ThailandPersonal Data Protection Act, sensitive and biometric categories
Personal Data Protection Act B.E. 2562 (2019), Section 26
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that captures or processes a faceprint, iris scan, fingerprint, voiceprint, or other biometric identifier from an individual in Thailand must obtain that individual's explicit consent under Section 26 before processing, unless a statutory exception applies.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does "biometric data" in Section 26, defined as personal data "arising from the use of technics or technology related to the physical or behavioral dominance of Person" that can identify a person, cover a voiceprint a service extracts from a recording, when the illustrative list ("the facial recognition data, iris recognition data or fingerprint recognition data") does not name one?
What it makes you log
Logging duty
Section 26 prohibits collecting sensitive data (race, political opinion, religion, sexual behavior, criminal records, health, disability, union membership, genetic and biometric data) without the data subject's explicit consent, subject to listed exceptions. It does not say the controller must keep a record of the consent or any log; the record the Act requires is in section 39, which this row does not cite.
- Kind
- None
- As of
What this law does
Section 26 prohibits collecting personal data on race, ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, or biometric data, or any data that may affect the data subject in the same manner, without the data subject's explicit consent, subject to enumerated exceptions such as vital interest and substantial public interest.
Biometric data is defined as data arising from technical processing of a person's physical or behavioral characteristics used to identify them, with facial recognition, iris recognition, and fingerprint recognition data given as express statutory examples. A voiceprint is not named as an express example, but the same-manner catch-all and the general physical-or-behavioral-dominance definition plausibly reach it; no provision was found excluding voice.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .