Thailand’s Electronic Transaction Development Agency (ETDA) has released two new subordinate regulations under the Royal Decree on Digital Platform Services: one detailing the assessment of digital platform services (DPSs) that will be deemed “high-risk” and subject to additional obligations, and another setting guidelines on user verification and authentication for all DPSs.
The two subordinate regulations are summarized below.
Impact Assessment of DPS Operations
Under the Royal Decree on Digital Platform Services, DPS operations that have the risk of seriously impacting financial and commercial security, reliability and credibility of data message systems, or the general public are subject to additional obligations. The first subordinate regulation mentioned above (officially titled Notification of the Electronic Transactions Commission Re: Criteria for Impact Assessment on Operation of Digital Platform Services) outlines the criteria for the ETDA to determine which DPSs are “high-risk.” DPSs falling under this designation include:
- DPSs whose total value of transactions conducted through the platform in Thailand exceeds THB 100 million (approx. USD 2.8 million) per year;
- DPSs whose operators have not registered their entities with the Department of Business Development (DBD)—notably overseas operators—and that have 100 or more merchants or business users in Thailand or total users in Thailand between 5 and 10 percent of the country’s population (i.e., approx. 3.3–6.1 million users, calculated using official 2022 figures);
- DPSs that allow their users to freely post certain messages, or do certain acts, that may affect the public in certain cases, such as: (1) unlawful messages or acts; (2) messages or acts that may affect a child’s rights or people’s fundamental rights; and (3) messages or acts that may negatively affect political opinions of Thai citizens (whether before or after an election) or statements or actions likely to negatively affect other individuals due to gender differences or sexual violence.
After considering these criteria and the details provided by DPS operators when notifying the ETDA, the ETDA will announce a list of the types or names of “high-risk DPSs.”
According to the Royal Decree on Digital Platform Services, the high-risk DPSs must:
- Conduct risk assessments;
- Implement risk management measures;
- Conduct hearings for changes to terms and conditions for providing the DPS;
- Report on their compliance with the above obligations on an annual basis; and
- Comply with other obligations to be prescribed by the ETDA.
Identification and Verification
The second subordinate regulation (Notification Re: Manual for Identification and Verification Process) prescribes the manual and standards for the identification and verification of DPS users. The manual serves as a guideline for DPS operators on verifying and authenticating the identity of high-risk or potentially impactful users. This may include users who have greater access rights or the ability to access more features than regular users, users with numbers of followers exceeding a defined threshold (e.g., more than 5,000 followers), and users with transaction volumes or frequencies exceeding specified limits (e.g., a total transaction value of more than THB 50,000 per month).
DPS operators should comply with the identity verification and authentication requirements for user registration on digital platforms by at least undertaking the following:
- Verifying the identity of applicants for DPS user registration. Information for verifying the identity of service applicants should be from the results of identity verification by identity providers (IDPs) that have previously verified the individual’s identity (such as verifying the Thai ID card information issued by the Ministry of Interior). IDPs should support at least identity assurance level 2 (IAL2).
- Collecting user data. For the purpose of verification and authentication, DPS operators should collect data such as name and surname, ID card number or passport number, and contact details of individual users (or for corporate entities, name of the company, corporate registration number, and name of any authorized persons). DPS operators should collect additional user data as appropriate to the nature of their DPS. For example, digital platforms categorized as online marketplaces may collect electronic commerce registration numbers.
- Determining the access rights and features accessible on the platform. DPS operators should specify the access rights and accessible features for users based on the level of identity verification and authentication or based on the user data collected. Users who have undergone identity verification and authentication at a higher level may be granted greater access rights and more accessible features.
- Displaying symbols or statements confirming identity verification and authentication. DPS operators should have a “verified” badge indicating that a user has completed identity verification using the methods defined by the DPS operator. The badge should be a clear and easily accessible and understandable symbol or statement. The display format should be adaptive to different screen sizes.
- Confirming the identity of users accessing the DPS. DPS operators should ensure that the identity verification of users logging in to the DPS achieves a reliability level of at least authentication assurance level 2 (AAL2) or rely on the results of identity verification obtained from another IDP that has previously verified the individual’s identity.
