Thailand’s biometric data collection stirs debate for Myanmar nationals

Hailed as a success by the Thai government, the pilot project could see another expansion.
Kiana Duncan for RFA
Mae Sot, Thailand
Thailand’s biometric data collection stirs debate for Myanmar nationals A woman wearing a protective face mask walks past a painted Thai flag in a street amid the coronavirus disease (COVID-19) outbreak in Bangkok, Thailand, March 26, 2020.
Jorge Silva/Reuters

Thailand is piloting a biometric data collection program across five provinces, seeking to streamline health services for Myanmar nationals and stateless people – the country’s most mobile population. 

With biometric details, including facial and iris scans, collected from 10,000 people, the program has already garnered praise for alleviating concerns over the identification of migrants. Yet, its implementation has activists worrying about Thailand’s evolving privacy landscape.

At the heart of the project is the efficient allocation of HPV and COVID-19 vaccines – a logistical hurdle for the transient. The program is being spearheaded by the Department of Disease Control in partnership with the National Electronics and Computer Technology Center and the Thai Red Cross Society.

“[There are] maybe at least two or three times [doses] for each person. So we have to know whether this person already got a vaccination for the first time or the second time, so we can give the next dose properly,” said Chai Wutitiwatchai, the technology center’s director.

The plan is to compile a million profiles using iris and facial scans alongside personal data. 

The provinces chosen, including Tak, Samut Sakhon and Prachuap Khiri Khan, are home to significant communities of Myanmar people, ranging from Civil Disobedience Movement activists – who quit their jobs to protest against military rulers – to asylum-seekers and laborers. 

Declared a success by the Department of Disease Control, the office’s representatives told Thai media it could expand to other provinces.

Privacy concerns

Pichit Siriwan, the Red Cross’s deputy director of relief and the community health bureau, highlights the voluntary nature of the data provision, assuring that healthcare will not be denied to those uncomfortable with the process. 

“The faces and irises of the undocumented patients who visit health service outlets or displaced persons in the temporary shelters who seek vaccination will be scanned or taken,” Pichit told Radio Free Asia, a news organizaion affiliated with BenarNews.

“Then we will acquire a 13-digit ID with the Mo Prom app. One can refuse if one feels not comfortable with that. They still can receive the service.”

A migrant worker from Myanmar receives the Sinovac COVID-19 vaccine in Phuket, Thailand, June 28, 2021. [Jorge Silva/Reuters]

But some digital activists remain uncertain whether biometric data from sensitive groups is safe to collect and store.   

The centralization of personal data was particularly troubling for Myanmar nationals living in Thailand, according to a spokesperson at Myanmar Internet Project, a group documenting the country’s internet landscape. 

“This is concerning for us on a next level. We don’t actually know how this data will be shared,” said the official at the organization who declined to be named for security reasons.

“As Myanmar exiles, we are very concerned this kind of data will be shared with different authorities, particularly on the Myanmar side.”

The Red Cross, which will be responsible for storing the data and developing policy around it, including how it may be shared, rejected the possibility of collaborating with cross-border projects, including Myanmar’s junta-launched e-ID program. 

Iris and facial scans would not be shared with state or private agencies, Pichit added.

However, the Red Cross still can tell state agencies and humanitarian organizations “whether certain individuals had biometrics collected already and had the 13-digit I.D. or not,” according to Pichit.

Police impunity

Other precedents like police impunity in migrant-populated areas leave some cautious of how far officials may go to get information they want, especially with hospitals under the Ministry of Public Health.

“From my experience in the [Thai] Deep South, security, military officials often asked for individual information from hospitals,” said Supat Hasuwannakit, president of the Rural Doctor Society.

“They have both official and unofficial channels to seek such data. When it is official with a government letter, we have to follow them.”

Additional legislation forthcoming from Thai authorities proposes a national database for DNA and other biometric information collected from 400,000 cases and 10,000 inmates per year.

The Red Cross said that in all cases, they would not risk the security of a patient by sharing facial or iris scans “to the police or any other agencies.” 

However, the organization added it would have to share the data if it were court-ordered. 

Myanmar migrant workers buy snacks from a vendor as they have been stuck for two weeks due to lockdown measures after more than a thousand COVID-19 cases were detected in the workers’ dormitory in Bangkok, May 24, 2021. [Soe Zeya Tun/Reuters]

Thailand’s fledgling privacy policy, as well as a major data leak in 2023, has left others uncertain about data security. 

In March 2023, Supat from the Rural Doctor Society became a whistleblower on a leak of 55 million Thai citizen identities. At that time, the society claimed the leak occurred from a private developer of the Mo Prom app.

Data privacy law

Thailand passed its first and only data privacy law in 2022, but critics say it is still too weak to provide adequate protection.

It also has significant loopholes allowing data to be used and collected without explicit consent “for life-saving purposes, statistical research, public benefit or to protect one’s rights and interests,” if it is done “via contract and under the authority of law.”

“Although that’s a good kind of basic legislation, it’s actually not efficient enough,” said the Myanmar Internet Project spokesperson.

For some, the project was eerily similar to one carried out in Bangladesh. In a controversial U.N. case in 2021, nearly a million identities of Rohingya refugees were turned over to the Bangladesh and Myanmar officials, causing some to go into hiding. 

Volunteers give free food for migrant workers from Myanmar who lost their jobs following the coronavirus disease (COVID-19) outbreak in Bangkok, April 23, 2020. [Soe Zeya Tun/Reuters]

In the past, registering directly with the Ministry of Public made some migrants uneasy, even if it was to receive basic public health services, said Chai from the technology center. 

Going through a non-government organization makes some feel more comfortable. 

“You know, they’re quite afraid of showing themselves to the state by making an official registration,” he added. “But if they’re just giving a picture of their face or even their iris pattern, they don’t much care about showing themselves to the public.”

The Ministry of Public Health’s Department of Disease Control did not respond to RFA’s inquiries as of this writing. 


Add your comment by filling out the form below in plain text. Comments are approved by a moderator and can be edited in accordance with RFAs Terms of Use. Comments will not appear in real time. RFA is not responsible for the content of the postings. Please, be respectful of others' point of view and stick to the facts.