POSSIBILITY OF THE ALTERNATIVE DISPUTE RESOLUTION (ADR) ON THAI’S PDPA

POSSIBILITY OF THE ALTERNATIVE DISPUTE RESOLUTION (ADR) ON THAI’S PDPA

1. Introduction

In Thailand apart from the Dispute Mediation Act B.E. 2562, the mediation processes are also provided in other specific legislation, such as mediation processes in the Contract Farming Act[1] or insurance disputes mediation which is under authority of the Office of Insurance Commission (OIC). It could be seen that each in charge authorities would have their expertise and special authority to resolve such dispute which is related to such specific legal area.

Under Thai’s Personal Data Protection Act B.E. 2562 (“PDPA“), the alternative dispute resolution is also being provided under Section 72 (3). The Personal Data Protection Committee (“PDPC”) also have their authority to settle any disputes in connection with Personal Data[2].

Even though Section 72 of Thai’s PDPA stated that PDPC could mediate the dispute which relates to Personal Data Protection, but Thai’s PDPA does not provide any clear dispute mediation procedure. Moreover, the Act just only provided the right to submit any claims only for the Data Subject side[3], and there is no right provided for Data Controller and Data Processor to submit any dispute to PDPC.

If the dispute parties under PDPA could not enter into the mediation processes as being stated in Section 72, the only choices would be following the processes of claim as provided in Chapter 5[4], then how the dispute could be amicably resolved as aforementioned in Section 72 (3)?

Another issue which should be considered is that, in other aspects of the law the Data Controller, Data Processor, and Data Subject, are playing in other roles and there are some legal relationships between them, such as the relationship between employer and employees or education institute and student. These relationships might not be able to continue with a good atmosphere, as the Data Controller and Data Processor would not be satisfied if they were complaint by Data Subject.

This Article will focus on the issues, whether Thai’s PDPA should have the Mediation Processes or not and will it benefit for any related parties under this Act.

2. Why the Dispute Mediation Act B.E. 2562 could not be used for these specific issues?

In Thailand, the dispute that able to be solved under Thai’s Dispute Mediation Act in the year 2562 (“Thai’s Mediation Act”), could be categorized into 2 categories[5] as follows: –

2.1 Civil Dispute Mediation[6]

Under Thai’s Mediation Act, there are just only 4 types of Civil Dispute which can be brought to mediation processes[7] which is 1. Land-related disputes other than ownership disputes, 2. Disputes between heirs involving assets to be acquired through succession, 3. Other disputes as specified in the royal decree and 4. Any disputes other than the above, which has the claim amount not exceeding 5 million baht or not exceeding the amount which prescribed in the royal decree.

As aforementioned, the disputes on Personal Data are not mentioned in Thai Mediation Act. Currently, there is no any royal decree mentioned that the dispute on Personal Data could be resolved by using the Mediation processes prescribed in this Act.

2.2 Criminal Dispute Mediation[8]

As under the Thai’s Mediation Act, the Criminal Offences which could be entered to mediation processes shall be compoundable offenses[9], which is matched with Section 79 of Thai’s PDPA, which is also compoundable offenses.

However, even the dispute in the criminal part could be settled, but it is still not clear that the disputes on the civil part should be deemed as settled. Moreover, as there are many complex provisions under Thai’s PDPA such as interpretation issues for any offense’s elements. Therefore, to avoid any misunderstanding, the dispute related to PDPA’s should be considered by the PDPC and it shall have a specific mediation procedure as well.

3. Mediation under Korean Personal Information Protection Act. (“PIPA”)

Under Korean’s PIPA, which is also special legislation focused on personal data protection same as Thai’s PDPA, it provides specifically mediation processes in Chapter 6 for any disputes that arise from breaching principles of Personal Information Protection as mentioned in such Act, which would be conducted by the authority called as “Personal Information Dispute Mediation Committee” [10].

The Personal Information Dispute Mediation processes under PIPA is obviously similar to mediation processes in general, in the sense that, any parties who related to the Personal Information Issue could submit their dispute to the Mediation Committee to be considered, no matter they are Data Subject side or the Data Processor side under PIPA[11].

After the Application for Mediation being applied by a Party (hereinafter in this part would be called as “Plaintiff”) to the Mediation Committee, then the Committee shall notify another Party (hereinafter would be called as “Defendant”), after that the Mediation Committee would prepare a “Draft of Settlement before Mediation” during examination of the case[12]. When the examination was done, they would prepare the “Draft of Mediation” including the information such as suspension of violation activities to be investigated, restitution, damages and other necessary remedies and any measure necessary to prevent recurrence of the identical or similar violations[13].

The examination processes would be conducted by the Mediation Committee by requesting any parties to provide such related evidence or materials, which is necessary to mediate the dispute, or even request such parties to involve in dispute examination as a witness and provide their statements or evidence by appearing before the Mediation Committee[14].

When all Parties provided their evidence or statement to Mediation Committee, then they shall prepare and present the Draft of Mediation Settlement to each Party without delay. Both parties shall notify to the Dispute Mediation Committee within 15 days that, they would accept or deny the Draft of Mediation Settlement. If the dispute was denied, it shall be deemed that the dispute between the Parties is inappropriate to mediate, and the Mediation Processes shall be dismissed[15].

It could be seen that mediation processes, is also based on the consent and willingness of the disputed Parties, whether they intend to engage in the dispute mediation and it will certainly not interfere with the Data Subject’s Consent under PIPA objective.

4. Issues which shall be considered when some disputes arise over Personal Data Protection.

As the matter of fact that Thai’s PDPA is related to all organizations and almost all of them shall comply this legal provision. However, the issues which shall be concerned, and could be amicably resolved by using Mediation Processes, could be described as follows: –

4.1 Issues regarding to Authority of the Competence Officer to enter to the premise of Data Controller and Data Processor.

Regarding to the Thai’s PDPA Chapter 5 “Complaints”, when the Data Subject submit such complaints to the PDPC, the law provided a lot of authority to the Data Subject, PDPC and their competent officer to enter to the premise of the Data Controller and Data Processor[16], which is quite similar to the powers of the inquiry official under the Criminal Code, and they could be damaged from entering to the premise by Competent Officers, without restitution or remedies. As Data Controller have to seize their operation of business, which means they would loss some amount of income, even the leakage of personal information still not be proved yet.

It could be seen that, there is only Data Controller and Data Processor side who would be enforced by this Chapter. In contrast, the Data Subject is only party that have several rights. Therefore, if there is any choice for the Dispute Parties to enter to the mediation processes, then it could be considered as an option that could reduce such damages between both parties.

4.2 Thai’s PDPA favors the Data Subject only.

As the objective of the Law is to protect their Personal Data, and there are several rights being provided for the Data Subject under Thai’s PDPA.

On the other hand, there is no right for the Data Controller and Data Processor even the right to start the Dispute Settlement processes by submitting the application to the PDPC. It could be seen that currently Thai’s PDPA aimed to enforce the Data Controller and Data Processor only, even though, the dispute could be amicably resolved by both Parties, which is not quite fair for the Data Controller and Data Processor sides. Therefore, the mediation could be able to consider as a balancing option for both parties and could reduce any risk of being questioned by society about the impartiality of this law.

4.3 The Issue regarding to the maintenance of relationship between Data Subject and Data Controller and Data Processor

As the matter of fact that, the Data Subject under other provisions apart from PDPA could be in other roles, such as patient, employee, clients and etcetera. Therefore, if the Data Subject intends to file the complaints against their employer, services provider or the hospital, who being in the role of Data Controller or Data Processor as well, and the dispute parties could not be able to amicably discussed and resolved the dispute. At the end of the day, if both Parties have to continue on their business activities, then how could they continue in a good atmosphere.

4.4 Why the Mediation could be used to resolve the disputes under PDPA, while Arbitration is not?

As the objective of Personal Data Protection would be on the “Consent” of the Data Subject. However, in arbitration processes, the parties would be bound to the Arbitration clause since they shall first agree to use arbitration process as a dispute resolution method, without any right of the Parties to withdraw such case or use other methods to resolve the dispute, which obviously seems to be conflicted with the “Consent” of the Data Subject, as it is one of the most important objectives of the Personal Data Protection Law.

Moreover, the arbitrator also has more authority to decide such disputes and granted arbitration award to enforce another party, after the hearing processes was done, unless the award was in conflict with the public order or good morals. Then how could Data Subject’s Consent be protected from duties under Arbitration Processes, as there is no choice provided for Data Subject along all of the arbitration processes? Meanwhile, for mediation processes, from file the Application to sign the Settlement Agreement, would be based on the Consent of both Parties.

5. Conclusion

To sum up, as the Complaints Processes under current PDPA provided a lot of power and authorities to PDPC, Competent Officer and the Data Subject, leads to various issues as defined above. In contrast, PDPA’s Complaints Processes does not provide any right for the Data Controller and the Data Processor during the Processes of Complaints, instead, they have a lot of duties to comply, even though the dispute could be the settled proceeded by the mediation processes, and it would also be a benefit of Data Subject, if the dispute could be settled within mediation processes, as any personal data would not be distributed more.

At the end of this chapter, if there is any possibility in the future to have mediation processes in PDPA, in order to comply with impartiality and independence principle, the member of Mediation Committee should not be the same as the member in PDPC.

– END –

• [1] Contract Farming Promotion and Development Act. B.E. 2560
• [2] Thai’s PDPA, Section 72 (3)
• [3] Thai’s PDPA, Section 73
• [4] Thai’s PDPA, Chapter 5
• [5] Dispute Mediation Act Chapter 2 and 3
• [6] Dispute Mediation Act Chapter 2 Part 1 Section 20
• [7] Dispute Mediation Act Section 20
• [8] Dispute Mediation Act Chapter 3 Section 35
• [9] Dispute Mediation Act Section 35 (1)
• [10] Korean’s PIPA, Chapter 6, Article 40-50
• [11] Korean’s PIPA, Article 43
• [12] Korean’s PIPA, Article 46
• [13] Korean’s PIPA, Article 47 (1)
• [14] Korean’s PIPA, Article 45
• [15] Korean’s PIPA, Article 47
• [16] Thai’s PDPA, Section 76 Paragraph 2

---

For further information, please contact THAC!

---