The Tort of Personal Data Breach Litigation : Analysis on Liability under the European Union's GDPR

Abstract

     The General Data Protection Regulation (“GDPR”) of the European Union establishes a framework for private enforcement, allowing data subjects to seek civil remedies for the damage suffered as a result of an infringement of the GDPR from the data controller or processor. This article aims to comparatively analyze the mechanisms for exercising the right to compensation under Thailand's Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and the GDPR, which has been in force earlier and features more developed jurisprudence on various key issues, in order to develop a systematic understanding of the remedial mechanisms available to individuals for ensuring their data protection rights. The article explores the essential aspects of civil liability provisions under Thailand’s PDPA in comparison with the GDPR, including elements of liability, the burden of proof, defenses to liability, and the nature of recoverable losses. Particular emphasis is placed on the significant divergence between the two regimes concerning the recognition of compensable damage. While the GDPR explicitly allows for compensation for both material and non-material harm—including the fear of potential misuse of personal data resulting from data breaches—Thailand’s PDPA does not explicitly address non-material damages. In practice, this may place a considerable burden on data subjects, who must then prove quantifiable financial loss in order to claim compensation. Such a limitation may undermine the effectiveness of data protection enforcement in Thailand. Accordingly, the article recommends legal reform and a re-evaluation of the interpretation of non-material damage within the Thai legal system—particularly in the context of personal data protection—to ensure the effective and comprehensive safeguarding of data subjects’ rights.