Live สัมมนาออนไลน์ “PDPA กับเรื่องร้องเรียนติดอันดับ”

Main Ideas / Lessons Conveyed

• PDPA is essential in the digital age: Personal data has real value and can be exploited for profit or wrongdoing (e.g., scams, impersonation, identity fraud).

• Personal data can be misused in many ways:

  • Financial harm (fraud, account draining, phishing)
  • Reputational harm (especially when sensitive data is exposed)
  • Identity misuse (using copies of ID documents, bank books, receipts, etc.)
  • Targeted fraud by criminals using information about people’s habits or situations

• “Personal data” definition emphasized: Data that can identify an individual (directly or indirectly). The video gives examples such as age plus identifying context, and other data points tied to a person.

• “Data breach” and responsibility: When an organization collects personal data but fails to protect it (leaks, improper sharing), the data owner becomes a victim and can file a complaint.

• Organizations must comply:

  • They must collect/use data for legitimate purposes.
  • They must protect it and prevent leakage.
  • They must provide proper information when handling complaints.

• Complaints can be filed through PDPA mechanisms:

  • The PDPA Center provides consultation and receives complaints.
  • Complaints are reviewed through internal steps before expert committee decisions.

• Enforcement / decision steps:

  • An initial review checks completeness/accuracy and whether it fits PDPA scope.
  • The complainant/respondent may be asked for clarifications.
  • Decisions are ultimately made by the expert committee.

• Enforcement outcomes include orders and penalties:

  • Orders can range from warnings to more serious administrative actions.
  • Penalties may include administrative fines and (in some cases) civil/criminal liability.

• Prevention is repeatedly stressed: The audience is urged to be cautious, share less, verify requests, and gather evidence if misuse happens.

---

Methodology / “How-To” Instructions (Detailed Bullets)

A) What Individuals Should Do to Protect Themselves (Prevention)

• Avoid clicking suspicious links:

  • Banks/government agencies typically don’t ask you to reset passwords via random links.
  • If a link looks unusual, stop and verify through official channels.

• Share only necessary information:

  • Don’t give extra data “just because” a form asks.
  • If asked for unusually sensitive or excessive fields (e.g., unrelated family salary/ID details), consider refusing and seeking guidance.

• Be skeptical of impersonation:

  • Check whether a website/agent actually belongs to the real organization.
  • Look for signs of scam pages that mimic government or official sites.

• Do not assume permission covers all future uses:

  • Consent must be specific; customers/data owners can later object/veto or revoke consent depending on the case and PDPA rules.

• If you suspect misuse, collect evidence quickly:

  • Take screenshots/photos of messages, receipts, links, and transfers.

• Cross out or redact ID card copies when appropriate:

  • The video recommends covering/redacting parts (e.g., value/unused fields) and leaving only what is necessary for the stated purpose.

• If a scam happens, act immediately:

  • Block numbers/accounts used by scammers.
  • Consider reporting and update identifiers if needed (e.g., replacing compromised ID).

---

B) How to File a Complaint / Seek Help (PDPA Process)

• Use PDPA Center channels:

  • Online/website filing (site referenced: pdpc.or.th)
  • Email (mentioned as a common pathway)
  • Postal service (also mentioned)
  • In-person consultation (walk-in / contact staff)
  • LINE contact: LINE @pdpc Thailand (also “pdpc Thailand” mentioned in multiple places)

• Before filing, ensure the complaint is “complete and accurate”:

  • Provide facts, documents, and clear details.
  • Include who the data controller/organization is, what data was compromised, and what violation occurred.

• After submission, expect staged review:

  • If incomplete/inaccurate: the office may request clarification or you may need to supplement/redo parts.
  • If the complaint is preliminarily valid: it proceeds toward expert committee consideration.

• If the complaint advances to review:

  • The respondent may be notified and required to provide information.
  • The expert committee issues a decision/order if warranted.

---

C) What Organizations Should Do to Comply (Implied Guidance)

• Have proper data governance:

  • Protect data with appropriate controls so leaks don’t occur.

• Use data only for declared purposes:

  • Don’t collect “more than needed.”

• Secure data handling and transfers:

  • Avoid insecure sharing methods (e.g., broad forwarding through chat apps) for large batches of personal data.
  • Use secure/appropriate channels and encryption where applicable.

• Maintain records and evidence:

  • If challenged, the organization must be able to explain lawful basis and data handling history.

---

Key Concepts Explained (As Presented)

• Personal data = valuable and exploitable

  • The video stresses that personal data can be sold/weaponized.

• Sensitive personal data

  • Medical status and health information are treated as especially sensitive.

• Data controller / data owner / roles

  • Individuals are the data owners.
  • Organizations act as data controllers (and have duties).

• Consent and its limits

  • Consent is not unlimited and can be revoked/adjusted under PDPA rules.

• Unfair use = personal gain through customer data

  • Repeated emphasis that using customer data improperly violates privacy rights.

• Examples of common complaint scenarios

  • Telemarketing/cold calls despite objections
  • Sharing salary or employee data internally without protection
  • CCTV cameras capturing more than necessary (including audio)
  • Large-scale leaked datasets (e.g., Excel lists)

---

Case Examples Referenced (High Level)

• International case (celebrity medical result disclosure):

  • A hospital allegedly exposed sensitive health information; fines and legal consequences were discussed.

• Scam cases tied to receipts/receipt numbers & LINE contact:

  • Fraudsters call and guide victims through transfers.

• “Tokyo-style pancakes/banana fritters” bag example:

  • Packaging included copied ID/bank-book data; used to illustrate how personal data can be obtained and then used to commit fraud (e.g., opening accounts).

• Hospital medical record leak / hepatitis B exposure:

  • Medical record contents used for scams (e.g., impersonating hospital/pharmacy to steal money).

• Driver’s license renewal scam (“Ms. A” pseudonym):

  • Victim shares ID photos and then receives pressure to pay/pick up; later realizes it’s a scam.
  • Discusses what to do after suspected PDPA-related exposure.

---

Speakers / Sources Featured

PDPC Thailand / Seminar Hosts and Presenters (Names Given in Subtitles)

• Prim Chanita (host / presenter; sometimes referenced as “Prim”)
• Charoen Ayutthaya (host / presenter)
• Anan (legal officer; complaints department at PDPC)

Experts / Guests

• Assistant / Prof. Dr. Prapanpong Kham-on (legal expert specializing in PDPA-related law)
• Mr. Somphum Sukhanan (legal officer mentioned; appears in connection with the PDPA/complaints department discussion)

PDPC Center / PDPC (Office/Committee Structures)

• PDPA Center (consultation and complaint intake)
• Personal Data Protection Commission (PDPC) / Expert committee (review and orders)

Official Online Presence Referenced

• Facebook Live: PDPC Thailand (viewing platform and campaign)
• Website: pdpc.or.th
• LINE contact: @pdpc Thailand (mentioned)