1. Introduction

Algorithm Transparency Rights Recognition in Thailand concerns the legal recognition and protection of individuals whose civil rights, contractual interests, privacy, employment opportunities, financial access, consumer rights, or personal data are affected by automated decision-making systems and algorithmic technologies.

Algorithm transparency means that individuals should be able to understand, challenge, and seek legal remedies against decisions made or substantially influenced by algorithms, artificial intelligence (AI), automated scoring systems, profiling technologies, and machine-learning applications.

In Thailand, this subject is connected with constitutional protections, civil liability, contractual fairness, consumer protection, personal data protection, and digital governance.

An important legal distinction: Thailand does not currently have a single, comprehensive statutory right equivalent to a general EU-style right to algorithmic explanation for every automated decision. Instead, relevant protections arise from several existing legal frameworks.

2. Legal framework in Thailand

A. Constitution of Thailand B.E. 2560 (2017)

The Constitution provides the foundation for protecting individuals against arbitrary interference with their rights.

Relevant provisions include:

Section 25: Recognition and protection of constitutional rights and liberties.

Section 26: Exercise of state power must comply with the rule of law and constitutional limitations.

Section 27: Equality before the law and protection against unjust discrimination.

Section 32: Protection of privacy, dignity, and reputation.

Section 36: Protection of freedom of communication.

Section 41: Certain rights concerning access to public information and legal remedies.

These provisions may become relevant where public authorities use algorithmic systems to determine eligibility, allocate public benefits, assess applications, or make administrative decisions.

B. Personal Data Protection Act B.E. 2562 (2019)

The Personal Data Protection Act (PDPA) is one of the most important legislative instruments for algorithm transparency in Thailand.

Relevant provisions include:

Practical significance: An individual affected by an algorithm may seek access to relevant personal data, object to certain processing, request correction of inaccurate information, or pursue compensation where the statutory requirements are satisfied.

However, the PDPA's transparency and access rights should not automatically be interpreted as an unrestricted right to obtain source code, proprietary algorithms, or every internal technical detail.

C. Civil and Commercial Code

The Thai Civil and Commercial Code provides additional remedies.

Important provisions include:

Section 420: General tort liability for wrongful acts causing injury to another person's life, body, health, liberty, property, or rights.

Section 421: Exercise of a right for the sole purpose of causing injury may constitute an unlawful exercise of rights.

Section 422: Presumptions of fault in certain statutory violations.

Section 438: Judicial determination of compensation.

Section 5: Good-faith principle governing the exercise of rights and performance of obligations.

Section 150: Invalidity of juristic acts contrary to public order or good morals.

These provisions may support claims involving discriminatory automated decisions, negligent algorithmic deployment, inaccurate automated assessments, and unfair contractual practices.

D. Consumer Protection Act B.E. 2522 (1979)

Algorithmic transparency also intersects with consumer protection law.

Examples include:

Automated pricing and discriminatory price differentiation.

AI-generated financial recommendations.

Hidden algorithmic advertising.

Manipulative recommendation systems.

Automated rejection of consumer applications.

Misleading claims concerning AI-based services.

Where an algorithm creates misleading representations or unfair consumer practices, the Consumer Protection Act may provide additional remedies.

E. Electronic Transactions Act B.E. 2544 (2001)

This legislation is relevant to automated commercial transactions, electronic communications, and contracts concluded through electronic systems.

It helps establish the legal validity of electronic transactions but does not automatically make every algorithmic decision fair or legally unchallengeable.

F. Automated decision-making and AI governance

Thailand's PDPA does not establish a comprehensive equivalent of Article 22 of the EU GDPR.

Nevertheless, the PDPA's subordinate rules concerning automated decision-making, particularly the applicable PDPC notifications, must be considered where relevant.

The distinction is important:

An individual may have rights concerning personal-data processing.

An individual may have grounds to challenge an unlawful or discriminatory decision.

An individual does not automatically acquire a right to inspect an entire proprietary algorithm.

A company cannot avoid its legal obligations simply by delegating decisions to AI.

3. Recognition of algorithm transparency rights

The following rights are particularly relevant to Thai civil law.

1. Right to information

Individuals should receive legally required information about the collection, purposes, and processing of their personal data.

2. Right to access

Under PDPA Section 30, individuals may request access to their personal data and obtain copies, subject to statutory conditions and exceptions.

3. Right to correction

Individuals may request correction of inaccurate or misleading personal data.

4. Right to object

Section 32 provides an objection right in specified circumstances, including certain processing based on public tasks or legitimate interests and direct marketing.

5. Right to protection against discriminatory processing

Constitutional equality principles and applicable statutory protections may be relevant when algorithmic systems produce discriminatory outcomes.

6. Right to compensation

Where unlawful processing causes damage, PDPA Sections 77–78 may support compensation and, where appropriate, punitive damages.

7. Right to meaningful human oversight

Human review is an important governance safeguard. However, it should not be presented as a universal, independently enforceable right under the Thai PDPA.

4. Six major case laws and judicial authorities

There is an important limitation in this field: publicly available Thai higher-court decisions directly establishing a general right to explanation of algorithmic decisions remain very limited. The following authorities are therefore identified separately as a Thai domestic development and comparative precedents. The foreign decisions are persuasive research materials, not binding Thai judgments.

Case 1. Thai insurance-company personal-data judgment (March 2024)

Thai domestic authority

Background:

A Thai court of first instance decided a personal-data protection dispute involving an insurance company.

The dispute concerned the collection, use, and disclosure of the plaintiff's blood-alcohol test results and a photograph without the required explicit consent.

The information was disclosed in connection with the rejection of an insurance claim and allegedly caused reputational harm and discriminatory treatment.

Legal principles:

Protection of sensitive personal data.

Consent requirements under Section 26 of the PDPA.

Lawfulness of processing.

Compensation for personal-data violations.

Accountability of data controllers.

Relevance to algorithm transparency:

An insurance company using automated risk assessment must ensure that sensitive personal information is processed lawfully. An algorithm cannot justify an otherwise unlawful collection or disclosure of personal data.

The judgment is a first-instance decision, not a final Supreme Court precedent.

Case 2. State v. Loomis, 881 N.W.2d 749 (Wis. 2016)

Comparative authority

Background:

The Wisconsin Supreme Court considered the use of COMPAS risk-assessment software during criminal sentencing.

The defendant challenged the use of a proprietary algorithm because its methodology was not fully transparent.

Legal principles:

Algorithmic risk assessments may influence consequential decisions.

Proprietary technology creates difficulties in examining methodology.

Decision-makers must understand the limitations of algorithmic assessments.

Human judicial responsibility cannot simply be transferred to software.

Relevance to Thailand:

The case is relevant to algorithm-assisted administrative and civil decision-making.

For example, a Thai financial institution should not automatically treat an AI-generated risk score as conclusive proof of an individual's creditworthiness.

Case 3. Ewert v. Canada, 2018 SCC 30

Comparative authority

Background:

The Supreme Court of Canada considered the reliability of psychological and actuarial assessment tools when used for Indigenous offenders.

The dispute concerned whether assessment tools had been adequately validated for the population to which they were applied.

Legal principles:

Reliability of predictive assessment tools.

Potential cultural bias.

Requirement for scientifically appropriate assessments.

Fairness in consequential decision-making.

Relevance to Thailand:

This case is useful when examining AI systems used for:

Employment screening.

Insurance risk evaluation.

Creditworthiness assessment.

Educational selection.

Public-benefit eligibility.

A system trained on unsuitable datasets may produce systematically unfair results.

Case 4. R (Bridges) v Chief Constable of South Wales Police, [2020] EWCA Civ 1058

Comparative authority

Background:

The English Court of Appeal examined the use of automated facial-recognition technology by police authorities.

The claimant challenged the legality of the technology's deployment and its implications for privacy and equality.

Legal principles:

Public authorities must comply with applicable legal safeguards.

Automated surveillance requires adequate governance.

Discretion and safeguards must be sufficiently controlled.

Equality and privacy implications must be assessed.

Relevance to Thailand:

The decision offers guidance for examining facial-recognition systems, biometric identification, automated surveillance, and AI-based public-sector decisions.

It demonstrates why algorithmic transparency must include information about how systems are deployed and controlled.

Case 5. Google Spain SL and Google Inc. v AEPD and Mario Costeja González, Case C-131/12 (2014)

Comparative authority

Background:

The Court of Justice of the European Union examined an individual's request concerning search-engine results associated with personal information.

The case addressed the responsibilities of search-engine operators and the protection of personal information.

Legal principles:

Personal-data protection in digital environments.

Individual rights concerning information appearing in search results.

Responsibilities of organisations processing personal data.

Balancing privacy with freedom of information.

Relevance to Thailand:

This decision is relevant to algorithmic search rankings, automated profiling, online reputation, and the consequences of automated indexing.

Thai individuals may pursue applicable PDPA remedies where their personal data is processed unlawfully.

Case 6. SCHUFA Holding (Scoring), Case C-634/21 (2023)

Comparative authority

Background:

The European Court of Justice considered automated credit scoring and the legal implications of a score generated by a credit-information company.

The score was used by another organisation in making a decision concerning an individual.

Legal principles:

Automated credit scoring can constitute automated decision-making in relevant circumstances.

The practical influence of a score matters.

Organisations cannot necessarily avoid automated-decision safeguards by dividing the decision-making process between different entities.

Individuals require meaningful protection against consequential automated decisions.

Relevance to Thailand:

This is particularly important for Thai banks, lending companies, credit-information businesses, and fintech platforms.

If an algorithmic score effectively determines whether a person receives credit, the legal analysis should consider the actual influence of that score, rather than merely identifying which organisation formally makes the final decision.

Case 7. Dun & Bradstreet Austria, Case C-203/22 (2025)

Comparative authority

Background:

The European Court of Justice considered the meaning of meaningful information about the logic involved in automated decision-making under the GDPR.

The dispute concerned an individual's ability to understand an automated creditworthiness assessment.

Legal principles:

Explanations must be meaningful and understandable.

A technical formula alone may not satisfy transparency requirements.

Individuals should be able to understand how their personal data influenced the decision.

Commercial confidentiality must be balanced against data-subject rights.

Relevance to Thailand:

This decision provides a useful comparative model for interpreting transparency obligations under the Thai PDPA.

For instance, a bank could explain that an automated loan rejection resulted from particular financial indicators without necessarily disclosing its complete proprietary source code.

5. Additional judicial authorities relevant to transparency

The following cases provide further comparative principles for developing Thai algorithmic accountability law.

Case 8. Lloyd v Google LLC, [2021] UKSC 50

Background: The UK Supreme Court examined a representative action concerning Google's alleged unlawful collection of browser-generated information.

Principles:

Personal-data protection requires attention to actual legal injury.

Large-scale data processing may affect many individuals.

Collective remedies have procedural requirements.

Data-processing organisations must comply with applicable privacy obligations.

Thai relevance: This case is useful for considering collective claims arising from algorithmic profiling and large-scale misuse of personal information.

Case 9. R (Braganza) v BP Shipping Ltd, [2015] UKSC 17

Background: The UK Supreme Court examined contractual decision-making discretion and the limits on exercising that discretion arbitrarily.

Principles:

Contractual discretion must be exercised rationally.

Relevant considerations must be taken into account.

Irrelevant considerations must be excluded.

Decisions must not be irrational or arbitrary.

Thai relevance: The reasoning can inform comparative analysis of contracts in which one party relies on automated systems to determine payments, eligibility, performance ratings, or contractual benefits.

These are comparative authorities rather than Thai algorithm-specific precedents.

6. Application in different civil-law sectors in Thailand

มันนิกซ์พาแอปฟินนิกซ์คว้า รางวัลระดับโลกจาก The Digital CX Awards 2023

A. Banking and financial services

Banks may use automated credit scoring, fraud detection, and loan eligibility systems. Incorrect personal data or unlawful processing may give rise to PDPA and civil liability claims.

A young Asian woman works at her desk in an office, surrounded by paper files, financial charts, and devices. She focuses on HR, legal consulting, and compliance while managing time effectively.

B. Employment law

Automated recruitment, employee monitoring, productivity scoring, and termination recommendations may raise privacy, discrimination, contractual fairness, and wrongful-dismissal issues.

AI and virtual care are transforming hospitals throughout Asia: Philips

C. Healthcare

AI diagnosis and patient-prioritisation systems must be assessed for accuracy, lawful processing of health information, professional responsibility, and patient safety.

‘อีคอมเมิร์ซ-ค้าปลีกไอที’ ปรับแผนรับ ‘เศรษฐกิจขาลง - กำลังซื้อฝืด’

D. E-commerce and consumer transactions

Personalised pricing, recommendation engines, targeted advertising, and automated account restrictions may create consumer disputes and personal-data protection issues.

DGA นำบริการ Digital สอนประชาชนสระแก้วเพิ่มช่องทางใหม่เพื่อการเข้าถึงบริการภาครัฐ | Techsauce

E. Government administration

Automated eligibility assessments, public-service allocation, and digital identity verification may be challenged where decisions are unlawful, discriminatory, procedurally unfair, or inadequately reasoned.

7. Civil liability for algorithmic opacity

Algorithmic opacity occurs when individuals cannot reasonably understand how an automated system reaches a consequential decision.

Under Thai law, several potential claims may arise.

Elements of a civil claim

A claimant may need to establish:

A legally protected interest or right.

An unlawful act, breach of duty, or other recognised legal basis.

Actual damage where required.

A causal connection between the conduct and the damage.

The applicable statutory requirements and available defences.

For PDPA claims, Section 77 provides a specific civil-liability framework, including liability irrespective of intent or negligence, subject to statutory exceptions. Section 78 permits punitive damages of up to twice the actual compensation in appropriate circumstances.

8. Recognition of algorithmic transparency in Thai judicial administration

An important development is the Recommendations of the President of the Supreme Court regarding the Use of AI Technology in Case Operations (19 September 2025).

The recommendations address responsible AI use in judicial work.

They distinguish between permitted supporting functions, such as:

Legal research.

Information retrieval.

Document summarisation.

Case-management planning.

Mathematical calculations.

Preliminary document preparation.

They also prohibit judges from using AI to assess or predict the probability of disputed issues for determining cases.

The recommendations emphasise verification, judicial independence, confidentiality, and disclosure of AI use in relevant circumstances. They are guidance rather than a comprehensive binding AI statute.

Oxford Institute of Technology and Justice

This development is significant because it recognises that AI should support judicial administration without replacing independent judicial decision-making.

9. Remedies and enforcement mechanisms

Individuals affected by algorithmic decisions may consider the following remedies.

A. Personal Data Protection Committee (PDPC)

The PDPC has regulatory and enforcement responsibilities concerning personal-data processing. Complaints may concern unlawful collection, disclosure, security failures, or failure to respect applicable data-subject rights.

B. Civil courts

A claimant may seek:

Compensation for proven loss.

Damages arising from unlawful data processing.

Appropriate remedies under general tort law.

Punitive damages where the PDPA requirements are satisfied.

C. Administrative Courts

Where a public authority makes an unlawful administrative decision using an algorithm, an affected individual may have grounds to seek judicial review, subject to jurisdiction and procedural requirements.

D. Class actions

Where a common unlawful data-processing practice affects numerous individuals, class-action proceedings may be available under Thailand's class-action framework.

10. Major legal challenges

11. Suggested reforms for Thailand

Thailand could strengthen algorithm transparency rights through the following reforms:

1. Statutory explanation rights: Introduce clearer rights to receive understandable explanations of consequential automated decisions.

2. Human review: Establish safeguards allowing individuals to request meaningful human reconsideration in high-impact cases.

3. Algorithmic impact assessments: Require appropriate risk assessments for high-risk AI systems.

4. Anti-discrimination safeguards: Establish testing requirements for systems used in employment, banking, insurance, and public administration.

5. Auditability: Require adequate documentation of training data, decision criteria, system changes, and outcomes.

6. Disclosure obligations: Require organisations to disclose when AI materially influences significant decisions.

7. Civil compensation: Clarify responsibility among developers, vendors, deployers, and data controllers.

8. Judicial accountability: Develop procedural standards for the use of AI-generated evidence and recommendations in litigation.

12. Overall conclusion

Civil Law and Algorithm Transparency Rights Recognition in Thailand represents an emerging area of civil liability, digital privacy, consumer protection, contractual fairness, and constitutional rights.

The PDPA provides an important foundation through its transparency, access, objection, correction, and compensation provisions. The Civil and Commercial Code provides additional remedies where algorithmic conduct causes legally recognised injury.

However, Thailand still lacks a comprehensive statutory framework providing a universal right to explanation and human review of all consequential automated decisions.

An important research qualification: The Thai insurance judgment discussed above is a reported first-instance PDPA decision. The other cases are comparative judicial authorities, not binding Thai precedents. Contemporary Thai legal commentary also reports that publicly available higher-court PDPA decisions remain extremely limited.

Chambers+2

The comparative decisions in Loomis, Ewert, Bridges, SCHUFA, and Dun & Bradstreet provide useful principles for developing a stronger Thai approach to accountability, fairness, explainability, and meaningful review.

The ultimate objective should be to ensure that no individual loses a legally protected right merely because an organisation has delegated an important decision to an algorithm.

13. Important legal references

For further academic research, the following legislation and authorities should be considered:

Constitution of the Kingdom of Thailand B.E. 2560 (2017).

Personal Data Protection Act B.E. 2562 (2019).

Civil and Commercial Code of Thailand.

Consumer Protection Act B.E. 2522 (1979).

Electronic Transactions Act B.E. 2544 (2001).

Computer Crime Act B.E. 2550 (2007).

State v. Loomis (2016).

Ewert v. Canada (2018).

R (Bridges) v Chief Constable of South Wales Police (2020).

SCHUFA Holding (Scoring) (2023).

Dun & Bradstreet Austria (2025).

Research note: PDPA Section 39 concerns records of processing activities; it should not be confused with the individual access right under Section 30. Section 32 also provides a limited, specified objection right rather than a general right to challenge every AI decision