controller shall prepare and publicize a consent withdrawal method to facilitate the data subject, who does not wish the Data Controller to continue collecting and using his or her Personal Data, to notify his or her withdrawal of consent easily.

The disclosure and other acts other than the collection and use of Personal Data under paragraph one, shall be in accordance with the provisions hereunder.