Thailand issues new Notification regarding Criteria on Storing Computer Traffic Data of Service Providers

The new Notification, which entered into effect on 14 August 2021, provides some significant changes to the regulatory obligations concerning the retention of computer traffic data applied to service providers. As a main change, the categories of regulated service providers have been expanded and revised to cover new services. Some categories of service providers which were already regulated under the previous Notification and now have updated services include telecommunication and broadcast carriers, access service providers, hosting service providers, internet cafés as well as content and application service providers. Additional categories of service providers under the new Notification include certain online application stores (e.g. App Store, Google Play, Chatbot, Clubhouse, Telegram), social media service providers like Facebook, YouTube, Instagram or LinkedIn, cloud computing service providers and various digital service providers.

Furthermore the new Notification provides additional obligations on verification and authentication systems, data retention and closed circuit television. While the previous Notification already addressed verification and authentication requirements, the new regulations further specify them in accordance with standards provided in the Electronic Transactions Act B.E. 2544.

Service provider shall provide security measures for storing the computer traffic data, which include to store them in media, computer equipment or systems that can maintain the integrity and authentication of users and set up an access control system for the computer traffic data. Furthermore service providers need to designate a person to liaise with the Ministry of Digital Economy and Society. The stored computer traffic data must allow to identify and authenticate individual users, for instance indicating proxy server or cache, network address translation or a wifi-hotspot. 

Under the new Notification the retention period has been changed as well. Generally, service provider need to store computer traffic data for at least 90 days from the date they have been entered into a computer system. But in case of i.a. reasonable indications of offences under the Computer Crime Act or for the purpose of collecting information and evidence on offences relating to national security, terrorism, or public disorder concerning the use of computer systems or data, the official in charge may order a service provider to extend the retention period for a maximum of 6 months consecutively. The entire period may not exceed two years.

The new Notification also obliges third party service providers, e.g. cloud service providers, that are engaged by a regulated service provider to store computer traffic data. Such third parties must be prepared to store, copy, keep the computer traffic data, and deliver such computer traffic data to the authorities upon respective request.