1. Introduction

Mobility Data Governance Disputes in Thailand concern legal conflicts arising from the collection, processing, storage, sharing, transfer, and commercial use of information generated by transportation systems and mobility technologies.

Mobility data includes information produced by:

GPS-enabled vehicles and navigation systems.

Ride-hailing applications and taxi platforms.

Public transportation smart cards.

Electric vehicle charging networks.

Connected and autonomous vehicles.

Intelligent traffic-management systems.

Vehicle registration and insurance databases.

Logistics and delivery platforms.

Mobile phones and location-tracking applications.

Smart roads, toll systems, and digital parking infrastructure.

In Thailand, mobility data governance intersects with civil liability, contractual obligations, privacy rights, consumer protection, cybersecurity, and administrative regulation.

The central legal issue is determining who may collect, control, access, share, commercialize, and retain mobility data, and who bears legal responsibility when that data is misused or causes harm.

For example, a ride-hailing company may collect a passenger's precise location, journey history, payment details, and travel preferences. If this information is disclosed without a lawful basis, the passenger may have grounds to pursue legal remedies under Thai law.

Thailand does not have one comprehensive statute exclusively governing mobility data. Instead, several existing legal frameworks operate together.

2. Applicable Thai legal framework

A. Personal Data Protection Act B.E. 2562 (2019)

The Personal Data Protection Act (PDPA) is the principal legislation governing personal information generated through mobility systems.

Important provisions include:

Application to mobility disputes:

A transportation application collecting continuous GPS information must identify a lawful basis for processing, explain its purposes, and implement appropriate safeguards.

A company cannot assume that a passenger's acceptance of general application terms automatically authorizes every subsequent use of location data.

B. Electronic Transactions Act B.E. 2544 (2001)

This Act recognizes the legal significance of electronic records and electronic communications.

Relevant provisions include Sections 7–10 and 13–14.

Applications include:

Electronic transportation agreements.

GPS-generated journey records.

Electronic fare receipts.

Digital vehicle rental agreements.

Electronic consent records.

Online insurance and mobility service contracts.

Electronic evidence can be used in civil proceedings, subject to requirements concerning authenticity, integrity, and evidentiary weight.

C. Civil and Commercial Code

The Civil and Commercial Code (CCC) provides the principal foundation for contractual and tortious claims.

Important provisions include:

Section 149: Juristic acts.

Section 150: Invalidity of unlawful juristic acts.

Sections 354–361: Offer and acceptance.

Section 368: Contract interpretation and good faith.

Section 386 onwards: Contract termination.

Section 391: Consequences of termination.

Section 420: Wrongful acts and tort liability.

Section 423: Liability for false statements damaging another person's reputation or interests.

Section 425: Employer liability for employees' wrongful acts committed in the course of employment.

Section 438: Assessment of compensation.

These provisions become relevant where transportation operators breach data-related contractual obligations or misuse personal mobility information.

D. Computer-Related Crime Act B.E. 2550 (2007), as amended

The Computer-Related Crime Act addresses certain forms of unlawful computer-system access, interference, and computer-related offences.

It is relevant where mobility databases are affected by:

Unauthorized access.

Manipulation of GPS records.

Interference with transportation databases.

Unauthorized extraction of information.

Cyberattacks against connected vehicles.

Not every PDPA violation automatically constitutes an offence under this legislation. The elements of the relevant offence must independently be established.

E. Land Traffic Act B.E. 2522 (1979)

The Land Traffic Act provides the regulatory background for road transportation.

It becomes relevant when mobility data is used in:

Traffic enforcement.

Vehicle monitoring.

Road safety management.

Electronic traffic systems.

Vehicle-related investigations.

F. Consumer Protection Act B.E. 2522 (1979)

This Act may apply to disputes involving misleading representations by mobility-service providers, unfair service conditions, undisclosed data practices, and misleading digital advertising.

3. Meaning and classification of mobility data

Mobility data is not a single legal category. Different information types may receive different levels of legal protection.

An important distinction is that anonymized traffic statistics may not be personal data if individuals cannot reasonably be identified. However, location histories that can be connected to identifiable individuals remain potentially protected personal data.

4. Major categories of mobility data governance disputes

4.1 GPS tracking and unauthorized surveillance claims

GPS tracking allows transportation companies to monitor vehicles, passengers, drivers, and delivery personnel.

Disputes may arise when:

Employers continuously monitor drivers outside working hours.

Ride-hailing platforms retain passenger location histories unnecessarily.

Vehicle manufacturers transmit location information without adequate transparency.

Insurance companies collect location information beyond their disclosed purposes.

Individuals use tracking technology to monitor another person's movements without lawful justification.

Under Sections 21, 22, 23, and 24 of the PDPA, the purpose, scope, transparency, and lawful basis of processing must be considered.

A company may have a legitimate basis for tracking a delivery vehicle during working hours, but that does not automatically authorize continuous monitoring of the driver's private movements.

4.2 Ride-hailing platform data disputes

Ride-hailing platforms generate substantial quantities of personal and commercial information.

Potential disputes include:

Unauthorized disclosure of passenger addresses.

Sharing driver information with third parties.

Misuse of customer travel histories.

Algorithmic driver profiling.

Incorrect passenger or driver identity records.

Unlawful retention of location information.

Disputes concerning responsibility between platform operators and third-party processors.

The platform may be a data controller, while a technology contractor providing data-processing services may be a data processor. Their respective responsibilities must be assessed under the PDPA.

4.3 Public transportation smart-card disputes

Thailand's public transportation networks increasingly depend on electronic ticketing and digital payment infrastructure.

Smart-card systems can record:

Passenger entry and exit points.

Journey times.

Travel frequency.

Payment information.

Transfer patterns.

Station usage.

These records can help transportation authorities plan infrastructure and manage congestion.

However, disputes may arise when identifiable travel records are shared with unrelated commercial organizations or retained without an appropriate legal justification.

The key legal question is whether the use of such records is consistent with the original purpose and an applicable lawful basis.

4.4 Connected vehicle data ownership disputes

Connected vehicles generate information about their mechanical condition, driving behavior, location, and operational performance.

Potential conflicts include:

Manufacturers refusing to provide vehicle diagnostic data.

Vehicle owners demanding access to information stored by manufacturers.

Repair workshops seeking access to diagnostic systems.

Insurance companies requesting telematics information.

Commercial competitors extracting vehicle-generated information.

Thai law does not establish a general rule that every item of vehicle-generated data belongs exclusively to the vehicle owner.

Instead, disputes may involve contractual rights, personal data protection, trade secrets, intellectual property, and access rights.

4.5 Mobility data and insurance liability disputes

Insurance companies may use driving data to assess risk and calculate premiums.

Examples include:

Speeding frequency.

Sudden braking.

Driving duration.

Accident history.

Geographical risk.

Vehicle usage patterns.

A dispute may arise when an insurer refuses compensation based on inaccurate GPS or telematics records.

The insured person may challenge the reliability of the information, the contractual basis for its use, and whether the insurer properly assessed the claim.

Sections 30–35 of the PDPA may also become relevant where personal data access, correction, objection, or erasure rights are involved.

4.6 Mobility data and autonomous vehicle disputes

Autonomous and semi-autonomous vehicles generate sensor information, camera recordings, location information, and automated decision logs.

Where an accident occurs, parties may dispute:

Whether the vehicle correctly detected an obstacle.

Whether the manufacturer received accurate sensor information.

Whether software updates affected vehicle performance.

Whether the operator failed to maintain the system.

Whether the collected data was altered or deleted.

Section 420 of the CCC may provide a basis for tort liability where its requirements are satisfied.

Contractual and product-related liability may also arise depending on the relationship between the manufacturer, software provider, vehicle owner, and operator.

4.7 Cross-border mobility data transfers

Mobility platforms may process Thai users' information through overseas cloud infrastructure.

Disputes can arise when:

A foreign platform transfers Thai passenger information overseas.

A foreign analytics company receives GPS histories.

International insurance providers exchange vehicle records.

A foreign manufacturer accesses connected-car information.

A logistics company transfers customer information to international contractors.

Section 28 of the PDPA governs certain transfers of personal data to foreign countries.

A cross-border transfer must satisfy the applicable statutory requirements and exceptions. Simply storing information on an overseas server does not remove the data controller's Thai legal responsibilities where the PDPA applies.

5. Six or more important Thai judicial decisions and case laws

Six-plus judicial authorities

Important case-law qualification: Thailand has a relatively limited publicly reported higher-court jurisprudence specifically concerning the PDPA. A 2026 legal-practice review reports no substantial body of publicly available high-court privacy judgments under the Act. Therefore, the following decisions are established Thai judicial authorities relevant by analogy to mobility data disputes. They should not be misrepresented as judgments directly concerning GPS tracking or mobility databases.

Chambers and Partners+1

Case 1. Supreme Court Decision No. 4893/2558

Subject: Privacy rights and unauthorized disclosure of personal information

Facts:

The dispute concerned the unauthorized publication of intimate images and information relating to an individual's private life.

The affected individual argued that the publication violated personal privacy and caused legally recognizable harm.

Legal issue:

Whether interference with personal privacy could constitute a wrongful act under Section 420 of the CCC.

Judicial principle:

The Supreme Court recognized the infringement of privacy as a wrongful act under Section 420. The decision distinguished privacy-related injury from reputational injury governed by Section 423.

ETDA+1

Application to mobility data:

This is particularly relevant to unauthorized GPS surveillance and disclosure of identifiable travel histories.

For example, a company that improperly publishes an individual's private journey records may face a civil claim if the elements of wrongful conduct and damage are established.

Case 2. Supreme Court Decision No. 8089/2556

Subject: Electronic authentication and enforceability of electronic transactions

Facts:

The dispute concerned borrowing through a Quick Cash card.

The borrower used a card and personal identification number to make withdrawals through an automated banking system.

The creditor sought repayment, while the borrower challenged whether sufficient written evidence of borrowing existed.

Judicial principle:

The Supreme Court recognized that the electronic transaction process, including authentication through the personal identification number and confirmation of withdrawals, could provide legally sufficient evidence of borrowing.

The Court applied Sections 7, 8, and 9 of the Electronic Transactions Act.

LawArai

Application to mobility data:

This decision is relevant to electronically authenticated mobility transactions.

For example, a transportation company may rely on authenticated electronic records to establish a driver's acceptance of a data-processing agreement or a passenger's acceptance of a digital service transaction.

However, authentication of a transaction does not itself establish consent to every separate use of personal information.

Case 3. Supreme Court Decision No. 6757/2560

Subject: Electronic communications and legally effective declarations

Facts:

A creditor sent a Facebook message stating that a debt of THB 670,000 did not need to be repaid.

The creditor later attempted to recover the amount, arguing that the message was not intended to legally discharge the debt.

Judicial principle:

The Supreme Court accepted the electronic communication as written evidence of the creditor's declaration of debt forgiveness.

The Court applied the Electronic Transactions Act and the CCC provisions concerning discharge of obligations.

LawNode

Application to mobility data:

The case is relevant to digital mobility agreements and electronic waivers.

For instance, a transportation platform that electronically communicates a refund, compensation commitment, or waiver of a contractual claim may be bound by that communication, depending on the circumstances.

It also illustrates the importance of preserving electronic records in mobility disputes.

Case 4. Supreme Court Decision No. 2162/2567

Subject: LINE communications and electronic contractual evidence

Facts:

The dispute concerned repeated money transfers between two parties and their communications through LINE.

The creditor alleged that the transfers were loans. The defendant argued that they were investments in a business.

Judicial principle:

The Supreme Court distinguished between transactions supported by sufficiently clear electronic communications and transactions lacking the necessary evidence.

For transactions 2–18, the messages and responses established written evidence of borrowing. Other transfers did not satisfy the required evidentiary standard under Section 653 of the CCC.

ThaiDeka+1

Application to mobility data:

This decision is relevant when a mobility company or individual relies on electronic messages to establish contractual consent or authorization.

A GPS record alone may establish where a vehicle travelled, but it does not necessarily prove the legal purpose of the journey or the parties' contractual intentions.

Case 5. Supreme Court Decision No. 3622/2568

Subject: Electronic communications, authentication, and proof of contractual intention

Facts:

The parties communicated through LINE and completed two separate financial transfers.

In the first transaction, the messages clearly established that the money was a loan.

In the second transaction, the borrower sent a thank-you sticker, but the conversation did not establish that the additional transfer was a loan.

Judicial principle:

The Court distinguished electronic authentication from proof of the underlying legal transaction.

Although the electronic communication could qualify as an electronic signature, the second transaction did not contain sufficiently clear evidence of the alleged loan.

LawNode+1

Application to mobility data:

This is useful in disputes involving consent and automated mobility services.

For example, a passenger's acknowledgement of an application notification does not necessarily demonstrate consent to continuous GPS monitoring or unrelated commercial data processing.

The precise meaning and context of the electronic communication remain important.

Case 6. Supreme Court Decision No. 1808/2561

Subject: Concealment of material information and civil liability

Facts:

A property developer sold land and buildings without disclosing that part of the property had been expropriated.

The purchasers suffered harm because important information about the property had not been disclosed.

Judicial principle:

The Supreme Court treated the concealment of material information as a wrongful act under Section 420 of the CCC, supporting the purchasers' claim for compensation.

Thai CCC

Application to mobility data:

The decision provides an analogy for transparency and disclosure obligations in commercial mobility relationships.

For example, a mobility platform that conceals material information about how it uses vehicle tracking data, where that concealment constitutes wrongful conduct and causes legally recognizable damage, may face civil liability.

The decision does not itself interpret the PDPA.

Case 7. Supreme Court Decision No. 6683/2537

Subject: Identification of the person legally entitled to claim compensation for vehicle damage

Facts:

A borrowed vehicle was involved in a collision after another vehicle struck it from behind.

The person who borrowed the vehicle attempted to recover the repair costs from the responsible parties.

Judicial principle:

The Supreme Court considered who had actually suffered the relevant financial loss and held that the borrower, who was not the person bearing the repair loss, lacked standing to recover that amount under Sections 420 and 438.

Thai CCC

Application to mobility data:

This decision is relevant to connected-vehicle and telematics disputes.

For example, if incorrect vehicle data causes financial loss, the claimant must establish that they are legally entitled to claim the particular loss.

A vehicle user, registered owner, leasing company, insurer, and fleet operator may have different interests and claims.

6. Civil liability for mobility data violations

Thai civil law provides several routes through which individuals and businesses may seek compensation.

A. Liability under Section 77 of the PDPA

Section 77 is particularly important.

A data controller or processor whose non-compliance with the PDPA causes damage to a data subject may be liable to compensate that person, whether the conduct was intentional or negligent, subject to the statutory exceptions.

Potential claims include:

Unauthorized disclosure of GPS information.

Unlawful processing of passenger information.

Improper collection of driver location histories.

Inadequate protection of connected-vehicle information.

Unauthorized disclosure of identifiable transportation records.

B. Punitive damages under Section 78

Section 78 allows a court to award punitive damages in addition to actual compensation, where appropriate.

Punitive damages cannot exceed twice the actual compensation awarded.

This provision is important where mobility companies engage in particularly serious personal data violations.

C. Tort liability under Section 420 of the CCC

A claimant may rely on Section 420 where another person unlawfully and intentionally or negligently injures their legally protected rights or interests.

Examples include:

Unauthorized surveillance.

Deliberate manipulation of vehicle information.

Wrongful disclosure of private travel records.

Unauthorized interference with connected-vehicle systems.

Improper exploitation of identifiable mobility information.

D. Employer liability under Section 425

An employer may be liable for wrongful acts committed by an employee in the course of employment.

For example, if a transportation company's employee unlawfully accesses and discloses passenger GPS histories while performing employment duties, the employer may face liability under the applicable conditions.

E. Contractual liability

A mobility platform may also face contractual claims where it fails to comply with agreed data-management obligations.

Examples include:

Breach of confidentiality provisions.

Failure to implement promised security measures.

Unauthorized sharing of customer information.

Failure to provide contracted data access.

Breach of connected-vehicle service agreements.

7. Evidence required in mobility data litigation

Electronic evidence is essential because mobility disputes frequently depend on automated information systems.

Important evidence categories

How GPS Works (Step-by-Step) | Trakkit

1. GPS and location records

Coordinates, route histories, timestamps, and location logs.

Fleet GPS Tracking & Management Solutions | Sensium

2. Vehicle telemetry

Speed, braking, vehicle status, sensor outputs, and diagnostic records.

Ride-hailing app Design by Muskan Jassal for PageX Studio on Dribbble

3. Platform records

Booking information, account histories, electronic receipts, and communications.

Metadata Integrity in Digital Evidence Handling

4. Cybersecurity evidence

Access logs, authentication records, security incidents, and database audit trails.

Understanding GDPR: What It Means for Companies Working with B2B Data

5. Consent and contractual records

Privacy notices, consent records, service agreements, and data-sharing arrangements.

Under the Electronic Transactions Act, electronic records may be admitted as evidence. Their evidentiary weight depends on reliability, integrity, origin, and the circumstances in which they were generated and maintained.

A mobility data claimant should ideally establish:

Who collected the information.

Who controlled its processing.

What information was collected.

Why it was collected.

Whether the processing had a lawful basis.

Whether unauthorized access or disclosure occurred.

What damage resulted.

8. Rights of individuals in mobility data governance

The PDPA provides important rights for individuals whose information is collected by mobility service providers.

These rights are not absolute. For example, statutory exceptions, legitimate retention requirements, and other lawful bases may affect whether a request must be granted.

9. Responsibilities of mobility data stakeholders

Different organizations may have different legal responsibilities.

A contractual agreement between two businesses cannot automatically eliminate statutory responsibilities owed to data subjects.

10. Regulatory and institutional mechanisms in Thailand

Several Thai institutions may become relevant in mobility data disputes.

1. Personal Data Protection Committee (PDPC)

Oversees the personal data protection framework and exercises statutory regulatory powers.

2. Office of the Personal Data Protection Committee

Supports implementation, supervision, and administration of the PDPA.

3. Electronic Transactions Development Agency (ETDA)

Plays an important role in electronic transactions and digital-economy development.

4. Department of Land Transport

Relevant to vehicle regulation, transport services, and vehicle-related information systems.

5. Office of the Consumer Protection Board

May become involved in consumer disputes concerning misleading mobility services and unfair commercial practices.

6. Thai courts

Civil courts may determine contractual, tortious, and compensation claims. Administrative courts may become relevant where a dispute concerns an administrative act or public authority's exercise of power.

11. Emerging legal challenges

Thailand's mobility sector faces several developing legal questions.

Future reforms worth considering

Thailand could strengthen mobility data governance through:

Specific standards for connected-vehicle data access.

Greater transparency concerning GPS tracking.

Standardized mobility data-sharing agreements.

Stronger protection of passenger travel histories.

Clearer responsibilities for autonomous vehicle data.

Improved procedures for preserving electronic accident evidence.

Better oversight of private mobility analytics.

Clearer rules for public-private transportation databases.

12. Comparative analysis: Thailand and international mobility governance

Thailand's legal framework can also be understood through comparison with international approaches.

The European Union's approach illustrates how mobility data governance can develop beyond ordinary privacy protection to include access to data generated by connected products.

Thailand may consider similar developments while adapting them to its own civil-law structure and transportation economy.

13. Conclusion

Civil Law and Mobility Data Governance Disputes in Thailand represent an important intersection of personal data protection, contractual liability, transportation regulation, consumer rights, and technological accountability.

The Personal Data Protection Act B.E. 2562 (2019), the Civil and Commercial Code, and the Electronic Transactions Act B.E. 2544 (2001) provide the principal legal foundations.

The seven judicial decisions discussed above offer relevant principles concerning privacy, electronic authentication, contractual evidence, disclosure, and compensation. They are analogous authorities rather than direct GPS or mobility-data judgments.

The most important legal conclusions are:

Privacy protection: Identifiable mobility and location information can receive protection under Thai privacy and data protection law.

Civil liability: Unauthorized processing that causes legally recognized damage may create liability under Section 77 of the PDPA or Section 420 of the CCC, depending on the claim.

Electronic evidence: GPS records, vehicle logs, and digital communications may be used in litigation, provided their authenticity and reliability are established.

Corporate responsibility: Mobility platforms, manufacturers, insurers, and processors must assess their respective legal obligations.

Future governance: Connected vehicles, autonomous transportation, and smart-city infrastructure will require clearer rules governing data access, sharing, security, and accountability.

Ultimately, Thailand's mobility data governance framework must balance technological innovation and transportation efficiency with privacy, individual rights, commercial fairness, and civil responsibility.

Academic research note: This discussion distinguishes established Thai judicial decisions from their proposed application to emerging mobility-data disputes. It does not claim that the cited Supreme Court decisions directly adjudicated modern mobility-data or PDPA claims. This distinction is important for formal legal research and case citation.