Interior Ministry under fire for scrubbing contractor details
In a recent development, the Department of Local Administration in Thailand has issued a directive instructing local administrations to remove information about abandoned contractors from their websites, as part of an effort to comply with the Personal Data Protection Act (PDPA).
The PDPA, enacted to safeguard personal data privacy and ensure lawful data processing, imposes strict requirements on the collection, use, disclosure, and retention of personal data. It emphasizes the rights of data subjects to have their information deleted or withdrawn from processing when no longer necessary or when consent is withdrawn.
This action could help improve privacy protection by respecting individuals’ rights to privacy and aligning with PDPA principles such as data minimization and purpose limitation. By removing contractor data that is no longer active or outdated, local administrations can avoid potential fines and legal disputes arising from unlawful publication of personal information, reducing the risk of PDPA violations.
However, this move has sparked controversy. The Anti-Corruption Organisation of Thailand (ACT) has condemned the Interior Ministry's plan to remove information about companies listed as abandoned contractors. ACT President Mana Nimitmongkol stated that this action could benefit wrongdoers and erase traces of failure, rather than revealing the truth to prevent future occurrences.
The lists of abandoned contractors contain sensitive personal data, including corporate registration numbers, names of managing directors or partners, addresses, and national ID numbers. The concern is that the removal of such information might limit transparency and public access to historical administrative data about contractors, potentially affecting public trust or oversight.
It is crucial to balance this need for privacy with the public interest in transparency and accountability. While the PDPA promotes privacy, there is often a need to balance this against legitimate public interest or legal requirements to disclose certain information. The removal should consider if any exemptions or legal obligations require the information to remain accessible.
Local authorities might need to update websites, internal policies, and ensure data retention schedules align with PDPA mandates, including documenting justifications for data removal and managing requests from data subjects exercising their rights.
As May approaches, prioritizing PDPA compliance activities is being emphasized. This development comes amidst ongoing discussions between Thailand and Singapore focusing on a MoU for the digital economy and enforcing the PDPA. Thailand's data is at risk amidst cybersecurity concerns, making compliance with data protection laws increasingly important.
In conclusion, the removal of information about abandoned contractors from local administration websites in Thailand is a complex issue that requires careful management to balance transparency, privacy, and lawful data processing principles. It is essential to ensure that the PDPA is complied with while maintaining a level of transparency necessary for public trust and accountability.
[1] Personal Data Protection Act B.E. 2562 (2019) [3] Department of Local Administration's Instruction Letter, April 2, 2023
- The controversy surrounds the Department of Local Administration's decision to align with the Personal Data Protection Act (PDPA) by removing information about abandoned contractors, as this action might benefit wrongdoers and erase traces of failure, potentially undermining transparency and accountability in the business and politics sectors.
- The economy and crime-and-justice sectors could be affected by the potential reduction in public access to historical administrative data about contractors, as an increase in unlawful publication of personal information could lead to PDPA violations and legal disputes.
- General-news outlets should report on this issue, highlighting the need to balance privacy rights with public interest, ensuring compliance with data protection laws, and maintaining a high level of transparency required for public trust and accountability.
