1. Introduction

Consumer Data Commercialization Claims in Thailand concern disputes arising when businesses collect, process, analyse, transfer, disclose, license, sell, or commercially exploit consumers' personal data without proper legal authority or in violation of consumer rights.

Consumer data has become an important commercial asset for:

Targeted advertising and behavioural marketing.

Customer profiling and predictive analytics.

Commercial data-sharing arrangements.

Financial credit scoring and risk assessment.

E-commerce personalisation.

Artificial intelligence and machine-learning applications.

Loyalty programmes and consumer purchasing analytics.

Cross-border data transfers and data brokerage.

However, the commercial value of personal information does not mean that businesses acquire unrestricted ownership over it. Thai law recognises personal data protection, privacy, contractual fairness, consumer protection, and civil liability as important safeguards.

The principal legal framework includes the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the Civil and Commercial Code, the Consumer Protection Act B.E. 2522 (1979), and relevant electronic-transactions and sector-specific legislation.

A central legal question is whether a business can commercially exploit consumer information beyond the purpose for which it was originally collected.

2. Legal framework governing consumer data commercialization

A. Personal Data Protection Act B.E. 2562 (2019)

The PDPA is the primary legislation governing personal data commercialization in Thailand.

Important provisions include:

Commercial data exploitation must therefore satisfy applicable requirements concerning lawful processing, transparency, purpose limitation, security, and data-subject rights.

B. Civil and Commercial Code

The Thai Civil and Commercial Code provides additional remedies where data commercialization causes contractual or non-contractual harm.

Important principles include:

Section 420: Liability for wrongful acts (tort).

Section 421: Exercise of rights contrary to their proper purpose.

Section 423: Liability for defamatory or harmful statements.

Sections 587 onwards: Hire of work and related contractual obligations.

Section 386 onwards: Rescission and termination of contracts, subject to applicable conditions.

Section 438: Court determination of damages arising from wrongful acts.

For example, where a company unlawfully sells customer information and causes financial or reputational harm, a claimant may potentially pursue civil remedies alongside PDPA remedies.

C. Consumer Protection Act B.E. 2522 (1979)

The Consumer Protection Act may apply where consumer-facing businesses use misleading representations, unfair advertising, or deceptive contractual conditions to obtain permission for commercial data exploitation.

Relevant protections include:

Protection against misleading advertising.

Protection against unfair contractual conditions.

Rights concerning accurate consumer information.

Remedies for deceptive commercial practices.

D. Electronic Transactions Act B.E. 2544 (2001)

Electronic transactions frequently involve consumer profiling, digital consent, electronic records, and online commercial contracts.

The legislation provides legal recognition for electronic transactions and electronic signatures. However, the validity of an electronic transaction does not automatically establish that every subsequent use of personal data is lawful under the PDPA.

3. Main types of consumer data commercialization claims

A. Unauthorized sale of consumer personal data

This occurs when a business sells customer databases, contact details, financial information, or purchasing histories to third parties without a valid legal basis.

Examples include:

Selling customer telephone numbers to marketing agencies.

Selling financial profiles to insurance intermediaries.

Transferring customer databases to advertising companies.

Selling consumer purchasing histories to data brokers.

Commercially exploiting customer information collected through loyalty programmes.

Legal issues:

Whether the original collection had a lawful basis.

Whether the consumer was properly informed.

Whether the subsequent disclosure was compatible with the original purpose.

Whether consent was freely given where consent is relied upon.

Whether the business obtained unlawful commercial benefits.

Whether the consumer suffered financial, psychological, or reputational harm.

Section 27 of the PDPA is particularly important because personal data cannot generally be used or disclosed for purposes beyond the applicable lawful basis and statutory exceptions.

B. Consumer profiling and behavioural advertising

Businesses increasingly analyse personal information to predict consumer behaviour and determine advertising strategies.

For example, an e-commerce platform may analyse:

Search histories.

Online purchases.

Browsing activities.

Location information.

Shopping preferences.

Previous interactions with advertisements.

The resulting profiles may be commercially valuable to advertising networks.

A claim may arise when profiling involves undisclosed purposes, unlawful disclosure, excessive collection, or processing without an applicable lawful basis.

C. Commercial exploitation of sensitive personal data

Section 26 of the PDPA provides enhanced protection for sensitive personal data.

This includes information concerning:

Racial or ethnic origin.

Political opinions.

Religious or philosophical beliefs.

Health information.

Disability.

Criminal records.

Genetic data.

Biometric data.

Sexual behaviour.

For example, an insurance company that commercially exploits medical information obtained during an insurance application may face liability if the processing lacks an applicable statutory basis.

D. Unlawful commercialization through third-party processors

Businesses frequently outsource customer-data processing to:

Marketing companies.

Cloud-service providers.

Payment processors.

Customer relationship management companies.

Advertising platforms.

Data analytics companies.

The controller cannot simply avoid responsibility by transferring operational activities to another company.

Sections 37 and 40 of the PDPA establish important responsibilities for controllers and processors respectively.

E. Commercial misuse of loyalty-programme information

Loyalty programmes collect substantial quantities of consumer information.

A supermarket, shopping centre, airline, or online retailer may collect purchasing preferences and transaction histories to develop commercial profiles.

Potential claims include:

Unauthorised disclosure of membership information.

Use of customer data for unrelated marketing.

Unlawful sharing with affiliated companies.

Failure to honour valid withdrawal requests.

Retention of personal data beyond the necessary period.

F. Cross-border commercialization of consumer information

International companies may transfer Thai consumers' information to overseas advertising networks, analytics providers, or cloud platforms.

Sections 28 and 29 of the PDPA regulate cross-border transfers.

A commercial data-transfer arrangement may create liability where the statutory transfer requirements, applicable safeguards, or relevant exceptions are not satisfied.

4. Important case laws and enforcement decisions

Important distinction concerning Thai precedents: Thailand's PDPA is relatively recent, and publicly available judicial decisions specifically addressing consumer-data commercialization remain limited. The available legal literature reports that most PDPA disputes have been dealt with through the Personal Data Protection Committee's Expert Committee rather than publicly reported higher-court judgments. Accordingly, the following list distinguishes actual judicial decisions from regulatory enforcement decisions and analogous Supreme Court authorities. It would be misleading to present all six as Supreme Court judgments.

Chambers and Partners+1

Case 1. Criminal Court decision concerning an insurance company's disclosure of medical information (March 2024)

Subject: Disclosure of sensitive personal data without explicit consent.

Facts:

An individual brought proceedings against an insurance company and its representatives concerning the collection, use, and disclosure of the individual's blood-alcohol test results and a photograph taken during the test.

The information was disclosed to a family member who was the insured party under the insurance arrangement. The disclosure contributed to the rejection of the insurance claim and allegedly caused reputational and personal harm.

Legal issue:

Whether the insurance company could process sensitive personal information without obtaining explicit consent.

Decision:

The Criminal Court dismissed the case. It considered that the processing was necessary for the establishment, exercise, or defence of legal claims under Section 26(4) of the PDPA.

Legal principles:

Explicit consent is not the only possible lawful basis for processing sensitive personal data.

Legal-claims exceptions may justify certain disclosures.

The purpose and necessity of processing must be assessed.

Commercial organisations must distinguish legitimate claims administration from unrelated commercial exploitation.

Relevance: This is particularly relevant to insurance companies, financial institutions, and businesses commercialising consumer health information.

This was a first-instance decision; it should not be treated as a final Supreme Court precedent.

Thailand

Case 2. Supreme Court Judgment No. 4893/2558 (2015)

Subject: Privacy rights and publication of private photographs.

Facts and legal background:

This decision concerned the publication of private photographs of individuals without their consent.

Legal issue:

Whether unauthorised publication of private images could constitute a wrongful act under Section 420 of the Civil and Commercial Code.

Legal principle:

The decision recognised the protection of privacy as a legally protected interest and treated unauthorised publication as potentially constituting a tort.

Relevance to consumer data commercialization:

The reasoning is relevant by analogy where companies:

Commercially distribute consumer photographs.

Use personal images in advertisements without proper authorisation.

Publish customer identities for promotional purposes.

Transfer identifiable consumer information to marketing companies.

A company cannot automatically treat information obtained through one commercial interaction as unrestricted advertising material.

This is a general privacy and tort authority, not a PDPA data-sale judgment.

ThaiLawOnline

Case 3. Supreme Court Judgment No. 1808/2561 (2018)

Subject: Concealment of material information in a consumer transaction.

Facts:

The dispute involved the sale of property where important information concerning expropriation was concealed from the purchaser.

Legal issue:

Whether concealing material information in a commercial transaction could constitute a wrongful act under Section 420.

Legal principle:

The judgment illustrates that concealing material facts in a commercial relationship may create civil liability.

Relevance to data commercialization:

The reasoning can be applied by analogy where:

An online business conceals the actual purpose of collecting customer data.

A company represents that information is collected only for service delivery but subsequently exploits it commercially.

A platform fails to disclose material information about third-party data sharing.

A consumer enters a transaction based on misleading privacy representations.

Importance: Commercial transparency is relevant not only to the underlying transaction but also to the representations through which consumer information is obtained.

ThaiLawOnline

Case 4. PDPC Expert Committee decision concerning an insurance company's unsolicited marketing

Subject: Collection of consumer information from another source and unsolicited insurance marketing.

Facts:

A consumer complained that an insurance company contacted him to promote its products without permission.

The consumer requested information about how the company had obtained his personal information and asked the company to stop contacting him.

The company had apparently obtained the information from another source before the PDPA became fully effective.

Decision:

The Expert Committee identified non-compliance concerning:

Collection of personal data from another source.

Failure to provide an effective withdrawal mechanism under the transitional provisions.

Failure to properly address the consumer's requests for access, rectification, and deletion.

The Committee ordered the company to delete the complainant's data, take measures to suppress the damage, improve its compliance procedures, and report its corrective actions.

Legal principles:

Previously acquired consumer information is not automatically exempt from the PDPA.

Consumers retain relevant statutory rights.

Commercial marketing cannot disregard valid withdrawal requests.

Businesses must establish lawful procedures for using purchased customer lists.

Relevance: This is directly connected with consumer data brokerage and commercialization.

Tilleke & Gibbins

Case 5. PDPC decision concerning an insurance company's marketing-information purchase

Subject: Commercial acquisition of consumer information.

Facts:

An insurance company had obtained personal information through a marketing-information sales arrangement entered into before the PDPA became fully effective.

The information had originated from an external source.

Legal issue:

Could the company continue using purchased consumer information without providing the required notification and withdrawal arrangements?

Decision:

The PDPC determined that the company could not rely merely on the fact that the information had been acquired before the PDPA's full implementation.

It required compliance with Section 25, including the applicable notification and consent requirements for information collected from another source. It also emphasised the availability of an easy withdrawal mechanism under Section 33.

Legal principles:

Purchased personal data remains subject to data-protection requirements.

A commercial purchase agreement does not itself establish a lawful basis for subsequent processing.

Data brokers and purchasers must examine the legal circumstances of collection.

Existing databases must be brought into compliance.

Relevance: This is one of the most directly relevant regulatory decisions for claims involving commercial customer databases.

Nishimura & Asahi

Case 6. PDPC decision concerning consent requirements in a mobile banking application

Subject: Consent obtained through digital financial services.

Facts:

A consumer complained that a mobile banking application did not allow consent to be given freely.

The complaint concerned the format and conditions of the application's consent requests, including access involving the banking service provider and affiliated companies.

Legal issue:

Whether a banking application could make consent a condition of accessing its services when the relevant data processing was not strictly necessary for the contractual service.

Decision and regulatory response:

The Expert Committee required the banking company to amend its consent arrangements to comply with Section 19.

Legal principles:

Consent must be freely given.

Consent should not be unnecessarily bundled with service agreements.

Commercial sharing with affiliated companies requires an appropriate legal basis.

Digital consent mechanisms must provide meaningful consumer choice.

Relevance: The decision is significant for fintech companies, digital banks, payment platforms, and businesses using consumer information for cross-selling.

Nishimura & Asahi

Case 7. PDPC enforcement concerning a government web application and the sale of leaked data

Subject: Commercial resale of personal data following a cybersecurity breach.

Facts:

A government web application was compromised, resulting in the personal information of more than 200,000 individuals being exposed and subsequently offered for sale on the dark web.

The investigation identified shortcomings including:

Weak passwords.

Inadequate security measures.

Insufficient risk assessment.

Lack of appropriate review of security arrangements.

Inadequate contractual arrangements with the external software developer.

Decision:

The data controller and the external software developer, acting as processor, were each fined THB 153,120.

Legal principles:

Controllers must implement appropriate security measures.

Outsourcing does not remove the need for processor oversight.

Security failures can create substantial liability even where the commercial resale is undertaken by an unauthorised third party.

Relevance: This case demonstrates the relationship between data commercialization, cybersecurity, processor responsibility, and civil claims for resulting harm.

bdo.th+1

Case 8. PDPC enforcement concerning a private hospital's disposal of patient records

Subject: Commercial and unauthorised use of personal records.

Facts:

A private hospital engaged an external contractor to destroy patient records.

Instead of properly destroying the documents, the contractor mishandled them, and patient records were reused as food wrappers. Information relating to more than 1,000 individuals became publicly exposed.

Decision:

The hospital received an administrative fine of THB 1,210,000, while the contractor received a fine of THB 16,940.

Legal principles:

Controllers must ensure appropriate safeguards for outsourced operations.

Confidential records must be securely destroyed.

Health information requires special protection.

Contractors and processors may face liability for failures within their responsibilities.

Relevance: The decision is important for businesses that commercialise health-related consumer data, particularly hospitals, insurance companies, medical platforms, and health-data analytics providers.

Chambers and Partners+1

Case 9. PDPC enforcement concerning a collectible-toy retailer and its reservation-system processor

Subject: Commercial customer database security and processor accountability.

Facts:

A collectible-toy retailer used an external processor to operate its reservation system.

The system was compromised for a short period, resulting in unauthorised amendments to approximately 200,000 records.

Decision:

The PDPC imposed:

THB 500,000 on the retailer.

THB 3 million on the external processor.

Legal principles:

Commercial platforms must supervise outsourced processing.

Processors must maintain adequate security controls.

Controllers and processors have separate statutory responsibilities.

Customer reservation information must be protected against unauthorised modification and misuse.

Relevance: The decision is particularly useful for online retailers, loyalty programmes, ticketing services, and subscription platforms.

Chambers and Partners

5. Civil liability and remedies available to consumers

A. Compensation under Section 77 of the PDPA

Section 77 provides that a data controller or processor whose non-compliant processing causes damage to a data subject must compensate that person.

Importantly, liability does not depend on proving that the controller or processor acted intentionally or negligently.

Potential compensable losses include:

Financial loss resulting from identity theft.

Loss caused by fraudulent use of personal information.

Necessary expenses incurred to prevent or mitigate damage.

Loss arising from unauthorised disclosure.

Other legally established damage resulting from unlawful processing.

The statutory exceptions include damage resulting from force majeure or the data subject's own act or omission, and processing carried out in compliance with a lawful official order.

B. Punitive damages under Section 78

Section 78 gives courts the power to award punitive damages in addition to actual compensation, up to twice the actual compensation amount.

Relevant considerations include:

Severity of the damage.

Commercial benefits obtained by the company.

Financial position of the controller or processor.

Corrective measures taken.

Contribution of the data subject to the damage.

Example:

Suppose an online retailer unlawfully sells a customer's personal information, causing THB 100,000 in established actual damages.

A court could potentially award:

Actual compensation: THB 100,000.

Additional punitive damages: up to THB 200,000.

Maximum combined award: THB 300,000.

This is an illustration, not an automatic award.

Thailand Law Library+1

C. Compensation under Section 420 of the Civil and Commercial Code

A consumer may also consider a tort claim under Section 420 where the conduct constitutes an unlawful infringement of another person's rights and causes damage.

For example, a marketing company obtains customer information from an online retailer and sells it to multiple advertisers without proper authority.

Potential claims may concern:

Invasion of privacy.

Unlawful disclosure.

Financial injury.

Reputational harm.

Other legally recognised damage.

The availability of concurrent claims and compensation must be assessed carefully to avoid double recovery for the same injury.

D. Right to access and obtain information

Section 30 provides a right of access to personal data and the right to request a copy, subject to statutory exceptions.

This can help consumers establish:

What information was collected.

Whether personal information is being processed.

Which organisations hold the information.

Whether information has been used unlawfully.

E. Right to deletion or destruction

Section 33 recognises the right to request erasure or destruction of personal data in specified circumstances.

This is particularly relevant when a company retains customer information after the original commercial purpose has ended or when the data subject has validly withdrawn consent and no other lawful basis applies.

F. Right to object

Section 32 gives data subjects the right to object to certain processing activities.

This is particularly important where consumer information is used for direct marketing.

A business must properly address applicable objections and cannot simply disregard a consumer's decision to stop the relevant marketing use.

G. Right to lodge a complaint

Section 73 provides a mechanism for lodging complaints with the relevant Personal Data Protection Committee mechanisms.

Consumers may seek regulatory intervention where a company:

Sells personal information unlawfully.

Refuses to respect data-subject rights.

Uses information for undisclosed purposes.

Fails to maintain appropriate security measures.

6. Collective consumer litigation and class actions

Consumer data commercialization frequently affects thousands of individuals simultaneously.

For example, an online shopping company may disclose a customer database containing 500,000 telephone numbers and purchasing histories.

Individual litigation may be difficult because each consumer may suffer relatively small or difficult-to-quantify losses.

Thailand's class-action framework under the Civil Procedure Code provides an important collective-redress mechanism.

Potential claimants may seek collective proceedings where the statutory requirements are met.

Important issues include:

Common questions of fact and law.

Common unlawful data-processing practices.

Identification of the affected consumer group.

Commonality of the legal remedies sought.

Adequate representation of the class.

Appropriate calculation of individual and collective damages.

Class actions may be particularly relevant to:

Data-broker activities.

Mass marketing database sales.

E-commerce information disclosures.

Unauthorised financial profiling.

Large-scale customer-data breaches.

7. Commercial sectors exposed to consumer data claims

8. Defences available to businesses

A company facing a consumer data commercialization claim may raise several legal defences.

1. Valid consent

The company may establish that the consumer gave valid, informed, and freely given consent for the relevant processing.

Consent must cover the relevant purpose; permission for one activity does not automatically authorise unrelated commercial exploitation.

2. Contractual necessity

A company may rely on Section 24 where processing is necessary for performing a contract to which the data subject is a party or for taking steps at the data subject's request before entering into a contract.

However, unrelated advertising or data resale cannot automatically be classified as contractually necessary.

3. Legitimate interests

Section 24 recognises legitimate interests as a possible lawful basis, subject to the applicable balancing requirements and statutory protections.

A company must consider whether its commercial interests are outweighed by the fundamental rights of the consumer.

4. Legal obligations

Processing may be lawful where necessary to comply with applicable legal obligations.

5. Legal claims

Section 26(4) may permit certain processing of sensitive personal data where necessary for the establishment, exercise, or defence of legal claims.

6. Force majeure or consumer contribution

Section 77 provides limited statutory exceptions to civil liability where the relevant damage results from force majeure or the data subject's own act or omission.

These defences are fact-dependent and do not provide a general exemption for commercial data sales.

9. Criminal and administrative consequences of unlawful data commercialization

Civil liability is not the only consequence of unlawful commercial exploitation of consumer information.

A. Criminal liability

The PDPA provides criminal penalties for specified unlawful uses and disclosures, particularly involving sensitive personal data and improper commercial benefits.

The Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes (No. 2), B.E. 2568 (2025), also strengthens the legal response to unlawful exploitation of personal data, including certain illegal data-sale activities.

Accordingly, businesses and individuals involved in unauthorised personal-data markets may face criminal exposure in addition to civil and administrative proceedings.

Country Comparative Guides+1

B. Administrative penalties

The PDPC can impose administrative penalties for statutory violations.

The relevant maximum administrative fines under the PDPA depend on the particular provision and violation, with certain offences attracting fines of up to THB 5 million.

Regulatory enforcement can also require corrective action, including improvements to security, processing procedures, and data-subject rights mechanisms.

C. Corporate responsibility

Corporate responsibility may extend to:

Data controllers.

Data processors.

Commercial data brokers.

Marketing intermediaries.

Outsourced technology providers.

Businesses controlling customer databases.

The precise liability of each participant depends on its statutory role, conduct, and applicable legal obligations.

10. Practical examples of consumer data commercialization disputes

11. Major legal challenges in Thailand

1. Difficulty establishing actual damages

Consumers may struggle to quantify financial and non-financial harm caused by the commercial exploitation of their personal information.

2. Complex data-broker networks

Information can pass through several intermediaries, making it difficult to identify the original source and responsible parties.

3. Cross-border enforcement

Overseas advertising companies and data analytics providers can make investigations and enforcement more complicated.

4. Artificial intelligence and predictive profiling

AI systems may generate commercially valuable consumer predictions using information obtained from multiple sources. Determining the lawful basis and responsibility for such processing can be difficult.

5. Inadequate transparency

Consumers may not understand how their information is transferred, analysed, or monetised.

6. Limited judicial precedent

The relatively recent implementation of the PDPA means that the number of publicly available judicial decisions specifically concerning personal-data commercialization remains limited.

12. Suggestions for legal and regulatory reform

Thailand could strengthen its consumer data protection framework through:

More specific transparency requirements for commercial data-sharing arrangements.

Stronger oversight of professional data brokers.

Clearer rules governing the monetisation of consumer profiles.

Improved consumer access to information about third-party disclosures.

Stronger safeguards for children's personal information.

More effective cross-border enforcement cooperation.

Greater availability of collective consumer remedies.

Improved judicial and regulatory guidance concerning AI-based profiling.

Mandatory due diligence for businesses purchasing consumer databases.

Stronger accountability for commercial intermediaries.

13. Conclusion

Civil Law and Consumer Data Commercialization Claims in Thailand represent an increasingly important area of civil liability, consumer protection, and digital commercial regulation.

The Personal Data Protection Act B.E. 2562 (2019) provides the principal statutory framework by regulating collection, use, disclosure, processing, and commercial exploitation of personal information.

Sections 77 and 78 are particularly important because they provide compensation and punitive-damages mechanisms for consumers harmed by unlawful personal-data processing.

The Civil and Commercial Code, particularly Section 420, provides additional protection against wrongful conduct, while the Consumer Protection Act addresses misleading commercial representations and unfair consumer practices.

The judicial decision concerning insurance-related disclosure of sensitive personal information, Supreme Court Judgment Nos. 4893/2558 and 1808/2561, and the PDPC enforcement decisions involving insurance marketing, banking applications, government databases, hospitals, and online retailers provide useful legal guidance.

The central legal principle is that consumer information is not an unrestricted commercial commodity. Businesses may derive economic value from personal information only within the boundaries of applicable legal authority, transparency, purpose limitation, and consumer rights.

Research qualification: The nine decisions discussed above include judicial decisions and regulatory enforcement matters. They should not all be described as binding court precedents. Thailand does not presently have six publicly established Supreme Court judgments specifically addressing consumer-data commercialization. Distinguishing actual judicial authorities from regulatory decisions is essential for accurate legal research.