Right to ฺBe Forgotten under the Personal Data Protection Act B.E. 2562 (2019)

Abstract

Without explicitly referring to the term “right to be forgotten”, the data subject’s right under Section 33 of the Personal Data Protection Act B.E. 2561 (2019), and the data controller’s duty under Section 37(3) of the Personal Data Protection Act B.E. 2561 (2019), these two provisions are both capable of protecting right to be forgotten in accordance with universal theories on right to be forgotten, legal provisions, precedents, and guidelines in several foreign countries. These countries include the European Union, Australia, Japan, Hong Kong, Taiwan, the Philippines and Singapore. To facilitate clarity on how the data controller can fully comply with the Personal Data Protection Act B.E. 2561 (2019), especially when it comes to a data controller who provides search engine service, as well as to recognize the fact that communication between people is increasingly done through digital platforms, this article proposes that Section 33 and Section 37(3) of the Personal Data Protection Act B.E. 2561 (2019) should be amended to explicitly recognize the term “right to be forgotten”. This amendment will help making it clear that if a search engine provider already delisted the displayed personal data, its action shall be deemed to be fully compliant with the law without erasing or destroying the said personal data. Once deemed legally-sound, a search engine provider can avoid a risk associated with noncompliance with the Personal Data Protection Act B.E. 2561 (2019). In addition, this research recommends that the Personal Data Protection Commission should announce criteria for erasing, destroying, or anonymizing personal data by exercising its power under Section 33 paragraph 5 of the Personal Data Protection Act B.E. 2561 (2019). This subordinate law (or guidelines) can be developed by taking into account erasure, destruction, and anonymization guidelines in foreign countries.