The Right Not to Be Subject to Automated Decision-Making in the Age of Artificial Intelligence: A Comparative Legal Analysis of Thailand's Personal Data Protection Act and the EU GDPR and AI Act Frameworks

Abstract

            Background and Objectives: The rapid development of artificial intelligence (AI) technology has significantly transformed personal data processing, particularly through AI-driven Automated Decision-Making (ADM) in credit assessment, personnel screening, and insurance risk evaluation, while Thailand's Personal Data Protection Act B.E. 2562 (PDPA) still lacks protective provisions equivalent to the European Union framework. This research article aims to 1) analyse the principles and protection mechanisms of the right not to be subject to automated decision-making under GDPR Article 22, EU AI Act Article 86, and CJEU jurisprudence; 2) analyse and classify the legal gaps of the PDPA B.E. 2562 concerning the protection of data subjects from automated decision-making; 3) comparatively analyse the legal mechanisms of both systems using the Functional Equivalence Method; and 4) propose recommendations for improving Thai law to enhance the protection of data subjects in the context of artificial intelligence.

             Research Methodology: This study is qualitative research conducted through documentary research, using Doctrinal Legal Research combined with Functional Equivalence comparative analysis following Zweigert and Kötz. The scope of primary sources covers GDPR Articles 4, 13–15, 22 and 35 together with Recitals 71–73; EU AI Act Articles 3, 5, 6, 9, 14, 59 and 86; CJEU case law in SCHUFA Holding (C-634/21) and Dun & Bradstreet Austria (C-203/22); EDPB guidelines (WP251 rev.01 and Opinion 28/2024); and the PDPA B.E. 2562 with its secondary legislation. Data were analysed through three mechanisms: doctrinal analysis, functional equivalence comparative analysis, and gap analysis.

           Results: The research found that 1) the EU framework employs a Four-Tiered Protection System: (1) GDPR Article 22 establishing a prohibition with three exceptions and mandatory safeguards, including human intervention, the right to contest, and algorithmic explanation; (2) EU AI Act Articles 14 and 86 requiring Human Oversight-by-Design; (3) CJEU case law establishing the Determining Role Test and the standard of procedures and principles actually applied; and (4) EDPB Soft Law measures; and 2) the PDPA contains five legal gaps, namely the absence of a right to refuse ADM, the lack of profiling oversight, insufficient algorithmic transparency, the absence of DPIA provisions, and weak enforcement mechanisms, resulting in a Multidimensional Structural Divergence between the two legal systems.

           Conclusion: The researcher proposes, as the researcher's own recommendation, amending the PDPA by enacting Section 32/1 to recognise the right not to be subject to automated decision-making, imposing duties of meaningful human intervention, algorithmic transparency, and mandatory DPIA for high-risk ADM, together with urgent interim measures through PDPC guidelines.