Thailand’s new proposed Cyber Security Law indicates increased surveillance and risks of legal action against information technology (IT) and social media companies.

• The plan is legally binding as it is stipulated from Thailand’s 2017 Constitution; planned resources allocated to key areas reveal that the plan is mostly a reform on bureaucratic and legal processes.
• The establishment of a special agency and setting-up of a Cyber Security Law will probably worsen the operating environment for social media companies by increasing the power of the government to use legal means to obtain private user data.
• The implementation of the reform plan depends on how long the military government stays in power; potential further delays of the general election beyond February 2019 will favor the plan.

On 7 April, the Royal Thai Government Gazette officially published the Thailand National Reform Plans. The plan, finalized by the Office of the National Economic and Social Development Board and the National Legislative Assembly, covers 11 areas and serves as a directive for the first five years from 2018 to 2022 for the 20-year national strategy, Thailand’s long-term vision, outlined by the new 2017 Constitution. Prime Minister General Prayut Chan-o-cha has voiced his support of the plan, and Deputy Prime Minister Wissanu Krea-ngam has announced that the plan is legally binding and state agencies must implement it.

Plan proposed for IT sector heightens operational risk for businesses
A breakdown of resources reveals that the focus is on reforms in bureaucracy and administration (see chart). The plan noted that the “Pracharat” policy – co-ordination between big corporations and government bureaucracy – is the main driving force to achieve reforms. However, the plan on information technology (IT) focuses on national security, and its language highlights elevated risk to IT and media companies.

There are five specific measures:

• Establishing a single point of contact to communicate with IT service providers
• Establishing an agency with prosecutorial power to file civil action against service providers
• Establishing a clearing house to process complaints
• Amending the Revenue Code to authorise taxation of online business from abroad
• Promulgating a Cyber Security Law

Implementation of the plan will be relatively easy because Thailand already has an existing Computer Crime Act, which allows the government to block access to any content deemed harmful and prosecute users accused of spreading harmful information, especially related to the monarchy.

Agency with prosecutorial power and Cyber Security Law will affect all companies with online presence
A key area of the IT section is tightening regulation on online media, which includes increased surveillance and more effective measures to demand accountability from online media providers such as Facebook, Line, Twitter, and YouTube (specifically mentioned in the plan). The most significant measures are the second and fifth points from the list above. According to our sources, the plan is probably a result of previous unsuccessful attempts to request social media companies to provide users’ private information. The new reform plan opens up possibilities of the government invoking tort lawsuits according to the Civil and Commercial Code, with social media companies facing heavy penalties if they do not co-operate.

In addition, the proposed Cyber Security Law will equip the government with increased power to create a single gateway and control all traffic in and out of the country. The law is probably designed to enhance the control of the National Council for Peace and Order (NCPO; Thailand’s military government), rather than promote business efficiency. Businesses other than social media companies will also probably be affected because of the widespread use of online business transactions. Furthermore, government capability in managing and maintaining a gateway secure and large enough to facilitate the law’s implementation remains questionable, which raises the likelihood of payment delays, arbitrary disruptions, and regulatory uncertainty when the law is implemented.

Setting up new agencies can be achieved within months. The amendment to the Revenue Code and the promulgation of the Cyber Security Law will take a longer time. Currently, there are no details of how the Revenue Code will be amended. It will probably target foreign businesses whose income is made on the internet in Thailand through selling advertisement or online shopping. However, how the government will enforce the plan is unknown.

Outlook and implications
Despite passing the National Reform Plans, the military government still faces a major headwind before they can be implemented. Lawmakers have already expressed that the plan is impractical, with important aspects being weak and insufficient, such as combating corruption. Democrat Party (traditionally the more conservative party) leaders have expressed intentions to propose changes in the constitution to amend the reform plan.

Key indicators of the likelihood of implementation include the date of the general election. If the election is delayed beyond 2019, the implementation of the fourth and fifth measures should be achieved with relative ease by the military government. The National Legislative Assembly (NLA) is appointed by, and under strong influence of, the NCPO. These non-partisan lawmakers have passed several controversial acts without issues. A civilian-elected government in 2019 will hinder the implementation of the plan because of lawmakers’ expressed skepticism in the feasibility and effectiveness of the plan. It will be more complicated if the new government replaces the NCPO in 2019.

Whether or not the election takes place on time in 2019, Thailand’s policy-making process will probably be increasingly uncertain. Post-election parliament will probably be fragmented with small parties fighting with one another. There remains a significant possibility that the National Reform Plans will be delayed or neglected. This will not be unprecedented – from 1997 to 2013, several reforms mandated by constitutions never materialized because of legislative paralysis.

A further indicator would be resistance from business groups. Thai governments have a record of using generous transfer payments to low-income populations for political support and to drive economic growth. Business confidence and investment sentiment remain low in Thailand because of sluggish domestic demand, low growth in household spending, and greater competition from low-cost manufacturing centres in the ASEAN region. Business groups, headed by large conglomerates, will probably have substantial leverage over the military government and any potential civilian governments.