The Royal Decree on the Operation of Digital Platform Services subject to Prior Notification B.E. 2565 (hereinafter referred to as “Royal Decree”) has been issued pursuant to the Electronic Transaction Act B.E. 2544 with effect as from 20 August 2023. Recognizing the increasing popularity and importance of online platforms to the economy and the society at large, this Royal Decree intends to enhance the credibility as well as the transparency of the platforms and to prevent possible damage to the public. This Royal Decree is the first specialized legislation governing the operation of digital platform services with extraterritorial applicability. It would thus be necessary for digital platform operators (both locals and internationals) to take the necessary steps to comply with such regulations. The Electronic Transactions Development Agency (the “ETDA”) of the Ministry of Digital Economy and Society will be a supervising authority under this Royal Decree with responsibility to, among others, publicize the list of online platforms which have complied with the Royal Decree and issue certification marks to the said platforms. Among those tasks, the ETDA is also empowered to request any document pertaining to the platform operation from the platform for inspection, as well as to enter the operator’s place for examining, gathering and seizing evidence.

To help you capitalize on these changes, we summarize the salient points of this Royal Decree as follows.

Who is governed by this Royal Decree?

The Royal Decree focuses on the operator of a “Digital Platform Service”, which is broadly defined as a service for provision of an electronic medium for connecting business operators to consumers or buyers through the computer network, for them to enter into electronic transactions with or without service fees. This, however, does not include a platform exclusively for offering goods and services of the operator itself or its affiliates.

An operator located outside of Thailand may also be subjected to this Royal Decree if its platform is provided to consumers in Thailand. It is further specified that certain platform operators shall be deemed to provide services for customers in Thailand, e.g. those displaying information in Thai language, those using Thai domain names (“.th”), those accepting payment in Thai currency, and those having offices or personnel in Thailand, etc.

What actions must be taken?

Pursuant to the Royal Decree, the operator is required to take various actions both before and during the operations as follows.

1. Local contract: The overseas operator is required to appoint a local contact in Thailand to coordinate with the ETDA.
   
   
2. Notification to the ETDA: Prior to operation, the operator shall notify the ETDA of the relevant details, e.g. information on the operator, and the platform. The operator is also required to update these details to the ETDA on a yearly basis. In addition, for a platform with a large number of revenues or users, either (i) annual revenues before expenses of more than 1,800,000 Baht for an individual operator or more than 50,000,000 Baht for a corporate operator, or (ii)  users of more than 5,000 persons per month, other details on its operation will be required, including transaction values, revenues, types and numbers of users, users’ complaints, relevant service providers, and dispute resolution procedures.
   
   For a digital platform operated before implementation of this Royal Decree, the operator is required to notify the ETDA of the above information within 90 days from the effective date of this Royal Decree.
   
   Furthermore, the ETDA is also empowered to obtain this information from other governmental authorities and to share the information from the operators with other governmental authorities to facilitate the operator and dissolve duplicated data requests to the operator as well.
   
   
3. Disclosure to users: This requirement is applicable to specific types of digital platforms, i.e. those charging service fees, those acting as intermediaries for offering goods/services to customers, those entering into agreements with business operators to offer goods and services to customers, and those offering search engines. These operators are required to clearly and properly disclose the terms and conditions on the use to their users before or at the time of use. The issues to be disclosed shall include at least main factors of algorithms and criteria for product ranking and suggestions, targeted advertisement, and satisfaction evaluation, access and use of information on use of the platforms, etc.
   
   
4. Security measures: The “Large Digital Platform”, defined to include platforms with either (i) revenues before expenses of more than 300,000,000 Baht from digital platform services or more than 1,000,000,000 Baht for all services, or (ii) users of more than 10% of the Thai population ̶ shall be subject to security requirements. Those as defined above, need to conduct risk assessment and management, implement a secured system measure, and appoint a legal compliance officer, etc.
   
   
5. Relief measures:  The Digital Platform operator is required to have relief and remedy measures for damages, in place, from its platform. These measures shall at least include the management of a complaint process, or support center for damaged users.

In case of non-compliance, the ETDA may suspend operation of the said platform and order it to rectify within 90 days or a period as prescribed by the ETDA . Otherwise, the ETDA can revoke the notification of the said platform and announce such revocation to the public via ETDA’s communication channel. The violating platform may be subject to a criminal penalty of imprisonment not exceeding one year or a fine not exceeding one hundred thousand Baht or both according to the Act.

The notification and disclosure of information pursuant to this Royal Decree may be inevitable for transparency of the digital platforms. However, as much of this information may involve trade secrets and confidential information of the platform operators, e.g. ranking algorithms, as well as personal data of users, the notification and disclosure of this information should be limited only to the extent necessary to achieve the essential purpose. It remains to be seen the degree of detailed information that will be required, and the degree of security measures that will be used by the government to protect such information.

We will continue to follow developments in connection with this Royal Decree, and will report related news as it becomes available.