Cross-Border Transferring of Personal Data
Pursuant to our previous articles on the PDPC Notification on Criteria for Protection of Personal Data Sends or Transfers to a Foreign Country According to Section 28 of the PDPA (Draft Notification on Section 28) and the PDPC Notification on Criteria for Protection of Personal Data Sends or Transfers to a Foreign Country According to Section 29 of the PDPA (Draft Notification on Section 29) (collectively referred to as the Draft Notifications), whereby at the time were drafts for public hearing. Now, the Personal Data Protection Committee (PDPC) in Thailand has announced the official version of Draft Notifications, the effective date of which shall be on 24 March 2024. This article herein then intends to outline the essential differences between the Draft Notifications and their respective official versions.
Subordinate regulation pursuant to Section 28 of the PDPA:
As we have discussed in length regarding the provision of Section 28 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA) prescribing a condition under which the data controller may cross-border transfer personal data, that is, if the destination country or international organization is deemed to have an adequate personal data protection standard, otherwise, other exemption would have to be relied upon (e.g., consent form the data subjects), and that what was deemed as adequate personal data protection standard, more information can be studied at the Draft Notification on Section 28. The official version and the draft version are substantially the same, except for the defined terms, which were added to exclude the sending or transferring of personal data of the following nature: (1) the sending or transferring of personal data by an intermediary as a data transit; (2) the sending or transferring of personal data that was done between the computer systems or data storages, provided that no third-party has access to such personal data. Examples of the exempted activities include the sending or transferring of personal data by the cloud computing service provider. By this exclusion, it releases intermediary and cloud computing service providers, as well as controllers or processors, burden compliance burdens.
Subordinate regulation pursuant to Section 29 of the PDPA:
In continuation to our previous article on the Draft Notification on Section 29, where we discussed that the PDPA provides two additional mechanisms for the cross-border transferring of personal data, that is (1) cross-border transfer of personal data within inter-affiliate companies, provided that the personal data protection policy (Binding Corporate Rules or BCR) is reviewed and certified; and (2) where in absence of whitelist country (i.e., per Section 28) and the BCR has not been reviewed or certified, a data controller may cross-border transfer personal data provided that an appropriate safeguard that ensure the enforceability of personal data subject’s rights and a legally remedial measures has been put in place.
We have also discussed that the appropriate safeguard could be achieved through the use of the Model Contractual Clause, namely (1) ASEAN Model Contractual Clauses for Cross-Border Data Flows; or (2) Standard Contractual Clauses for the Transfer of Personal Data to Third Countries issued pursuant to Articles 46 (1), (2) (c), and 28 (7) of Regulation (EU) 2016/679 or the European Union General Data Protection Regulation, commonly known as GDPR. The official version of subordinate regulation pursuant to Section 29 of the PDPA entails the required elements to be in such Model Contractual Clause. Notable elements required to be in the Model Contractual Clause include but not limited to the (1) measures for notifying the sending or transferring of personal data to the data subject; (2) measures for limiting the sending or transferring of personal data; (3) measures for specifying responsibility for the sending or transferring of personal data to be included in the contract; (4) measures to maintain security in the sending or transferring of personal data; (5) measures for ensuring effective remedial measures; and others. Moreover, revisions/amendments to the Model Contractual Clause are possible, provided that such revision/amendment is not contrary to the required elements as samples. Please be reminded that the Model Contractual Clause may be used as an alternative to the reviewed and certified BCR. Data controllers and processors have the choice to adopt the method deemed appropriate to their normal business operation.
The development of these subordinate regulations will not only change the course of normal business operations but also the paradigm of personal data protection in the digital era. Unifying the cross-border transferring of personal data’s requirements with those of international standards will not only ease Thai data controllers or data processors’ compliance with the PDPA and other personal data protection regulations internationally but also, allow the foreign data controller or data processor to easily comply with the Thai requirements, indirectly promoting the investment in Thailand.
Author: Panisa Suwanmatajarn, Managing Partner