Legal Problems Regarding Personal Data Protection for Biometrics

Abstract

The objectives of this thesis are to (1) study concepts relating to personal data, biometrics  data, and general characteristics of biometric technology; (2) compare personal data privacy laws on biometrics among various countries, and (3) examine problems concerning Thailand’s personal data protection for biometrics.

The results of the study are to improve the Personal Data Protection Act 2019 as follow: (1) The term "biometrics" and the definition given may be ambiguous and tend not to support the rapid advancement of technology.  The definition should therefore be adjusted accordingly; (2) The conditions for processing of biometrics are already suitable to cover the rights of the data subjects; (3) The security of biometrics should be based on international standards and use both “protection by design” and “protection by default”.  Impact assessment and the justifications for using biometrics should always be done prior to the decision to use biometrics technology.   If the result of the impact assessment is “high impact” then approval from the supervisory authority should be obtained prior to the use of biometrics; (4) Data subjects should be able to file complaints or lawsuits on biometrics violations without having to proof actual or financial damages. The loss of control or the simple violation of the data subject rights should be a sufficient cause for filing complaints or lawsuits; (5) Penalties for violations relating to biometrics under Personal Data Protection Act 2019 should be set per data subject instead of per violation.  This will be a deterrence to data controller and encourage them to put in place proper security measures.