Conventus Law

Conventus Law

by

On November 14, 2023, Thailand’s Personal Data Protection Committee (PDPC) published a draft notification on collection of personal data regarding criminal records. The draft notification aims to provide clarifications and prescribe further criteria for processing criminal record data under the Personal Data Protection Act (PDPA), which generally requires the processing of criminal records to be carried out under the control of the relevant official authority under the law or under a data protection measure implemented according to rules prescribed by the PDPC.

After its eventual passage, the draft notification will have important implications for businesses’ recruitment and human resources activities in relation to individuals with criminal records.

Key aspects of the draft notification include the following:

  • “Personal data regarding a criminal record” and “criminal record data” denote personal data related to the investigations of criminal offenses, criminal prosecution, or criminal punishment that is official information or certified by the relevant supervisory authority, regardless of whether that action is connected to a final judgment.
  • Under the draft notification, data controllers may process criminal record data for the purpose of a recruitment process, checking the qualifications of personnel, and considering the suitability of a person for a position if the processing activities are required by law or when a data controller obtains explicit consent from the data subject. Furthermore, the necessity of processing the criminal record data must be announced at the beginning of the recruitment process.
  • Data controllers’ requests for explicit consent to collect a data subject’s criminal record data must also notify the data subject of the consequences of not providing consent or withdrawing consent.
  • The draft notification sets the allowable retention period for criminal record data at a maximum of six months from the end of the processing activities specified above. After the retention period ends, the criminal record data must be deleted, destroyed, or anonymized using an appropriate method.

The draft notification is open for a public hearing period until November 28, 2023.

WRITTEN BY

Tilleke & Gibbins
For further information, please contact:

Athistha (Nop) Chitranukroh – Tilleke & Gibbins, Tilleke & Gibbins
nop.c@tilleke.com

Athistha (Nop) Chitranukroh – Tilleke & Gibbins

Nop Chitranukroh, a partner at Tilleke & Gibbins, leading technology and insurance teams, with expertise in regulatory compliance and recognized as a top practitioner in insurance and TMT law.

Nop Chitranukroh is a partner and director of Tilleke & Gibbins’ corporate and commercial group. She leads the firm’s technology and insurance teams, and regularly advises clients across industries on a wide range of regulatory compliance matters relating to cybersecurity and data privacy, fintech, insurance, insurtech, and payments. She also represents multinational and local financial services, payments, and technology industry clients on a range of strategic matters, including market entry, M&As, and ongoing compliance across Southeast Asia.

Prior to joining Tilleke & Gibbins, Nop served as Thailand general counsel of an American multinational corporation, listed on the New York Stock Exchange, where she oversaw all operations within the legal department in Thailand. Nop was previously Asia-Pacific regional counsel for the same multinational finance and insurance corporation, based in Singapore. She has also served as a legal counsel at an industry-leading Irish-American financial services and software-as-a-service (SaaS) provider of payment processing software and related application programming interfaces (APIs) for e-commerce websites and mobile applications.

Widely recognized as a top practitioner in insurance and TMT legal practice in Southeast Asia, Nop is ranked as a leading lawyer in both technology and insurance industries in Thailand by Chambers Asia-Pacific, and has been identified as a Next Generation Partner in TMT by The Legal 500. She was named one of the Asia’s top 40 lawyers under 40 by Thomson Reuters’ Asian Legal Business, and in 2020, she was nominated for Data Privacy Lawyer of the Year (Asia) at the Asian Legal Awards.

Nop is a Certified Information Privacy Professional/Asia (CIPP/A) with the International Association of Privacy Professionals and serves as an advisory board member of Insurtech Asia. She has acted as a legal advisor for the Thailand Insurance Association for more than a decade.

Register for your monthly Asia legal updates from Conventus Law

Error: Contact form not found.

RELATED ARTICLES