VPNs with servers in Thailand

“Service provider” covers anyone providing others with internet access or any other service enabling communication through a computer system, and anyone storing computer data for others (s. 3). Whether a VPN operator falls within that definition is not established.

A provider that cooperates in, consents to or acquiesces in an offence under the Act, section 14 included, faces the same penalty as the offender, but is exempt if it proves it followed the minister’s procedure for notification and removal of the data (s. 15, as amended in 2017).

Section 20, as amended in 2017 (published in the Government Gazette on 24 January 2017), creates a Computer Data Screening Committee of nine members, three of them from the private sector, appointed by the digital ministry.

Officials may seek a court order to block or remove computer data that is contrary to public order or good morals even where it breaks no criminal law, and the amendment extended the power to data that is an offence under intellectual-property or other laws, on the request of the official in charge of those laws.

Section 14 of the Act, as amended in 2017, punishes entering false data into a computer system that could harm the public, cause panic, or harm public infrastructure, national, public or economic security with up to five years’ imprisonment, a fine of up to THB 100,000, or both. Knowingly forwarding such data carries the same penalty.

In the Criminal Code, defamation (s. 326) carries up to one year, a fine of up to THB 20,000, or both, and defamation by publication (s. 328) up to two years and a fine of up to THB 200,000. Section 112 punishes defaming, insulting or expressing malice against the king, queen, heir apparent or regent with three to fifteen years.

Account holders are traced through the retained traffic and client data. Non-content data can be obtained by a competent or inquiry official’s order or request; content data generally needs a court order (ss. 18 and 19).

Requests from foreign authorities for data held by Thai providers are routed through mutual legal assistance, with the Office of the Attorney General as central authority, in part because of limits set by the Personal Data Protection Act B.E. 2562 (2019), according to Thailand’s own account to the United Nations Office on Drugs and Crime. The order of the rows is the security score, and a server’s location is not a recommendation.