คอร์สเรียน PDPA พรบ.คุ้มครองข้อมูลส่วนบุคคล EP.2 ความหมายของ PDPA คืออะไร

Summary

This transcript discusses the concepts of data control and privacy laws, focusing on the Personal Data Protection Act (PDPA). It explains how organizations or individuals acting as Data Controllers manage personal data and the importance of consent from Data Subjects (owners of the data). The conversation highlights how many users unknowingly agree to terms and conditions by simply ticking 'accept' without fully understanding the implications of their data being used. It also touches on the legal obligations of Data Controllers and the transparency required under Thai law regarding data collection and usage.

Takeaways

• 😀 The Personal Data Protection Act (PDPA) regulates the protection of personal data.
• 😀 A Data Controller refers to a person or entity that controls personal data, including companies and website owners.
• 😀 When registering for online services (e.g., email or website accounts), the service provider acts as the Data Controller.
• 😀 Personal data cannot be collected, used, or disclosed without consent from the Data Subject (the person to whom the data belongs).
• 😀 In Thailand, the Data Subject is the individual whose personal information is being collected.
• 😀 Users often encounter long privacy policies that they accept without fully reading or understanding them.
• 😀 Pressing 'accept' on privacy policies is considered giving consent for data collection and usage.
• 😀 If users do not consent by pressing 'accept,' they cannot use the services provided by the website or application.
• 😀 The law requires that the purpose of collecting personal data must be clearly stated at the time of collection.
• 😀 Section 19 of the PDPA outlines that data can only be used for the specified purpose stated in the notification.
• 😀 The Data Controller cannot use, disclose, or collect data beyond the purpose outlined in the notification under Section 21 of the law.

Q & A

What is the role of a Data Controller according to the transcript?

A Data Controller is a person or legal entity that controls the collection, use, and disclosure of personal data. They are responsible for ensuring that personal data is handled according to the law.

Who is considered a Data Subject in the context of PDPA?

A Data Subject is the individual whose personal information is collected, used, or disclosed. In Thai law, this person is also referred to as the data owner.

What does the transcript suggest about online account registration and data collection?

When registering for online accounts or services, users provide personal information to the Data Controller. Consent is required for this collection, even if users quickly accept terms and conditions without reading them.

How does consent from the Data Subject work under PDPA?

Consent is given when a Data Subject agrees to allow the Data Controller to collect, use, or disclose their personal information. Simply pressing 'accept' in an application can indicate this consent.

What does Section 19 of the PDPA require?

Section 19 requires that the purpose of collecting or using personal data must be clearly stated. The Data Controller cannot use personal data for purposes not disclosed to the Data Subject.

What is the significance of Section 21 as mentioned in the transcript?

Section 21 relates to notifications about personal data usage. Once a Data Subject accepts, it allows the Data Controller to use the information within the stated purposes. Without acceptance, the data cannot be used.

What potential problem arises when users quickly accept terms without reading them?

Users may unintentionally give consent to data collection and usage they do not fully understand, effectively allowing the Data Controller to access and control their personal information.

How does the PDPA affect cross-border data use?

The PDPA applies to personal data both inside and outside the country. Data Controllers must comply with the law even if the data is stored or processed in another country.

Why is it important for the Data Controller to disclose the purpose of data collection?

Disclosing the purpose ensures transparency, allows the Data Subject to make informed decisions, and prevents misuse of personal data. It is a legal requirement under PDPA.

What is the general warning the transcript gives about personal data in apps and websites?

The transcript warns that personal data is often collected automatically when users accept terms in apps or websites. Users should be aware that pressing 'accept' is legally giving consent for their data to be used.