Law note · Thailand
Personal Data Protection Act, sensitive and biometric categories
What it requires
- An app that captures or processes a faceprint, iris scan, fingerprint, voiceprint, or other biometric identifier from an individual in Thailand must obtain that individual's explicit consent under Section 26 before processing, unless a statutory exception applies.
When LexLint raises it
processes_biometricsprocesses_voicetrains_modelscrawls_web
- Excludes recording-derived identifiers
- No
What we found
Section 26 prohibits collecting personal data on race, ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, or biometric data, or any data that may affect the data subject in the same manner, without the data subject's explicit consent, subject to enumerated exceptions such as vital interest and substantial public interest.
Biometric data is defined as data arising from technical processing of a person's physical or behavioral characteristics used to identify them, with facial recognition, iris recognition, and fingerprint recognition data given as express statutory examples. A voiceprint is not named as an express example, but the same-manner catch-all and the general physical-or-behavioral-dominance definition plausibly reach it; no provision was found excluding voice.