1. Introduction

Autonomous Biodigital Governance in Thailand is an emerging area of civil law concerning the regulation of systems that combine biological information, digital technologies, artificial intelligence (AI), biometric identification, genetic data, automated decision-making and autonomous digital infrastructure.

The concept involves the use of intelligent technologies to collect, process, analyse and make decisions based on biological and digital information, sometimes without continuous human supervision.

Examples include:

AI systems analysing human DNA and genetic characteristics.

Autonomous biometric identification and facial-recognition systems.

Digital healthcare platforms using biological information.

AI-powered genetic testing and medical diagnosis.

Automated decisions based on an individual's biological characteristics.

Digital identity systems connected to biometric databases.

AI-managed biotechnology research and biological information networks.

Autonomous systems managing genetic, medical and personal data.

In Thailand, this subject must be examined through existing civil-law principles rather than treated as an already established, independent legal field.

The principal legal foundations include the Thai Civil and Commercial Code, the Personal Data Protection Act B.E. 2562 (2019), the National Health Act B.E. 2550 (2007), consumer protection legislation, product liability legislation and relevant constitutional privacy protections.

An important distinction is that biological information is not simply ordinary digital information. Genetic information, biometric identifiers and medical records can reveal highly intimate characteristics of an individual. Their automated processing therefore raises questions of consent, privacy, ownership, negligence, discrimination, contractual responsibility and compensation.

2. Legal Framework Governing Biodigital Governance in Thailand

A. Thai Civil and Commercial Code

The Civil and Commercial Code provides the general foundation for civil responsibility arising from biodigital technologies.

Important provisions include:

Section 420 – Tortious liability

A person who wilfully or negligently unlawfully injures another person's life, body, health, liberty, property or rights must compensate the injured person.

This provision may apply where:

An AI genetic-analysis system produces negligent results.

An autonomous biometric system wrongly identifies an individual.

A healthcare platform discloses confidential biological information.

A company negligently operates a biological-data processing system.

An automated decision causes legally recognisable injury.

The central question is whether the defendant's conduct constitutes an unlawful infringement of another person's rights and whether the damage resulted from that conduct.

Section 421 – Exercise of rights contrary to their purpose

A person cannot exercise a right in a manner that is intended exclusively to cause injury to another.

This may become relevant where organisations misuse access rights to biological databases or exercise contractual powers abusively.

Sections 425–427 – Employer and principal liability

These provisions can become relevant when employees, representatives or agents cause damage while performing assigned duties.

For example, a biotechnology company may face liability for negligent conduct by personnel operating an automated genetic-testing platform.

However, the use of AI does not automatically establish employer liability. The statutory requirements and relationship between the conduct and assigned duties must be proved.

Section 438 – Assessment of damages

Courts may determine the nature and extent of compensation according to the circumstances and seriousness of the wrongful act.

Potential heads of damage include medical expenses, loss of earnings and other legally recoverable consequences.

B. Personal Data Protection Act B.E. 2562 (2019)

The PDPA is one of the most important laws governing biodigital governance.

Biometric data and genetic data fall within the category of sensitive personal data under Section 26.

Section 26 establishes additional restrictions on the collection, use and disclosure of sensitive personal data, subject to specified statutory exceptions and safeguards.

Relevant obligations include:

Obtaining legally valid consent where required.

Establishing an appropriate lawful basis for processing.

Protecting sensitive biological information.

Implementing suitable security measures.

Preventing unauthorised disclosure.

Respecting data-subject rights.

Establishing accountability for data-processing activities.

Section 37 imposes important duties on data controllers, including appropriate security measures and procedures for handling personal-data breaches.

Section 40 establishes obligations applicable to data processors.

Sections 77–78 provide civil-liability and compensation provisions for damage caused by violations of the Act, subject to their statutory requirements and applicable defences.

Section 79 provides for punitive damages in qualifying circumstances.

Consequently, an organisation cannot avoid its legal responsibilities merely because a biological-data decision was generated by an autonomous algorithm.

C. National Health Act B.E. 2550 (2007)

The National Health Act is important for the protection of medical information and patient autonomy.

Section 7 recognises the confidentiality of personal health information and restricts disclosure, subject to the exceptions established by law.

Section 8 addresses information and consent in connection with healthcare services.

These provisions are relevant to:

AI-assisted diagnosis.

Genetic screening.

Automated medical recommendations.

Digital healthcare platforms.

Biometric patient identification.

Automated medical-data sharing.

A healthcare provider must consider both the technological reliability of its system and its legal obligations towards patients.

D. Consumer Protection and Product Liability

The Consumer Protection Act B.E. 2522 (1979) and Product Liability Act B.E. 2551 (2008) may apply to biodigital products and services.

The Product Liability Act is particularly relevant where a defective product causes damage.

Examples include:

Defective biometric scanners.

Faulty genetic-testing equipment.

AI-integrated medical devices.

Automated laboratory systems.

Defective biological monitoring devices.

Whether a particular software-based system falls within the statutory definition of a product requires examination of the legislation and the nature of the system.

3. Autonomous Biodigital Governance and Civil Liability

A. Liability for autonomous biological-data processing

Autonomous biodigital systems may process personal biological information without direct human intervention.

For example, an AI platform may automatically analyse genetic data and classify an individual as having a higher risk of developing a particular disease.

If that classification is inaccurate and causes financial, professional or medical harm, several legal questions arise:

Was the biological information collected lawfully?

Was the processing conducted for a legitimate and disclosed purpose?

Was the system technically reliable?

Did the organisation take reasonable precautions?

Was the individual informed of the limitations of the technology?

Did the automated decision directly cause legally recognisable damage?

Under Section 420 of the Civil and Commercial Code, negligence may establish tortious liability where the statutory elements are satisfied.

Under PDPA Section 77, the controller or processor may also face civil liability for damage caused by non-compliant personal-data operations, regardless of whether the conduct was intentional or negligent, subject to the statutory exceptions.

B. Liability for autonomous biometric identification

Biometric technologies use characteristics such as:

Facial geometry.

Fingerprints.

Iris patterns.

Voice characteristics.

Other identifiable biological characteristics.

An autonomous biometric system may incorrectly identify a person as another individual.

Possible consequences include:

Denial of access to banking services.

Unlawful exclusion from employment.

Incorrect identification in healthcare facilities.

Reputational injury.

Unauthorised surveillance.

Disclosure of sensitive personal information.

Affected individuals may seek remedies under the PDPA, contractual law and general tort principles, depending on the facts.

C. Genetic-data governance and civil responsibility

Genetic data presents particularly serious legal concerns because it may reveal information not only about the individual but also about biological relatives.

For example, an autonomous genetic-analysis company might disclose information indicating a hereditary disease risk.

Such disclosure could affect:

Employment opportunities.

Insurance relationships.

Family relationships.

Personal reputation.

Psychological well-being.

Section 26 of the PDPA is especially important because genetic data is sensitive personal data.

The legal analysis must distinguish between the rights of the individual whose genetic sample was collected and the interests of relatives whose information may be indirectly revealed.

D. Autonomous healthcare and medical decision-making

AI-powered medical systems can analyse biological data and recommend treatments.

However, automated analysis does not eliminate the professional duties of healthcare providers.

A hospital using AI-assisted diagnostic systems should consider:

Accuracy and clinical validation.

Human supervision.

Patient information and consent.

Medical-record security.

System maintenance.

Documentation of recommendations.

Procedures for correcting inaccurate outputs.

If a medical professional blindly follows an unreliable automated recommendation, the conduct may be examined under ordinary medical negligence principles.

E. Biodigital contractual disputes

Autonomous biodigital systems frequently operate through digital contracts between:

Patients and healthcare providers.

Individuals and genetic-testing companies.

Hospitals and AI developers.

Biotechnology companies and research institutions.

Digital identity providers and consumers.

Contractual disputes may concern defective services, inaccurate reports, unauthorised data use, confidentiality, inadequate security and failure to provide promised functionality.

Relevant provisions of the Civil and Commercial Code include:

Section 215: compensation for non-performance of contractual obligations.

Section 222: compensation for damage resulting from non-performance.

Section 368: interpretation of contracts according to good faith and ordinary usage.

Section 373: invalidity of advance agreements excluding liability for fraud or gross negligence.

A company cannot automatically escape responsibility by inserting a general disclaimer stating that all automated biological analysis is provided at the user's risk.

4. Important Thai Case Laws: At Least 6 Judicial Decisions

Important legal qualification: Thailand does not yet have an established body of reported Supreme Court decisions specifically concerning autonomous biodigital governance, autonomous genetic decision-making or AI-controlled biological databases. The following decisions are relevant by analogy. They establish principles concerning medical negligence, confidentiality, health records, informed consent and civil liability that can be applied to future biodigital disputes.

Case 1: Supreme Court Judgment No. 4632/2565

Directly relevant to health-data confidentiality

Legal issue: Disclosure and internal handling of confidential medical records.

The case concerned the disclosure of a patient's medical records and surgical video to hospital legal personnel during the handling of a dispute between the patient and the hospital.

The Supreme Court considered Section 7 of the National Health Act B.E. 2550.

The Court distinguished disclosure to unrelated outsiders from disclosure to relevant internal personnel who needed the information to address an existing dispute.

The internal consultation in the circumstances of the case was not treated as an unlawful disclosure under Section 7.

Relevance to biodigital governance:

This judgment is particularly important for hospitals and biotechnology companies operating digital medical-record systems.

It demonstrates that confidentiality must be assessed in relation to the purpose, recipient and circumstances of disclosure.

For example, a hospital may need to share patient records with authorised legal or compliance personnel when defending a claim. However, that does not provide unrestricted permission to distribute genetic information or medical records to unrelated departments or commercial partners.

Case 2: Supreme Court Judgment No. 6092/2552

Medical negligence and automated diagnosis analogy

Legal issue: Negligent medical diagnosis and professional responsibility.

The physician relied on information communicated by nursing personnel instead of personally examining the patient.

The physician's treatment instructions resulted in a serious allergic reaction.

The Supreme Court treated the failure to examine the patient personally, in circumstances where there was no sufficient reason preventing examination, as negligence.

The patient's consent to medical treatment did not eliminate the physician's liability when the treatment fell below professional standards.

Relevance to biodigital governance:

This judgment provides an important principle for AI-assisted healthcare.

A physician cannot necessarily avoid liability by arguing that an AI diagnostic system generated the recommendation.

Where the professional is required to exercise independent clinical judgment, unreasonable reliance on an automated system may constitute negligence.

The case also demonstrates that patient consent does not automatically excuse substandard treatment.

Case 3: Supreme Court Judgment No. 292/2542

Informed consent and bodily autonomy

Legal issue: Negligent surgery and inadequate explanation of medical procedures.

The case concerned unsuccessful breast-reduction surgery followed by repeated corrective operations.

The Supreme Court found negligence in the circumstances, including the failure to exercise the required professional care and adequately explain the treatment process, duration and methods.

The decision recognised the importance of the patient's understanding of the medical procedure.

Relevance to biodigital governance:

This principle can be applied to AI-based genetic testing and autonomous medical technologies.

Before an individual undergoes a procedure involving genetic analysis or automated biological decision-making, the healthcare provider should provide adequate information about:

The nature of the procedure.

Its intended purpose.

Relevant risks.

Possible consequences.

The role of automated technology.

Available alternatives.

Consent should not be reduced to an unexplained digital acceptance button.

Case 4: Supreme Administrative Court, Decision A.587/2562

Legal issue: Loss of medical records and responsibility of a public hospital.

The case concerned the failure of a public hospital to provide medical records after the records had been lost.

The Administrative Court considered the hospital's legal responsibility to maintain and provide the records and found wrongful conduct arising from the neglect of official duties.

Compensation was awarded under the Liability for Wrongful Acts of Officials Act B.E. 2539 (1996).

Relevance to biodigital governance:

This decision is important for autonomous electronic medical-record infrastructure.

Hospitals and public institutions operating biodigital systems should maintain:

Accurate medical records.

Reliable backup systems.

Secure storage.

Appropriate access controls.

Record-recovery procedures.

Audit trails.

A digital transformation programme does not eliminate institutional responsibility for preserving essential medical information.

Case 5: Supreme Court Judgment No. 4289/2565

Legal issue: Medical records, missing entries and evidentiary responsibility.

This decision is relevant to the evidentiary importance of medical documentation, particularly information missing from records and the failure to create appropriate initial treatment records.

Relevance to biodigital governance:

An autonomous medical platform should preserve reliable records of:

Original biological information.

Data collection dates.

Laboratory results.

Algorithmic recommendations.

Human interventions.

Changes to medical records.

Final treatment decisions.

Where an organisation fails to maintain relevant records, the resulting evidentiary difficulties may become significant in litigation.

This judgment is useful when considering the responsibility of hospitals using automated clinical-record systems. It should not, however, be interpreted as a decision directly concerning AI-generated evidence.

J&A INTERNATIONAL LAW

Case 6: Supreme Court Judgment No. 2764/2565

Legal issue: Medical-service disputes and evidence concerning matters within the business operator's particular knowledge.

This decision is relevant to the evidentiary position of patients in medical-service litigation.

Relevance to biodigital governance:

In disputes involving autonomous medical platforms, the technical information necessary to establish how a system operated may be exclusively held by the hospital, technology provider or biotechnology company.

Examples include:

Algorithmic decision logs.

Diagnostic-system configurations.

Software validation reports.

Laboratory processing records.

Data-access histories.

This makes documentation, transparency and preservation of technical evidence particularly important.

The judgment is an evidentiary analogy, not a ruling on autonomous biological technology.

J&A INTERNATIONAL LAW

Case 7: Supreme Court Judgment No. 5958/2564

Legal issue: Evidentiary requirements and unsupported allegations in medical-service litigation.

The decision is relevant to the requirement that claims must be supported by evidence rather than merely asserted.

Relevance to biodigital governance:

An individual alleging that an autonomous biological-data system caused injury should, where possible, establish:

What information was processed.

How the system used that information.

What decision or output was produced.

What injury followed.

The causal relationship between the system's operation and the injury.

The organisation's technical records may be important in establishing these matters.

This case should be treated as a general evidentiary analogy rather than an AI-specific precedent.

J&A INTERNATIONAL LAW

5. Emerging Personal Data Protection Litigation

The 2024 Thai insurance-company personal-data judgment

In March 2024, a Thai court of first instance delivered an important decision concerning the collection, use and disclosure of sensitive personal data by an insurance company.

The dispute involved:

Blood-alcohol test results.

A photograph of the individual undergoing the test.

Processing without the required explicit consent.

Disclosure of the information to another person.

Rejection of an insurance claim.

Alleged reputational and personal injury.

The case raised questions concerning Section 26 of the PDPA and the lawful basis for processing sensitive personal data.

Biodigital significance: Blood-test results are biological information. The decision illustrates how unauthorised processing of biological information can create civil liability and affect an individual's contractual and personal interests.

It is particularly relevant to autonomous insurance systems that use biological information to determine eligibility, assess risk or reject claims.

The reported material does not establish that this was an AI-related dispute or a final Supreme Court precedent.

Tilleke & Gibbins+1

6. Allocation of Liability Among Biodigital Stakeholders

One of the most complicated questions in autonomous biodigital governance is determining who should be responsible when multiple organisations participate in the processing of biological information.

Liability must be determined according to the applicable statutory provisions, contractual relationships and evidence of causation. Merely participating in an autonomous system does not automatically make every stakeholder liable.

7. Civil Remedies Available in Thailand

Individuals affected by autonomous biodigital systems may have several possible legal remedies.

A. Compensatory damages

Under Section 420 of the Civil and Commercial Code, an injured person may claim compensation where the requirements of tortious liability are established.

Possible claims include:

Medical expenses.

Rehabilitation expenses.

Loss of income.

Property damage.

Legally recoverable non-pecuniary damage.

B. PDPA compensation

Section 77 provides civil compensation for qualifying personal-data violations.

Importantly, the provision does not require the injured person to establish intention or negligence by the controller or processor.

The statutory exceptions include force majeure, the data subject's own act or omission, and compliance with a lawful official order.

C. Punitive damages

Under Section 78 of the PDPA, courts may award punitive damages in addition to actual compensation.

The maximum is twice the amount of actual compensation.

The court considers relevant circumstances, including the seriousness of the damage, benefits obtained by the defendant, financial position, remedial measures and the data subject's contribution to the damage.

Thailand Law Library

D. Injunctions and preventive remedies

Depending on the cause of action and applicable procedural law, an affected individual may seek appropriate judicial relief to prevent continuing unlawful conduct.

Examples include seeking protection against:

Continuing unauthorised processing.

Further disclosure of genetic information.

Continued use of unlawfully obtained biometric data.

Repeated dissemination of confidential medical records.

E. Consumer remedies

Where a biodigital product qualifies under the Product Liability Act B.E. 2551 (2008), injured consumers may have access to the statutory product-liability framework.

The Act provides an important additional remedy alongside contractual and tortious claims.

Thailand Law+1

8. Major Legal Challenges

1. Absence of legal personality for autonomous systems

An autonomous AI system is not automatically recognised as an independent legal person under Thai civil law.

Consequently, liability generally needs to be allocated to legally responsible individuals or organisations.

2. Ownership of biological information

Thai law protects personal data through privacy and data-protection rules, but the legal status of biological information should not be reduced to a simple ownership question.

The rights to access, control, process and disclose biological information must be distinguished from ownership of physical samples, laboratory equipment and research materials.

3. Algorithmic discrimination

An autonomous biodigital system may classify individuals according to genetic characteristics or biometric information.

This can create risks of unfair treatment in employment, insurance, healthcare and financial services.

4. Cross-border biological-data transfers

Biotechnology companies may store biological information on overseas cloud platforms.

Section 28 of the PDPA regulates international transfers of personal data, subject to its conditions and exceptions.

A company cannot assume that storing sensitive biological information abroad removes its obligations under Thai law.

5. Evidentiary difficulties

Individuals may not have access to the source code, training data, algorithmic logs or laboratory records necessary to explain an automated decision.

Courts may therefore need to consider expert evidence, electronic records, medical documentation and technical audit trails.

6. Autonomous decision-making without meaningful human review

A system may independently determine whether an individual qualifies for a service, receives medical treatment or satisfies an insurance company's risk criteria.

Thai law must be applied to the specific decision, including applicable consent, contractual, consumer-protection and data-protection requirements.

9. Recommendations for Strengthening Thai Biodigital Governance

Thailand could strengthen its civil-law framework through the following measures:

1. Biological-data protection: Establish clearer operational safeguards for genetic, biometric and other sensitive biological information.

2. Algorithmic accountability: Require appropriate documentation of automated biological-data processing.

3. Human supervision: Establish suitable human-review mechanisms for high-impact healthcare and biometric decisions.

4. Genetic-data confidentiality: Strengthen safeguards against unauthorised commercial disclosure.

5. Civil liability clarification: Clarify the respective responsibilities of AI developers, healthcare institutions, laboratories and data processors.

6. Electronic evidence preservation: Encourage secure audit trails and reliable preservation of automated decision records.

7. Consumer protection: Improve remedies for individuals harmed by defective biodigital products and services.

8. Institutional coordination: Promote cooperation between the Personal Data Protection Committee, Ministry of Public Health, healthcare regulators and consumer-protection authorities.

10. Conclusion

Civil Law and Autonomous Biodigital Governance in Thailand represents an emerging intersection of civil liability, biotechnology, artificial intelligence, medical confidentiality, genetic information and personal-data protection.

The Thai Civil and Commercial Code, particularly Section 420, provides the general foundation for tortious liability. The PDPA provides specific safeguards for sensitive biological information and civil remedies for qualifying violations. The National Health Act protects the confidentiality of health information and supports patient autonomy.

The seven judicial decisions discussed above provide useful legal foundations concerning medical negligence, confidentiality, informed consent, medical records and evidentiary responsibility. They should not be mistaken for seven direct precedents on autonomous biodigital systems.

Overall legal position

The central principle is that technological autonomy does not eliminate human and institutional legal responsibility. Hospitals, biotechnology companies, data controllers, developers and healthcare professionals must remain accountable under the legal rules applicable to their respective activities.

11. Important Statutory Provisions for Research and Examination

Final research observation: The most important starting points for developing this subject into a specialised Thai civil-law research chapter are Supreme Court Judgments 4632/2565, 6092/2552 and 292/2542, together with PDPA Sections 26, 37 and 77–78. These connect biological-data confidentiality, professional responsibility and compensation into a coherent legal framework.