Legal Issues Concerning Consent for the Collection, Use, and Disclosure of Personal Data under the Non-Life Insurance Act B.E. 2535 (1992)

Abstract

          The study entitled “Legal Issues Concerning Consent for the Collection, Use, and Disclosure of Personal Data in Non-Life Insurance Business” aims to analyze the inconsistencies between the Non-Life Insurance Act B.E. 2535 (1992) and the Personal Data Protection Act B.E. 2562 (2019). The study focuses on key issues, including the principle of consent for personal data processing, the disclosure of policyholders’ data to the Office of Insurance Commission, collection of excessive data  beyond necessity and determination of the data retention periods. This research employs a qualitative methodology using documentary research. Relevant legal provisions, judicial decisions, academic literature and related legal documents are examined and comparatively analyzed to assess the consistency between the two Acts. The findings reveal that the Non-Life Insurance Act B.E. 2535 does not explicitly provide comprehensive provisions on personal data protection. Consequently, the protection of policyholders’ rights primarily relies on the enforcement of the Personal Data Protection Act B.E. 2562, which may lead to ambiguity in interpretation and practice, particularly regarding the legal basis for disclosure of data to state authorities, excessive data collection and fixed retention periods that may contrary to the principles of purpose limitation and proportionality. The study proposes amendments to the Non-Life Insurance Act B.E. 2535 to integrate consent and personal data protection principles in alignment with the Personal Data Protection Act B.E. 2562 in order to enhance legal clarity and promote a balance between regulatory oversight and the protection of policyholders’ privacy rights.