Thai Financial Regulators Join Forces to Ask Banks to Strengthen Personal Data Protection

The BOT (Bank of Thailand), SEC (Securities and Exchange Commission), OIC (Office of the Insurance Commission) and PDPC (Personal Data Protection Commission) have signed an MoU to support the supervision of personal data protection in the financial sector.

Fazzaco Live Webinar on 12th May: Vladimir Moshkov on How to Start a Crypto Exchange from Scratch​

The MoU was signed ahead of 1 June 2022, when Thailand's new PDPA (Personal Data Protection Act) becomes fully enforceable. Last September, the BOT directed banks to prepare for the implementation of the PDPA, which was derived in part from GDPR and enacted in 2019.

The PDPA mandates that data controllers and processors who use personal data must receive consent from data owners and use it only for expressed purposes. The law imposes punishment up to THB 5 million in administrative fines and up to THB 1 million in criminal fines for non-compliance, starting from 1 June.

Under the new MoU, BOT, SEC, OIC  and PDPC will coordinate on the supervision of the financial sector to ensure that governance frameworks for personal data protection are consistent with the PDPA. The MoU supports the exchange of information between the authorities, the development of personnel in the financial sector, and education of financial services users to ensure smooth compliance with the PDPA.

At the signing ceremony, BOT governor Dr Sethaput Suthiwartnarueput emphasised the importance of striking a balance between personal data protection and data utilisation to support the financial sector's development.

He added that personal data protection standards in Thailand needed to be enhanced to drive the country towards a digital economy in the long term, and a financial sector underpinned by open data.

​Dr Suthiwatanaruput open data will enable financial businesses to further develop their services, while also promoting good governance to help mitigate the risks of data sharing. "This MoU helps to ensure supervision and protection of personal data in the financial sector is consistent and not overlapping, reducing the burden and cost for business operators as well as the public."

The BOT has been working with banks to prepare for the implementation of the PDPA. Sethaput said that while banks are prepared to adopt the PDPA policy framework, some non-bank entities still need to improve their personal data protection practices.

Source: Regulation Asia