On January 23, 2025, Thailand made history by becoming the first country in Southeast Asia to legally recognize same-sex marriage. This milestone affirms the right to form a family on an equal basis and enables same-sex spouses to access benefits and entitlements just like heterosexual couples.
However, questions have arisen regarding how organizations that collect spousal information for employee welfare purposes should handle data concerning same-sex spouses. Specifically, there is concern over whether such data collection constitutes the processing of sensitive personal data under Section 26 of the Personal Data Protection Act B.E. 2562 ("PDPA"). If that’s the case, it’s important to determine whether explicit consent from the data subject is needed before collecting the data. Here’s how this issue can be addressed:
The PDPA regulates the processing of personal data, which refers to any information that can directly or indirectly identify an individual, excluding data of deceased persons. Organizations, as data controllers, must justify their data collection and reference an appropriate legal basis under Section 24.
However, the law imposes stricter conditions on processing certain types of personal data that could have a more significant impact on data subjects, such as racial or ethnic origin, religious beliefs, sexual behavior, and criminal records (hereafter referred to as "sensitive personal data"). Organizations collecting sensitive personal data must obtain explicit consent unless an exemption under Section 26 applies.
Sexual behavior or sexual orientation refers to an individual's capacity for deep emotional experiences, romantic relationships, or sexual attraction toward individuals of the same, opposite, or multiple genders. This raises the question of whether collecting employees’ spousal information, including same-sex spouses, constitutes processing sexual behavior data under Section 26.
To address these issues, the UK’s Information Commissioner's Office (ICO) has noted that some data collection may lead to inferred data, which could be considered sensitive personal data. For example, a photograph or a name may indirectly reveal religious beliefs or racial background. Similarly, collecting information on same-sex spouses could imply sexual orientation or behavior.
However, to determine whether inferred data qualifies as sensitive personal data, the following factors must be considered:
• Purpose of Processing: Is the primary objective to identify sensitive personal data? For instance, is the organization explicitly trying to determine an individual’s sexual orientation?
• Treatment of Different Groups: After inferring sensitive data, does the organization intend to treat individuals differently based on this data, such as granting or denying benefits based on sexual orientation?
If the collection of spousal information for employee benefits does not aim to identify sexual behavior and does not lead to differential treatment based on gender identity, it may not be classified as sensitive personal data.
To ensure compliance with the law, organizations should adopt the following approaches:
3.1 Legal Basis for Processing
If the collected data is deemed general personal data rather than sensitive data, organizations may rely on legal bases under Section 24 for the processing, such as:
• Contractual Basis: The collection of spousal information as part of employment contracts or agreements to provide employee and family benefits.
• Legitimate Interest: The necessity of collecting such data to provide employee benefits while ensuring that individual rights and freedoms are not infringed.
3.2 Best Practices for Compliance
To align data collection with data protection principles, organizations should:
• Provide a Privacy Notice: Clearly inform data subjects about data processing, specifying the purpose and legal basis.
• Implement Security Measures: Establish safeguards to prevent unauthorized access, loss, or disclosure of personal data.
• Collect Only Necessary Data: Limit data collection to essential details, such as the spouse’s name and eligibility for benefits.
• Ensure Equal Treatment: Treat same-sex and opposite-sex spouses equally, avoiding discrimination.
With Thailand’s progressive step toward marriage equality, organizations have an opportunity to demonstrate their commitment to diversity and inclusion by ensuring equitable and comprehensive employee benefits. Properly collecting and processing spousal data in compliance with legal requirements and respecting data privacy will allow businesses to move forward with societal progress in a sustainable and responsible manner.
Source:
- https://www.undp.org/sites/g/files/zskgke326/files/2023-01/personal-data-lgbtqi-report-eng.pdf
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/
