1. Introduction

Biodigital Identity Rights Recognition in Thailand concerns the legal recognition and protection of an individual's identity when biological characteristics and digital technologies are combined to establish, verify, authenticate or represent that person's identity.

A biodigital identity may involve:

Fingerprints and fingerprint databases.

Facial-recognition information.

Iris and retinal scans.

DNA and genetic information.

Voiceprints and behavioural biometrics.

Digital identity cards and electronic identification.

Biometric authentication for banking and financial services.

Digital health records and biological identification.

AI-generated digital representations of individuals.

The central legal question is whether an individual retains effective control over their biological and digital identity when government authorities, financial institutions, hospitals, technology companies and other organisations collect or process identity information.

Thai law does not currently recognize a separate civil-law category called biodigital personality or biodigital identity ownership. Nevertheless, several existing legal frameworks provide protection through privacy, personal data, constitutional rights, civil liability and electronic transaction legislation.

The most important legislation is the Personal Data Protection Act B.E. 2562 (2019), the Civil and Commercial Code, the Constitution of Thailand B.E. 2560 (2017), and the Electronic Transactions Act B.E. 2544 (2001), as amended.

2. Legal framework governing biodigital identity in Thailand

A. Personal Data Protection Act B.E. 2562 (2019)

The PDPA is the principal legislation governing the processing of personal data in Thailand.

Section 6 – Personal data

Personal data means information relating to a living individual that enables the identification of that individual, directly or indirectly.

Biometric information capable of identifying a person therefore falls within the protection of the Act.

Section 19 – Consent

Consent must generally be obtained where consent is the applicable lawful basis for processing personal data.

Consent must be freely given, specific and informed. It must also be capable of being withdrawn, subject to the applicable statutory conditions.

Section 20 – Children's personal data

Special requirements apply to obtaining consent for processing children's personal data.

Section 23 – Privacy notices

Data controllers must provide relevant information concerning the purposes and details of personal data processing.

Section 24 – Lawful bases for processing

Personal data may be processed under specified lawful bases, including consent, contractual necessity, legal obligations and legitimate interests, subject to the statutory requirements.

Section 26 – Sensitive personal data

This is particularly important for biodigital identity.

It covers sensitive categories including:

Genetic data.

Biometric data processed using technical means to identify an individual.

Health information.

Other specially protected personal information.

Processing generally requires explicit consent unless a statutory exception applies.

Sections 37 and 40 – Security and processing responsibilities

These provisions establish important responsibilities concerning security measures, data-controller obligations and data-processor compliance.

Section 77 – Civil liability

A data controller or processor may incur civil liability for damage caused by unlawful processing, subject to the applicable statutory requirements.

Section 78 – Punitive damages

Courts may award punitive damages in qualifying circumstances, subject to the statutory limit.

The PDPA therefore provides a foundation for recognizing the individual's legal interest in protecting biological information used for digital identification.

B. Constitution of Thailand B.E. 2560 (2017)

The Constitution provides the fundamental rights foundation for biodigital identity protection.

Section 25 – Constitutional rights and liberties

Recognizes the protection of rights and liberties that individuals enjoy under the Constitution and applicable laws.

Section 26 – Restrictions on rights

Restrictions on constitutional rights must comply with the rule of law and proportionality requirements.

Section 27 – Equality

Protects equality before the law and prohibits unjust discrimination.

Section 32 – Privacy, dignity and reputation

This is particularly significant for biodigital identity.

It protects:

Personal privacy.

Human dignity.

Reputation.

Family rights.

Personal information against unauthorized exploitation.

Section 36 – Freedom of communication

Protects the confidentiality of communications and restricts unauthorized interception and disclosure, subject to legally recognized exceptions.

Section 32 provides an important constitutional foundation for challenging excessive collection or exploitation of biometric information.

Constitute+1

C. Electronic Transactions Act B.E. 2544 (2001)

The Electronic Transactions Act recognizes electronic records, electronic signatures and electronic authentication.

The 2019 amendments introduced express recognition of digital identity verification and authentication systems.

Its importance includes:

Recognition of electronic identity verification.

Legal recognition of electronic authentication.

Support for electronic contracts and transactions.

Greater reliability of electronic evidence.

Regulation of specified digital identity service providers.

The Royal Decree on Supervision of Service Businesses Relating to Digital Identification and Authentication Systems that Are Subject to Licensing B.E. 2565 (2022) establishes an additional regulatory framework for covered digital identity businesses.

สำนักเลขาธิการคณะรัฐมนตรี+2

D. Civil and Commercial Code

The Civil and Commercial Code provides remedies when biodigital identity violations cause legally recognized injury.

Section 420 is especially important where an organisation unlawfully obtains, manipulates, discloses or exploits a person's biometric identity and causes damage.

E. Computer-Related Crime Act B.E. 2550 (2007)

The Computer-Related Crime Act, as amended, is relevant when biodigital identity violations involve:

Unauthorized access to computer systems.

Unauthorized access to protected computer data.

Alteration or destruction of computer information.

Forged or false computer data.

Certain forms of digital impersonation and fraudulent activity.

It complements civil-law remedies where the identity violation also constitutes a computer-related offence.

3. Recognition of different biodigital identity rights

A. Biometric identity rights

Biometric identity is established through unique physiological or behavioural characteristics.

Examples include facial geometry, fingerprints, iris patterns and voiceprints.

Under Section 26 of the PDPA, biometric data processed using technical means for uniquely identifying a person receives sensitive-data protection.

The legal interests include:

Protection against unauthorized biometric collection.

Control over disclosure and further processing.

Protection against identity theft.

Security of biometric databases.

Protection against unauthorized commercial exploitation.

An important distinction is that protecting biometric information does not necessarily mean that a person owns every algorithm, database or digital record containing that information.

B. Genetic identity rights

DNA and genetic information can reveal highly sensitive information about individuals and their biological relatives.

The PDPA specifically includes genetic data within sensitive personal data.

Potential civil disputes include unauthorized DNA testing, disclosure of genetic reports, genetic discrimination and misuse of biological samples.

C. Facial identity and digital representation

Facial-recognition systems can identify individuals through digital images and biometric templates.

Legal disputes may arise when:

A company uses facial recognition without an appropriate lawful basis.

An individual's face is incorporated into an AI-generated identity.

Facial information is used for unauthorized authentication.

A digital impersonator creates a false identity.

Facial data is disclosed to third parties without legal justification.

D. Voice and behavioural identity

Voiceprints, typing patterns, movement patterns and behavioural biometrics may be used to authenticate individuals.

Where these data identify a living individual, the PDPA may apply.

The legal challenge is to distinguish ordinary personal information from biometric data processed specifically for unique identification.

E. Digital identity and legal personality

Thailand recognizes individuals as legal persons under its ordinary civil-law framework.

A digital identity, electronic account, biometric profile or AI-generated avatar does not independently acquire human legal personality merely because it represents an individual.

The actual individual remains the holder of the relevant human rights and legal responsibilities.

4. Important Thai judicial decisions and case laws

Important legal qualification: Thailand's reported jurisprudence specifically concerning biodigital identity is still developing. In particular, there is not yet a body of six reported Supreme Court judgments establishing a distinct biodigital identity doctrine. The following six decisions and judicial matters are relevant through privacy, digital impersonation, personal information, reputation and civil liability. They should not be represented as six direct biometric-identity precedents.

Case 1: Supreme Court Judgment No. 4893/2558

Subject: Privacy rights and unauthorized publication of intimate images

The case concerned the publication of intimate images of individuals without their consent.

The Supreme Court recognized that privacy is a legally protected right and that unauthorized publication can constitute a wrongful act under Section 420 of the Civil and Commercial Code.

Legal principles:

Privacy is a legally protected individual interest.

Unauthorized exploitation of private images can result in civil liability.

Freedom of expression does not automatically override another person's privacy.

Individuals may seek compensation for unlawful interference with protected personal interests.

Relevance to biodigital identity: The reasoning is relevant to unauthorized use of biometric photographs, facial images and digital representations.

Case 2: Supreme Court Judgment No. 4403/2566 (2023)

Subject: Digital publication and unauthorized distribution of intimate material

This decision concerned the online distribution of intimate images and videos.

The Supreme Court considered the legal consequences of distributing intimate digital material and the relationship between criminal offences and compensation for the affected individual.

Legal principles:

Digital publication can create legal liability.

Unauthorized distribution of intimate material can violate protected personal interests.

Digital evidence can establish the circumstances of unlawful publication.

Civil compensation may accompany criminal proceedings where legally justified.

Relevance to biodigital identity: The decision is relevant to misuse of facial images, biometric photographs and digitally manipulated representations.

Case 3: Supreme Court Judgment No. 976/2567 (2024)

Subject: Online broadcasting and reputational identity

This case concerned statements distributed through online political programmes, including YouTube and Facebook.

The Court considered whether the statements could identify and damage the reputation of the plaintiff even though the plaintiff was not expressly named.

Legal principles:

A person may be identifiable through indirect references.

Online publication can create reputational liability.

Digital communication can produce legal consequences similar to conventional publication.

Context is important when determining whether a person has been identified.

Relevance to biodigital identity: Digital identity protection must consider indirect identification, including AI-generated profiles and online representations.

Case 4: Supreme Court Judgment No. 89/2567 (2024)

Subject: Digital impersonation, computer data and fraudulent identity

This decision concerned conduct involving unauthorized computer access, alteration of data, false computer information, impersonation and forged documents.

The Supreme Court examined the relationship between the different offences and the defendant's criminal intent.

Legal principles:

Digital impersonation can attract criminal liability.

Electronic information may be used to establish fraudulent conduct.

Altering another person's digital information can have serious legal consequences.

Identity-related computer offences must be assessed according to the applicable statutory elements.

Relevance to biodigital identity: The decision is relevant to fraudulent use of digital identification, compromised identity credentials and false electronic identities.

Case 5: Supreme Court Judgment No. 2534/2565 (2022)

Subject: Digital communications, photographs and evidentiary requirements

The case involved allegations arising from a telephone conversation, a police report and the subsequent distribution of information through a LINE group.

The Supreme Court examined whether the criminal allegations sufficiently described the alleged false information and satisfied the procedural requirements of the Criminal Procedure Code.

Legal principles:

Digital communications must be evaluated according to their actual content.

Allegations involving electronic information must be sufficiently specific.

The legal character of an online communication depends on the statutory requirements.

Digital evidence does not eliminate the need to satisfy procedural safeguards.

Relevance to biodigital identity: The decision provides an evidentiary perspective for disputes involving false digital identity information and online impersonation.

Case 6: Thai First-Instance Personal Data Protection Judgment, March 2024

Subject: Unauthorized collection and disclosure of sensitive personal information

This is an important Thai personal-data protection judgment involving an insurance company.

The plaintiff's blood-alcohol test results and a photograph taken during the test were collected, used and disclosed without the required explicit consent.

The information was disclosed to an insured family member and allegedly caused reputational injury, humiliation and discriminatory treatment.

The court considered the application of Section 26 of the PDPA to sensitive personal data and the consequences of unlawful processing.

Legal principles:

Sensitive personal information receives enhanced legal protection.

Collection and disclosure must have an appropriate legal basis.

Improper disclosure may create civil liability.

The purpose and circumstances of processing are important in determining legality.

Relevance to biodigital identity: This decision is particularly useful because it demonstrates judicial consideration of sensitive biological and photographic information under Thailand's data-protection framework.

The publicly available account identifies this as a first-instance judgment but does not provide a verified Supreme Court judgment number. It should not be cited as a Supreme Court precedent.

Thai CCC+3

Overall judicial significance: These decisions provide useful analogies for protecting personal identity, privacy and digital information. They do not establish that biometric information is an independently owned item of property or that Thailand has already recognized a standalone civil right of biodigital identity.

5. Civil liability for biodigital identity violations

Thai civil law can provide remedies where biodigital identity violations cause legally recognized harm.

A. Unauthorized biometric collection

Suppose a private company collects fingerprints from customers without obtaining an appropriate legal basis.

Potential legal issues include:

Violation of Section 26 of the PDPA.

Failure to satisfy applicable transparency requirements.

Inadequate security arrangements.

Civil liability under Sections 77–78 of the PDPA, where their requirements are met.

B. Biometric identity theft

Suppose a criminal obtains another person's facial-recognition template and uses it to access a financial account.

The matter may involve:

Unlawful processing of personal data.

Unauthorized access to computer systems.

Fraudulent electronic transactions.

Civil liability for financial losses.

Potential criminal liability.

C. Unauthorized genetic information disclosure

Suppose a hospital discloses a patient's DNA report to an unauthorized third party.

The affected individual may have claims relating to sensitive personal data, confidentiality and civil liability.

D. AI-generated identity manipulation

Suppose an AI system creates a false digital representation of an individual using their facial image and voice.

Depending on the facts, potential claims may involve:

Privacy violations.

Unlawful personal data processing.

Defamation.

Computer-related offences.

Compensation for financial and non-financial injury where legally recoverable.

6. Recognition of ownership versus control over biodigital identity

One of the most important theoretical questions is whether an individual owns their biodigital identity.

Thai law requires several concepts to be distinguished.

The PDPA principally provides data-protection rights rather than an unrestricted proprietary right over every copy or representation of personal data.

Accordingly, an organisation may lawfully process certain identity information when a valid legal basis exists, but it does not thereby acquire unrestricted rights over the individual's identity.

7. Institutional responsibilities

Several Thai institutions have important responsibilities in biodigital identity governance.

The ETDA's digital identity framework includes identity-proofing and authentication standards. Thailand also regulates certain digital identity service businesses through the 2022 Royal Decree.

สพธอ.+2

8. Major challenges in biodigital identity recognition

Thailand faces several legal and technological challenges:

Biometric data ownership: Lack of a separate statutory framework defining ownership and control over biometric identity.

Identity theft: Increasing risks of fingerprint, facial and voice impersonation.

AI-generated identities: Difficulties distinguishing authentic identities from synthetic representations.

Genetic privacy: Risks arising from unauthorized genetic testing and disclosure.

Cross-border processing: Difficulties controlling biometric information transferred to foreign organisations.

Children's identity protection: Special concerns regarding biometric databases created before individuals reach adulthood.

Identity after death: Questions concerning genetic information, digital accounts and posthumous identity representations.

Public surveillance: Balancing security objectives against constitutional privacy rights.

9. Suggestions for legal reform in Thailand

Thailand could strengthen biodigital identity recognition through the following reforms.

1. Recognition of biodigital identity rights

Develop an express statutory framework recognizing an individual's interests in their biological and digitally represented identity.

2. Stronger biometric consent protections

Introduce clearer requirements for collecting, retaining, sharing and deleting biometric information.

3. Protection against digital impersonation

Strengthen civil remedies for unauthorized facial, voice and genetic identity exploitation.

4. AI identity accountability

Establish responsibilities for developers and operators of AI systems that create or manipulate identifiable digital representations.

5. Genetic privacy safeguards

Strengthen protections concerning DNA testing, genetic databases and unauthorized disclosure of genetic information.

6. Children's biodigital identity protection

Introduce safeguards for long-term storage and future use of children's biometric and genetic information.

7. Cross-border identity protection

Improve oversight of international transfers and foreign processing of sensitive biometric information.

8. Accessible civil remedies

Improve mechanisms for compensation, injunctions, correction and deletion of unlawfully processed identity information.

10. Comparative legal perspective

Thailand can also consider developments in other jurisdictions.

These approaches may provide useful models for developing stronger Thai protections, although their legal rules cannot automatically be applied in Thailand.

11. Conclusion

Biodigital Identity Rights Recognition in Thailand is an emerging area of civil law involving privacy, human dignity, biometric data, electronic authentication, genetic information and digital impersonation.

The Thai Constitution, particularly Section 32, provides an important foundation for privacy and dignity. The PDPA B.E. 2562 provides specific protection for biometric and genetic information, while the Electronic Transactions Act establishes legal recognition of digital identity verification and authentication.

The Civil and Commercial Code, especially Section 420, provides additional remedies where unlawful conduct causes damage.

The six judicial matters discussed demonstrate relevant principles from Thai privacy, digital publication, impersonation and personal-data litigation. However, Thailand has not yet established six reported Supreme Court precedents specifically recognizing an independent biodigital identity right.

The central legal principle is that an individual's biological characteristics and digital representations deserve meaningful legal protection, even where the information is processed, stored or authenticated by another person or organisation.

This analysis is intended for academic and legal research. Exact judgment texts and current statutory provisions should be verified before relying on them in litigation.