1. Introduction

Behavioral Insight Rights Recognition in Thailand concerns the legal protection of individuals against the unauthorized collection, analysis, prediction, manipulation, commercialization, and disclosure of information about their behavior, psychological characteristics, preferences, habits, emotions, and decision-making patterns.

In the modern digital economy, organizations increasingly use artificial intelligence (AI), behavioral analytics, biometric technologies, recommendation systems, social-media monitoring, and predictive algorithms to understand and influence human behavior.

Examples include:

Predicting an individual's purchasing decisions through online activity.

Analysing emotional reactions through facial-recognition technology.

Using psychological profiles to determine insurance premiums.

Predicting employee productivity and workplace behavior.

Assessing creditworthiness through behavioral data.

Using AI to influence political opinions and consumer preferences.

Creating digital behavioral profiles without meaningful consent.

Important legal distinction: Thailand does not presently recognize a separate, comprehensive statutory right called the Behavioral Insight Right. However, several existing legal protections can apply to behavioral information, particularly constitutional privacy, personal data protection, civil liability, personality rights, and consumer protection.

The central legal question is whether an individual's behavioral characteristics can be collected, analysed, predicted, or commercially exploited without violating legally protected personal interests.

2. Legal framework governing behavioral insight rights

A. Constitution of Thailand

The Constitution of the Kingdom of Thailand B.E. 2560 (2017) provides important foundations for protecting individual autonomy and privacy.

Section 32 – Right to privacy

Section 32 protects personal privacy, dignity, and family rights against unlawful interference.

Its relevance to behavioral insights includes:

Protection against intrusive behavioral surveillance.

Protection against unauthorized monitoring of private activities.

Protection against unlawful disclosure of personal behavioral information.

Protection against invasive psychological profiling.

Protection of personal dignity in digital environments.

Behavioral analysis that reveals intimate personal characteristics may therefore raise constitutional privacy concerns.

B. Civil and Commercial Code

The Thai Civil and Commercial Code provides important private-law remedies.

Section 420 – General tort liability

Section 420 establishes liability where a person, intentionally or negligently, unlawfully injures another person's life, body, health, liberty, property, or rights.

This provision is particularly important for behavioral insight disputes.

For example, an organization that unlawfully collects psychological information and uses it to discriminate against an individual may potentially incur tort liability.

Section 421 – Abuse of rights

Section 421 addresses the exercise of a right with the sole intention of causing injury to another person.

It may become relevant where an organization uses its contractual or technological powers to deliberately harm an individual's interests.

Section 423 – False statements and reputational injury

Section 423 concerns liability for communicating false information that damages another person's reputation or interests.

It may apply where an inaccurate behavioral profile is communicated to employers, financial institutions, business partners, or other third parties.

Section 18 – Personal name protection

Section 18 provides protection concerning the unlawful use of an individual's name.

It can be relevant where personal identity is commercially exploited through behavioral advertising, digital profiling, or impersonation.

C. Personal Data Protection Act B.E. 2562 (2019)

The Personal Data Protection Act (PDPA) is the most important legislation for behavioral insight protection.

It regulates the collection, use, storage, processing, and disclosure of personal data.

The following provisions are particularly relevant:

Application to behavioral insights

Behavioral profiles can constitute personal data when they identify or make an individual identifiable.

For example:

A consumer's purchasing history.

An employee's behavioral assessment.

An individual's browsing and location history.

Facial expressions linked to an identifiable person.

A psychological assessment associated with a particular individual.

Health information, biometric information, and other sensitive information may additionally fall under Section 26.

An important distinction is that Thailand's PDPA does not create a general equivalent of Article 22 of the European GDPR. It does not provide an unrestricted right to challenge every decision merely because it was automated. Section 32 provides objection rights in specified circumstances, while other PDPA protections and general legal remedies may apply depending on the facts.

Thai Law Knowledge Authority+2

D. Consumer Protection Act B.E. 2522 (1979)

Behavioral insight technologies can affect consumers through personalized advertising, psychological targeting, manipulative digital interfaces, and algorithmic pricing.

The Consumer Protection Act is relevant to:

Misleading commercial representations.

Unfair advertising practices.

Exploitative marketing.

Concealment of material information.

Unfair contractual terms.

Manipulation of vulnerable consumers.

For instance, a company that uses psychological vulnerability to encourage consumers to enter financially harmful transactions may face consumer-protection and potentially civil-liability issues, depending on the circumstances.

E. Criminal Code and confidentiality protections

Sections 322–325 of the Thai Criminal Code address certain unlawful acts involving confidential documents, information, and professional secrets.

These provisions may become relevant when behavioral information is obtained or disclosed through legally protected confidential relationships.

They do not, however, criminalize every unauthorized behavioral analysis.

3. Recognition of different categories of behavioral insight rights

Thailand's existing legal framework can be understood through the following categories.

A. Right to behavioral privacy

This concerns the individual's interest in preventing unjustified observation and analysis of private conduct.

Examples include:

Monitoring private online activities.

Tracking personal movements.

Recording private conversations.

Analysing intimate personal habits.

Section 32 of the Constitution and Section 420 of the Civil and Commercial Code provide important legal foundations.

B. Right to psychological privacy

Psychological privacy concerns information about an individual's mental characteristics, emotions, personality, fears, preferences, and psychological tendencies.

Examples include:

Emotional profiling.

Personality testing.

Psychological vulnerability assessments.

Predictive mental-state analysis.

When such information identifies an individual, PDPA protection may apply. If it reveals health information, Section 26 may also become relevant.

C. Right to behavioral data control

Individuals have statutory rights concerning personal data under the PDPA.

These include access, correction, objection in specified circumstances, erasure, restriction, and portability.

These rights are important because behavioral profiles may be generated from information collected across different digital platforms.

D. Right against behavioral discrimination

This concerns harmful treatment based on behavioral predictions or psychological classifications.

Examples include:

Denial of employment based on an inaccurate behavioral score.

Unfair insurance treatment based on psychological profiling.

Financial exclusion based on predictive consumer assessments.

Unfair treatment based on inferred personality characteristics.

There is no general standalone Thai statutory right against every form of behavioral discrimination. Depending on the facts, protection may arise through data protection, employment law, consumer protection, constitutional principles, and tort liability.

E. Right against behavioral manipulation

This concerns practices designed to exploit an individual's psychological weaknesses or behavioral tendencies.

Examples include:

Manipulative online advertising.

Exploitative subscription designs.

Targeting vulnerable consumers.

AI-generated persuasion based on sensitive personal characteristics.

The legal analysis may involve consumer protection, consent, contractual fairness, and Section 420 liability.

4. Important Thai case laws and judicial principles

Preliminary case-law qualification: Thailand has limited reported litigation directly concerning behavioral profiling, AI-based psychological prediction, and behavioral insight rights. The following six decisions and proceedings are relevant through privacy, personality rights, reputation, personal-data processing, and general tort principles. They should not be represented as judgments that have already established a separate behavioral insight right.

Case 1. Supreme Court Judgment No. 4893/2558 (2015)

Highly relevant privacy precedent

Subject: Unauthorized publication of intimate images

The dispute concerned the publication of intimate images of individuals without their consent.

The Supreme Court recognized that privacy in consensual intimate activities is a legally protected interest.

The Court treated the infringement of constitutional privacy as capable of constituting a wrongful act under Section 420 of the Civil and Commercial Code.

Legal principles:

Privacy is a legally protected personal interest.

Unlawful disclosure of intimate information may create civil liability.

Freedom of expression does not automatically override individual privacy.

Section 420 can protect interests beyond physical injury and property damage.

Relevance to behavioral insight rights:

The decision provides an important foundation for protecting intimate behavioral information against unauthorized disclosure.

Case 2. Supreme Court Judgment No. 6355/2548 (2005)

Subject: Unauthorized commercial use of an individual's image

This case concerned the use of an actress's image for commercial promotional purposes.

The dispute illustrates the protection of personal identity and publicity interests under Thai civil law.

Sections 18 and 420 are relevant to the protection of an individual's name, identity, and legally protected personal interests.

Legal principles:

An individual's identity has legally protected interests.

Commercial use of personal images can raise civil-law issues.

Unauthorized exploitation may create liability.

Personality-related interests deserve legal protection.

Relevance to behavioral insight rights:

An individual's behavioral profile, personality characteristics, and identifiable digital representation may similarly be exploited for commercial advantage.

The case is an analogy, not a direct ruling on behavioral analytics.

Case 3. First-instance judgment concerning fashion models, 47/2549 (2006)

Subject: Unauthorized commercial use of fashion models' images

The proceedings concerned the use of two fashion models' images for commercial trademark promotion without their consent.

The dispute illustrates the legal significance of consent and commercial exploitation of personal identity.

Legal principles:

Personal images have commercial and personality-related significance.

Unauthorized promotional use can create legal disputes.

Commercial exploitation of identity raises questions of consent.

Civil remedies may be available for wrongful interference with protected interests.

Relevance to behavioral insight rights:

Behavioral profiling can generate commercially valuable information about individuals. The reasoning concerning unauthorized commercial exploitation provides an analogy for evaluating the commercialization of personal behavioral characteristics.

This was a first-instance decision, not a Supreme Court precedent.

Tilleke & Gibbins

Case 4. Supreme Court Judgment No. 1808/2561 (2018)

Subject: Concealment of material information in a property transaction

The dispute concerned a property developer's failure to disclose that part of the property being sold had been expropriated.

The Supreme Court treated the concealment of material information as a wrongful act under Section 420, resulting in liability for the damage suffered by purchasers.

Legal principles:

Misleading or concealing material information can constitute a wrongful act.

Commercial actors must respect legally protected interests.

Actual damage and wrongful conduct are important to civil liability.

Section 420 can provide compensation for unlawful commercial conduct.

Relevance to behavioral insight rights:

The decision offers an analogy for situations where businesses conceal material facts about the collection or commercial use of behavioral information.

It does not directly concern personal-data processing.

Case 5. Supreme Court Judgment No. 5374/2561 (2018)

Subject: Interference with property-related rights

This decision concerned interference with a boundary wall serving as a public utility in a land-allocation development.

The Court considered the property-related rights involved and the application of Section 420 of the Civil and Commercial Code.

Legal principles:

Civil-law rights receive protection against wrongful interference.

Interference with another person's protected interests may create liability.

The circumstances of the interference matter.

Civil remedies may include compensation and orders requiring conduct to cease.

Relevance to behavioral insight rights:

Although this is a property dispute, it illustrates the broader operation of Section 420 in protecting legally recognized rights.

Its relevance is analogical rather than a direct recognition of psychological or behavioral rights.

Thai CCC

Case 6. Thai first-instance criminal court decision concerning an insurance company's use of blood-alcohol test information (March 2024)

Important PDPA proceeding

Subject: Processing and disclosure of sensitive personal data

This proceeding concerned an insurance company that collected, used, and disclosed an individual's blood-alcohol test results and a photograph of the individual undergoing the test.

The disclosure was associated with the rejection of an insurance claim and caused the individual to allege reputational damage, discrimination, humiliation, and ill treatment.

The court considered Section 26(4) of the PDPA, which provides a legal basis for processing certain sensitive personal data when necessary to establish, exercise, or defend legal claims.

The court dismissed the case because it considered the processing necessary for the insurance company's legal claims.

Legal principles:

Health-related and other sensitive information receives special protection.

Explicit consent is not the only possible legal basis for processing.

The purpose and necessity of processing must be examined.

Disclosure of sensitive information can create serious reputational consequences.

Legal claims may justify processing in circumstances permitted by Section 26.

Relevance to behavioral insight rights:

This proceeding is particularly relevant when behavioral analytics involve alcohol-related assessments, psychological information, health-related predictions, or sensitive personal classifications.

Important qualification: This was a first-instance decision, not a final Supreme Court ruling establishing a general principle for behavioral profiling.

Tilleke & Gibbins

5. Behavioral insight rights in important civil-law sectors

A. Employment and workplace behavioral monitoring

Employers may use AI systems to evaluate employees through:

Attendance and punctuality.

Productivity measurements.

Communication patterns.

Workplace surveillance.

Emotional recognition.

Employee performance predictions.

Under Thai law, employers must consider the PDPA when collecting and processing identifiable employee information.

An employer should not assume that an employment contract automatically authorizes every form of psychological or behavioral monitoring.

Potential civil liability may arise where unlawful processing causes damage or where an inaccurate behavioral assessment is used in a wrongful manner.

B. Banking and financial services

Financial institutions increasingly use behavioral information to evaluate financial risk.

Examples include:

Spending patterns.

Transaction frequency.

Digital payment behavior.

Consumer purchasing habits.

Fraud-risk predictions.

Creditworthiness assessments.

The PDPA, financial-sector regulations, contractual principles, and applicable consumer protections may govern these activities.

A bank should distinguish legitimate fraud prevention from excessive collection or unfair use of personal behavioral information.

C. Healthcare and psychological assessments

Behavioral information can be especially sensitive in healthcare.

Examples include:

Psychological assessments.

Emotional-state monitoring.

Digital therapy applications.

AI mental-health predictions.

Patient behavioral records.

Biometric and neurological information.

Where the information constitutes health or biometric data, Section 26 of the PDPA becomes particularly important.

Healthcare professionals must also consider applicable professional confidentiality obligations.

D. Digital platforms and social media

Digital platforms may develop behavioral profiles using:

Search histories.

Browsing activities.

Online purchases.

Location information.

Social interactions.

Content preferences.

Facial and voice information.

The PDPA may apply even when the organization conducting the processing is located outside Thailand, if the statutory territorial conditions are met, including monitoring behavior taking place in Thailand.

Chambers+1

E. Insurance and behavioral risk assessment

Insurance companies may use behavioral information to evaluate risk, determine eligibility, and investigate claims.

However, they must consider:

Whether the data collection has a lawful basis.

Whether the information is accurate.

Whether sensitive information is involved.

Whether the processing is necessary for the stated purpose.

Whether disclosure is legally justified.

The 2024 insurance-data proceeding discussed above illustrates the importance of examining the actual legal basis rather than assuming that all sensitive-data processing requires consent or that all processing is automatically permissible.

6. Civil remedies for violations of behavioral insight rights

An individual whose behavioral information has been unlawfully collected, disclosed, or exploited may have several potential remedies.

Compensation under Section 77

A data controller or processor that violates the PDPA and causes damage may be required to compensate the affected individual regardless of whether the violation was intentional or negligent.

The statutory exceptions include force majeure, the data subject's own act or omission, and compliance with a lawful official order.

Punitive damages under Section 78

The court may award punitive damages in addition to actual compensation.

These additional damages cannot exceed twice the actual compensation amount.

Relevant considerations include:

Severity of the damage.

Benefits obtained by the responsible organization.

Financial position of the organization.

Remedial measures taken.

Contribution of the affected individual to the damage.

Administrative and criminal consequences

Depending on the violation, organizations may also face administrative penalties or criminal liability under the PDPA.

For example, Section 79 addresses certain unlawful uses or disclosures of sensitive personal data that cause or are likely to cause legally specified forms of harm.

7. Major legal challenges in Thailand

8. Future development of behavioral insight rights in Thailand

Thailand could strengthen its civil-law framework through several reforms.

1. Recognition of behavioral privacy

The legislature could expressly recognize protection against intrusive collection and exploitation of personal behavioral characteristics.

2. Transparency in AI profiling

Organizations using AI to produce significant behavioral assessments should explain the nature and purpose of the processing.

3. Protection against psychological manipulation

Legal safeguards could address systems that exploit psychological vulnerabilities to influence important personal or financial decisions.

4. Human oversight

High-impact automated decisions should have meaningful human review where appropriate, supported by applicable legal duties and sector-specific regulation.

5. Behavioral data accuracy

Individuals should have effective mechanisms to challenge inaccurate psychological assessments and misleading behavioral classifications.

6. Stronger remedies

Courts and regulators could develop clearer approaches to compensation for reputational, psychological, financial, and other damage resulting from unlawful behavioral-data processing.

7. Protection of vulnerable individuals

Special safeguards could be developed for children, elderly persons, and individuals vulnerable to manipulative digital practices.

9. Critical legal analysis

The principal difficulty in Thailand is the distinction between collecting behavioral information and exploiting behavioral intelligence.

For example, an online shopping platform may lawfully analyse purchasing patterns for a legitimate purpose under an applicable legal basis. However, using an individual's sensitive psychological information to manipulate that person into making harmful financial decisions may raise different legal questions.

Three separate interests should therefore be distinguished:

Behavioral privacy: Protection against unjustified observation and intrusion.

Behavioral data protection: Control over the lawful collection, use, and disclosure of identifiable behavioral information.

Behavioral autonomy: Protection of an individual's ability to make personal decisions without unlawful coercion or manipulation.

These interests overlap but are not legally identical.

The existing Thai framework provides stronger express protection for personal-data processing and privacy than it does for behavioral autonomy as an independent civil right.

10. Conclusion

Civil Law and Behavioral Insight Rights Recognition in Thailand is an emerging area involving constitutional privacy, personality rights, tort liability, consumer protection, and personal data regulation.

The Constitution, the Civil and Commercial Code, and the Personal Data Protection Act provide the principal legal foundations.

The six cases and proceedings discussed above demonstrate relevant judicial approaches to privacy, identity, confidentiality, wrongful interference, and sensitive personal-data processing. They do not establish a separate, fully developed behavioral insight right.

The most important legal conclusion is that Thailand can already protect many aspects of behavioral information through existing civil-law and data-protection principles, but comprehensive recognition of behavioral autonomy, psychological privacy, and protection against manipulative profiling remains an area for future legislative and judicial development.

11. Key legislation and cases for academic reference

Legislation

Constitution of the Kingdom of Thailand B.E. 2560 (2017), Section 32.

Civil and Commercial Code, Sections 18, 420, 421 and 423.

Personal Data Protection Act B.E. 2562 (2019), Sections 19–27, 30–37 and 77–79.

Consumer Protection Act B.E. 2522 (1979).

Criminal Code, Sections 322–325.

Judicial authorities

Supreme Court Judgment No. 4893/2558 (2015) – Privacy and intimate images.

Supreme Court Judgment No. 6355/2548 (2005) – Commercial exploitation of personal images.

First-instance judgment No. 47/2549 (2006) – Unauthorized commercial use of fashion models' images.

Supreme Court Judgment No. 1808/2561 (2018) – Concealment of material information and tort liability.

Supreme Court Judgment No. 5374/2561 (2018) – Interference with property-related rights.

First-instance criminal court proceeding (March 2024) – Insurance company processing and disclosure of sensitive personal data.

Research note: The case descriptions are presented according to their reported subject matter and relevance. The first-instance decisions should not be confused with binding Supreme Court authorities, and the property cases are included only as analogies under general tort principles.