Privacy law ‘needed for PromptPay’
Experts concerned about new electronic money-transfer system in the absence legal safeguards.
THAILAND NEEDS to enact a credible data-privacy bill before the government launches the PromptPay electronic money-transfer service requiring citizens to give their personal data to the service provider, according to industry experts.
Legal and information technology specialist Paiboon Amornpinyokiat said personal information such as addresses, age, gender, religious beliefs and blood group would show up in the PromptPay database since the concept is to link all data in the Interior Ministry’s national ID card system.
At present, applicants for the PromptPay service need to use their national ID number and at least one of their mobile numbers to link with a chosen personal bank account.
Money transfers of Bt5,000 or less will be free of charge while those receiving government welfare or tax returns will receive the money electronically.
According to Paiboon, a proposed data-privacy law is needed to protect people using the service since there could be abuse or mistakes in data processing.
The proposed law has to include penalties and other punishment for violators, he said, adding that safeguards should also be added to existing regulations.
There are also concerns about the government’s ability to monitor people’s finances as well as their personal activities and health information in connection with various welfare programmes such as social security, national health insurance and tax records, all of which are highly sensitive.
Even the National Credit Bureau is governed by the Credit Information Business Act, but the PromptPay service has been launched without any specific law being passed.
Another expert source said the PromptPay scheme also has political consequences since it would help the government to monitor political opponents’ finances, which might affect voting patterns.
Meanwhile, Prinya Hom-anek, an IT expert and founder of ACIS Professional, said the PromptPay contract should have an “opt-in, opt-out” condition, which would allow people to choose whether their accounts could only receive money, or if they could send money as well.
He said banks also use existing Internet banking services on top of the PromptPay contract so there are risks to users who are unaware of Internet banking conditions.
Art Wichiencharoen, first senior vice president of Kasikornbank, said PromptPay should be viewed as an alternative for people who want to transfer money since they can use a mobile phone number, instead of a bank account number, while the fees for transfers of more than Bt5,000 are still cheaper than the existing rates.
In addition, PromptPay would also benefit the digital economy and e-commerce since it makes payment easier and reduces transaction cost, he said.
He added that PromptPay is not a new programme but an evolution of electronic services.
Regarding data privacy, he said, people’s ID numbers are already being used by the government for tax refunds.
In addition, ID numbers are used by employers along with bank account numbers to pay salaries in the corporate payroll system.
Art said some government organisations also have the authority to ask banks to release personal financial information as mandated by law.
On cybercrimes related to the PromptPay service, he said banks have followed international security standards required by the Bank of Thailand but users also have to be careful with any kind of financial transaction, including PromptPay, to avoid potential risks.
The government also aims to use PromptPay to send welfare funds directly to recipients such as senior citizens aged over 60 who currently receive a monthly allowance.
The system could also be used to provide benefits to low-income people who are also being requested to register.
