Thailand Law Library

by Thailand Lawyer

The Data Controller or the Data Processor, whose operation in relation to Personal Data violates or fails to comply with the provisions of this Act which causes damages to the Data subject, shall compensate the Data subject for such damages, regardless of whether such operation is performed intentionally or negligently, except where the Data Controller or the Data Processor can prove that such operation was a result of:

1. a force majeure, or the Data subject’s own act or omission to act;
2. an action taken in compliance with an order of a government official exercising its duties and power under the law;

The compensation under paragraph one includes all necessary expenses incurred by the Data subject for the prevention of the damages likely to occur, or which was spent to suppress the damages occurred.

The court shall have the power to order the Data Controller or the Data Processor to pay punitive damages in addition to the actual compensation rendered by the court as deems fit, but shall not exceeding 2 times of such actual compensation amount, by taking into account the relating circumstances such as the severity of damages incurred by the Data subject, the interest obtained by the Data Controller or the Data Processor, the financial status of the Data Controller or the Data Processor, remedy provided by the Data Controller or the Data Processor, or the Data subject’s act in contributing to cause the damages.

The claim for compensation from the wrongful act against the Personal Data under this Act shall be barred by prescription after the lapse of 3 years from the date that the injured person know of the damages and the identity of the Data Controller or the Data Processor who is to be liable, or after 10 years from the date of which the wrongful act against the Personal Data took place.