Task force to tackle scammers who exploit new data protection law

The Thailand National Broadcasting and Telecommunication Commission (NBTC) announced the move on Monday at its public forum, “PDPA Law and the New Dimension of Scam Problem Management".

NBTC chairman Pirongrong Ramasoota said tackling scams that exploit personal data would require cooperation from the NBTC, police, telecom providers, government agencies and civil society.

She explained that the working group would combat online fraudsters that exploit the process of storing, using and communicating information on various platforms.

"As legal authorities, we should not leave consumers alone to face the threat of fraudulent schemes, which constantly change over time. Both telecom operators and related agencies must seek proactive ways to prevent the problems now rather than treating them later," said Pirongrong.

Preventive measures may include technology guidelines designed to protect the right to privacy (Privacy by Design), system and data management, legal action and effective public awareness campaigns.

Arthit Suriyawongkul, a member of Thailand Consumers Council (TCC)’s subcommittee on communications and information technology, said many organisations in both the public and private sectors currently require people to submit their personal data before receiving services.

Loaded with such requirements, people can't remember which organisations they have allowed to access their personal information, he said. Hence, when they are contacted by criminal gangs claiming to be representatives of organisations, people easily fall into the trap.

"Scammers use psychological models based on personal data to build trust with victims … while creating fear by impersonating government officials and asking them to transfer money to escape [fake] allegations," said Arthit.

Pol Maj-General Niwet Arphawasin, chief of the Technology Crime Investigation and Analysis Division, added that the PDPA was a good start but legal loopholes still existed when it came to compliance with the new law.

Currently, in the case of data leaks, the law does not penalise those who agree to sell their own data but instead blames the person who stored the leaked information.

Niwet said those applying the new law need to consider the local context. In Western countries there is no problem selling personal data obtained legally, but in Thailand, obtaining and selling personal data has been a legal grey area.

“People are being deceived every day. The challenge is how to warn people directly and immediately. If people understand and are alert to any kind of scam, they can avoid becoming victims. The law should also add a category to identify the person who disclosed the data,” said Niwet.

Police say they receive an average of 10,000 complaints of online fraud every month, totalling 1.5 billion baht in damages – or at least 10 million baht per day.Therefore, public awareness campaigns are an important protective measure. Authorities also advise that if you are transferring money to another party, ask for their phone number so you can verify they have a legitimate contact.

Thosaphon Tasanakulphan, chief of the Personal Data Protection Committee, said the most vulnerable and sensitive data is information citizens must disclose to government agencies to register for various rights such as welfare. Hence, these agencies should request the minimal amount of information needed, he said.

NBTC chairman Pirongrong concluded that the PDPA represented an opportunity for all sectors to solve the problem of personal data leaks in Thailand. To overcome this challenge together, all organisations and sectors should strengthen enforcement and also awareness of personal data issues, she added.