Cross-border data flows: the agreements on the usage of personal data across borders and business opportunities for Thai entrepreneurs

Presently, cross-border data flows are imperative for business expansion and global trade as they have driven global economic growth by 0.3%, or around USD2.6 trillion in value, over the past decade. Business organizations must rely on cross-border data flows in order to better understand the market and customers, as well as for international trade and supply chain management. However, rapid transmission of cross-border data in line with thriving internet services has triggered many countries to be concerned about violations of personal data and national security, and has led to the introduction of personal data protection laws, as well as putting limitations on cross-border personal data outflows by invariably refusing the transmission of personal data to countries with lower personal data protection standards.

To reduce the impact of such limitations on the business sector, many countries have formed groups to set common data protection standards to achieve the free flow of data and to reduce the cross-border business restrictions. However, their efforts may give rise to data isolation among different groups, and this could inhibit cross-border business operations, especially trade, later on. Nevertheless, businesses will take into consideration the factor of cross-border personal data flows in choosing their investment destinations in the future.

Although Thailand has personal data protection laws that meet international standards and are in line with the ASEAN framework on personal data protection, the next important challenge is negotiations to join a group with free cross-border data flows to strengthen Thailand's position in accommodating and attracting new investment, as well as offering local entrepreneurs greater convenience in conducting businesses in the future. Currently, the groups of countries with free flows of personal data across borders are the General Data Protection Regulation (GDPR), the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, excluding Vietnam), the United States-Mexico-Canada Agreement (USMCA), the Association of South East Asian Nations (ASEAN, excluding Vietnam) and the APEC Cross-Border Privacy Rules (APEC CBPR), but Thailand is a member of the ASEAN only. Meanwhile, China, Russia, Vietnam and India are among the countries that restrict cross-border data flows.