Issues Concerning Interplay between Consent and Necessity for the Performance of a Contract under the Personal Data Protection Act B.E. 2562

Abstract

In order to collect, use, or disclose personal data of a data subject, the data controller shall be able to rely on at least one of the lawful bases as prescribed under the Personal Data Protection Act B.E. 2562 (2019), namely consent basis, which is the general principle, and other 6 lawful bases, including necessity for the performance of a contract, which are exceptions thereto. When applying the aforesaid lawful bases, the data controller shall always consider lawful bases other than consent, which are exceptions to consent first. For instance, where there is a contractual relation between the data controller and the data subject, if such contract is valid pursuant to the applicable law, and the collection, use, or disclosure of personal data is objectively necessary for the performance of obligations under such contract, which generally shall not include the case where the provision of consent is stipulated as a contractual obligation of the data subject, the data controller shall be able to rely on the necessity for the performance of a contract basis. This includes the provision of membership or loyalty program where the data controller has provided specific terms and conditions therefor and the hire of actors or models for his or her appearance in the relevant media. However, where the aforesaid conditions are not met, and there is no other lawful basis which could be applicable, the data controller may be required to obtain consent for collection, use, or disclosure of personal data from the data subject. This includes the obtaining of consent for collection, use, or disclosure of personal data in addition to consent obtained under the Model Release form and Informed Consent Agreement form. In such event, the consent obtained shall also be explicit, informed, and freely given, such as without a condition to provide consent for collection, use, or disclosure of personal data, which is not necessary for or not relevant to the contract entering, including the provision of the service.