Criminal Law Enforcement and Penal Sanctions for the Illegal Sale of Personal Data in Thailand

Abstract

This research examines the adequacy of Thailand’s legal framework in deterring and sanctioning the illegal sale of personal data, with particular attention to enforcement under the Personal Data Protection Act B.E. 2562 (PDPA). Using a qualitative documentary approach grounded in legal hermeneutics, the study analyzes statutory provisions, doctrinal writings, and comparative legal standards to evaluate whether current sanctions achieve proportionality and deterrence in the context of cross-border and technology-driven data markets. The findings reveal a critical loophole: Section 80 of the PDPA imposes criminal liability primarily on state officials, thereby excluding private individuals and non-state actors—who constitute a major source of unlawful data trading—from direct criminal accountability. In addition, the penalties available under relevant Thai laws are comparatively mild when benchmarked against international standards, where regimes such as the GDPR and the UK Data Protection Act 2018 authorize significantly higher financial sanctions and more robust enforcement mechanisms. The hermeneutic method is particularly suited to this inquiry because it enables interpretation of legislative intent, structural gaps, and practical enforceability across intersecting legal instruments, addressing jurisdictional complexity and evidentiary barriers that cannot be resolved through purely textual comparison of statutes. Based on these findings, the study proposes legal reforms including the expansion of criminal liability to private actors, clearer definitional elements of “unlawful data sale,” and a tiered sanction model designed to strengthen deterrence while preventing over-criminalization. These reforms aim to align Thai enforcement capacity with the realities of contemporary personal data trafficking and transnational digital crime.