Data Privacy Law in the Language of Trust Relationship in U.S. and Singapore: A Model for Thai Personal Data Protection

This dissertation aims at a better understanding of the role of data privacy law in/npromoting organization-individual trust relationship. It focuses on data security breaches/nin U.S. and Singapore, and the interactions of the regulatory designs, agency/nimplementations and the emergence of organization’s post-breach responses towards/naffected individuals that reflects and reinforces the value of trust in their relationship./nExamining the divergent approaches adopted by U.S. and Singapore provides lessons for/na regulatory design for privacy in Thailand./nBased on the comparative analysis of the selected data security breach decisions from the/nkey regulators in both jurisdictions—the Federal Trade Commission (FTC) and the/nPersonal Data Protection Commission (PDPC)—and on the U.S. and Singapore’s/norganizational perception of privacy, the study found a divergence as to the U.S. and/nSingapore design and enforcement approach to individual-organization trust relationship./nThe non-right-based privacy of the Singaporean Personal Data Protection Act, coupled/nwith the enforcement agency’s interpretation, constructs the direct venue and the gap for/norganizations to perform trustful behaviors towards individuals following the breach./nDesirable post-breach responses from organizations are consistently witnessed from the/nPDPC decisions such as voluntary and prompt notification and remedies provided to/nindividuals, and the Personal Data Protection Commission’s interpretation covers/nindividual interests informed by values in the society. The regulatory design aligns its ‘no/nideal of privacy’ with the organization’s perception and more established practices based/non trust relationship on the ground and the PDPC mitigating criteria applied to induce/norganization in initiating voluntary post-breach responses towards better protection of/nindividual privacy interests./nDespite more established culture of privacy among U.S. corporations, the integrated/npractices on the ground, and the long-standing enforcement against unreasonable data/nsecurity practices under Section 5 of the FTC Act, its current mechanism does not/nfacilitate a venue for trust relationships that drive organizational post-breach responses/ntowards individuals. Unlike the PDPC, the FTC enforcement does not formally recognize/npost-breach responses of organizations consistently. In a small number of cases where/nthose post-breach responses were recognized, only limited normative implications can be/ninferred from those contexts. Much ambiguity and uncertainty due to the unclear/nboundary of liabilities set under Section 5 has left organization actors with high risks,/nwithout adequate assurance for organizations to perform desirable post-breach behaviors./nThe legal ideal of U.S. privacy rightness, as exemplified by Section 5, is based on the/nnotions of self-control, independence and informational duties, and does not cover/nbroader individual privacy interests, which could be promoted through trust relationships./nThe U.S.’s consumer protection approach, in tandem with Singapore’s trust relationship/nbased approach of Singapore provide a great lens for Thailand to meet the dual legal/nideals of privacy rightness and promoting trust relationship. Thai specific conditions and/nthis hybrid iteration have led to the implementation in a complementary ways. The/npending Personal Data Protection Bill of 2018 and regulatory oversight should allow/norganizations with some limited space to practice exercising discretion towards desirable/npost-breach responses, alongside mitigating penalties imposed by the regulator to/nencourage these desirable practices. Rather than treating the breach notification and/npost-breach responses as reporting duties, the Thai Bill could offer an opportunity to/ncultivate privacy awareness and enhance an organization’s trustful behaviors towards/naffected individuals. The consumer protection provisions regarding advertisings could be/ninterpreted by the Thai consumer protection agency to trigger investigations against/nunfair and deceptive data security practices, and regulate consumer contracts in/nbusinesses involved in handling sensitive personal data. This consumer protection-based/nmodel would provide a readily available means to protect consumer privacy interests,/nengage media and public vigilance to uncover breach incidents and increase individual/nand organizational awareness of privacy and data security.

Advisor: Mayali, Laurent