## 6 Discussion  
This research investigated the feasibility and effectiveness of an AI-driven system using combined OCR and LLM techniques for automated personal data redaction on drug labels. The system specifically aimed for compliance with the Thai PDPA. It demonstrated a promising capability, achieving high redaction precision (92.5%) and reasonable recall (83.2%) coupled with a low over-redaction rate (3.1%). These results suggest potential for significantly reducing manual compliance efforts while preserving label utility. This was further supported by qualitative analysis where essential information remained understandable post-redaction.  
The core strength lies in the system's automation and the LLM's context-aware redaction capabilities. These offer advantages over static rule-based methods by handling language variations and identifying PII semantically [11]. This adaptability is crucial for the complexities of real-world labels and PDPA nuances. Additionally, combining EasyOCR and Tesseract improved text extraction recall over using a single engine [9; 10].  
However, several limitations must be acknowledged. Firstly, the evaluation presented herein is based on a dataset of 100 label images, predominantly in Thai (Section 4.1). This dataset's size and limited diversity may not fully capture the extensive variability in real-world labels (different languages, formats, and qualities). Consequently, while sufficient for this initial feasibility study, the generalizability and robustness of the reported performance metrics require further validation on larger, more diverse datasets.  
Secondly, the system's overall performance is intrinsically linked to the underlying OCR accuracy. Errors in text extraction, particularly with the complex Thai script or degraded image quality, were the primary cause of missed redactions (false negatives) [15]. This highlights the ongoing need for robust OCR advancements [12].  
Thirdly, while the LLM showed strong capabilities using pre-trained models and prompt engineering, it occasionally misinterpreted non-PII (false positives). More critically, it relied on simplified PDPA guidelines provided via the prompt. This approach may not adequately capture the full complexity and potential ambiguities of the legal text. The system's ability to handle nuanced legal definitions and challenging edge cases (e.g., ambiguous text strings, partially redacted information potentially allowing re-identification) without domain-specific fine-tuning or explicit legal validation remains a significant limitation. This underscores the difficulty in fully replicating nuanced human legal judgment with current AI models alone. It highlights the critical need for validation by legal professionals and potentially human oversight in practical deployment scenarios, as discussed further in Section 7.  
Finally, transitioning this system to a production environment requires careful consideration of practical aspects, particularly data security when interacting with external services. As noted in Section 3.2, our prototype utilized an external LLM API. While only text segments were transmitted, reliance on third-party services necessitates robust security measures beyond standard protocols for operational deployment under PDPA. This demands thorough vetting or alternative architectures like on-premise models, as discussed further in Section 7.