Fix Thailand's data confusion

Thailand has made significant strides in building a data governance framework, most notably through the Personal Data Protection Act (PDPA) 2019.

- JOMPON PITAKSANTAYOTHIN

Data now underpins how citizens exercise their rights, how governments deliver services, how businesses innovate, and ultimately, how democracy is sustained.Yet Thailand finds itself at a crossroads. Government agencies remain uncertain about whether information they hold can be disclosed or must remain secret under overlapping laws. Citizens, meanwhile, are often left in the dark. Are their rights protected? Is their personal information secure?

This is not a theoretical concern. It is a systemic problem with real consequences for transparency, accountability, and public trust.

Thailand's data governance regime has evolved incrementally, without a unifying vision. The Official Information Act (1997) establishes disclosure as a democratic principle and reflects constitutional access-to-information rights. However, that principle is routinely undermined by the Rules on Official Secrets, which allow agencies to withhold information under broadly defined categories such as “national security” or “public order”.

In practice, these broad exemptions are often applied expansively. For example, journalists and civil society organisations have repeatedly reported difficulties obtaining public procurement documents, including bidding details and contract justifications, even when no security-related content was involved. In several cases reported in Thai newspapers, agencies rejected requests outright, citing internal classifications rather than engaging in a harm-based assessment.