The third wave of COVID-19 is now spreading all over Thailand. The rise in confirmed numbers of cases and deaths has been reported by the Centre for the COVID-19 Situation Administration (“CCSA”). In response to the outbreak, the Ministry of Public Health announced a vaccination plan which ultimately aims to reduce the spread of COVID-19 infections by having around 50 million people (roughly 70% of the population) in Thailand vaccinated by the end of the year.
At this stage, free vaccinations have been offered to the elderly and certain vulnerable groups with chronic conditions, such as heart disease, diabetes, or obesity. This has been pursued through online registrations using the “Mor Prom” portal, “Mor Prom” official account in the Line application or at designated hospitals. Subsequently, vaccines will be rolled out to the rest of the Thai population. Vaccination is currently on an ‘opt-in’ voluntary basis, though this could change depending on the severity or duration of the current crisis.
The government is now actively encouraging people to undergo vaccination as supplies would soon become more widely available. With this in mind, it is crucially important to understand the extent to which employers are permitted to access their employees’ vaccination information (and the limits to this) under the Thai Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).
COVID-19 Vaccination Information
Under Section 26 of the PDPA, information related to an employee’s vaccination is regarded as health information which would be deemed as ‘sensitive data’. However, the PDPA’s provisions will not become fully effective until 1 June 2022, in line with the Thai cabinet’s decision that has been passed on 5 May 2021, which has postponed the PDPA’s full entry into force.
Collecting, Processing and Transferring COVID-19 Vaccination Information
With respect to the collection, processing or transfer of sensitive data, the employee’s express consent must be secured beforehand. Likewise, the employee must be duly notified in advance of the purpose of collection and processing and his/her rights regarding the sensitive personal data in question. The purpose of use related to such sensitive data must be strictly limited to that notified to the employees at the time the data was requested.
In requesting consent, the employer (as the data controller) must inform the employee (as a data subject) of the purpose for the collection, use or disclosure of personal data, the legal basis for collecting, processing or transferring the personal data and the employee’s rights under the PDPA, including data retention period. The consent must be expressly given in writing or through an electronic system unless consent cannot otherwise be secured by such methods. Additionally, the consent request form must be (i) easy to understand, (ii) explicitly separate from other messages, and (iii) specific to the purpose of data collection. The employee also has the right to withdraw his/her consent at any time via an easy straight-forward method similar to how the consent was requested in the first place.
Exemptions on Collecting, Processing and Transferring COVID-19 Vaccination Information
Only certain exemptions would allow the employer to collect, use, or disclose an employee’s COVID-19 vaccination information (sensitive data) without explicit consent. This includes: necessity of complying with the law with respect to (i) assessment of the employee’s working capacity; (ii) for public interest concerns to protect against cross-border contagious diseases or epidemics; or (iii) employment protection in which it is a mandatory for the employer to exercise its rights or obligations provided that the employer has appropriate measures to protect the fundamental rights and interests of its employees. It must be remembered that interpretation of these exemptions is still unclear as no subordinate regulations or implementing guidelines have been issued so far that provide a clearer understanding of the conditions under which such exemptions can be invoked.
If you have any questions or enquiries with respect to this update or any other issue in relation to the COVID-19 outbreak and its implications for your business, please feel free to contact Kraisorn Rueangkul (Partner).
The information provided here is for information purposes only and is not intended to constitute legal advice. Legal advice should be obtained from qualified legal counsel for all specific situations.
