On 24 November 2025, the Office of the Personal Data Protection Committee (“PDPC Office”) identified non-compliant activities carried out by a well-known iris-scanning service provider (the “Service Provider”) under the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). The Service Provider had offered iris-scanning services to the public, whereby individuals were requested to provide their consent and undergo iris scanning to verify their humanity, in return for receiving cryptocurrency on a monthly basis.
In this regard, the PDPC Office said that the Service Provider’s business operations were conducted in violation of the PDPA, particularly in relation to the unlawful obtaining of consent whereby (i) the consents provided by individuals were not freely given, and (ii) the purposes for the collection, use, and disclosure of biometric data were not adequately disclosed to the individuals.
Following discussions with the Service Provider, the PDPC Office explained that the lack of freely given consent arose from the fact that individuals’ participation was influenced by the incentive of receiving cryptocurrency, rather than based on a genuine and voluntary decision to allow the collection of their iris data. This practice was deemed inconsistent with internationally recognized data protection principles, which require consent to be freely given and not obtained through any kind of inducement or undue influence.
With respect to the insufficiency of purpose notification, the PDPC Office found that the Service Provider informed individuals only that their iris data would be used to verify their humanity and that, thereafter, such data would be converted into encoded information incapable of re-identifying individuals. However, system testing conducted by the PDPC Office revealed that, upon re-scanning, the system was still able to recognize previously scanned iris data. This demonstrated that the system retained the capability to identify individual users. Accordingly, the PDPC Office emphasized that the purposes relating to authentication and identity verification must be clearly disclosed to individuals prior to the collection of their biometric data.
In addition to the two non-compliant practices identified above, the PDPC Office indicated that there may be other aspects of the Service Provider’s operations requiring further assessment to determine overall compliance with the PDPA.
As interim measures, the PDPC Office ordered the Service Provider to remedy its non-compliance within seven days from the date of the order by undertaking the following actions:
- Immediately suspend and cease the collection of biometric data through iris-scanning activities conducted in exchange for cryptocurrency; and
- Delete all biometric data and other related personal data of approximately 1.2 million individuals in their entirety.
If the Service Provider does not comply to the PDPC’s order, the PDPC Office would fine the Service Provider at 500,000 Baht a day. While, a penalty for its non-compliant activities could be up to 5 million Baht per account; yet, this is still under consideration of relevant factors.