PDPC Fines Major It Products Retailer THB 7 Million Following Data Breach

On 21^st August 2024, the Personal Data Protection Committee (PDPC) of Thailand's Ministry of Digital Economy and Society (MDES) announced that it had issued a fine of THB 7 million on J.I.B. Computer Group Co., Ltd. (JIB) for violations of the Personal Data Protection Act (PDPA) following a data breach. The PDPC noted that it was the first administrative fine issued under the PDPA.

The PDPC reported that a data breach occurred at JIB, an online IT products retailer, leading to the unauthorized exposure of personal data to a call center group known for using such information to perpetrate fraud.

Following the investigation, the PDPC determined that the company had violated:

• Section 41 PDPA by failing to appoint a data protection officer (DPO), despite processing personal data for over 100,000 individuals as part of its core business;