Thailand has piloted a biometric data collection program across five provinces, seeking to streamline health services for Myanmar nationals and stateless people – Thailand’s most mobile population.
With biometric details, including facial and iris scans, collected from 10,000 people, the program has already garnered praise for alleviating migrant identification concerns. Yet, its implementation has sparked activist concerns over Thailand’s evolving privacy landscape.
At the heart of the project, spearheaded by Thailand’s Department of Disease Control in partnership with the National Electronics and Computer Technology Center and Thai Red Cross Society, is the efficient allocation of HPV and COVID-19 vaccines – a logistical hurdle for the transient.
“[There are] maybe at least two or three times [doses] for each person. So we have to know whether this person already got a vaccination for the first time or the second time, so we can give the next dose properly,” said Chai Wutitiwatchai, the technology center’s director.
The plan is to compile a million profiles using iris and facial scans alongside personal data.
The provinces chosen, including Tak, Samut Sakhon and Prachuap Khiri Khan, are home to significant communities of Myanmar people, ranging from Civil Disobedience Movement activists – who quit their jobs to protest against military rulers – to asylum-seekers and laborers.
Declared a success by the Department of Disease Control, the office's representatives told Thai media it could expand to other provinces.
Privacy concerns
Pichit Siriwan, Red Cross’s deputy director of relief and community health bureau, highlights the voluntary nature of the date provision, assuring that healthcare will not be denied to those uncomfortable with the process.
“The faces and irises of the undocumented patients who visit health service outlets or displaced persons in the temporary shelters who seek vaccination will be scanned or taken,” Pichit told Radio Free Asia.
“Then we will acquire a 13-digit ID with the Mo Prom app. One can refuse if one feels not comfortable with that. They still can receive the service.”
But some digital activists remain uncertain whether biometric data from sensitive groups is safe to collect and store.
The centralization of personal data was particularly troubling for Myanmar nationals living in Thailand, according to a spokesperson at Myanmar Internet Project, a group documenting the country’s internet landscape.
“This is concerning for us on a next level. We don’t actually know how this data will be shared,” said the official at the organization who declined to be named for security reasons. “As Myanmar exiles, we are very concerned this kind of data will be shared with different authorities, particularly on the Myanmar side.”
The Red Cross, which will be responsible for storing the data and developing policy around it, including how it may be shared, rejected the possibility of collaborating with cross-border projects, including Myanmar’s junta-launched e-ID program.
Iris and facial scans would not be shared with state or private agencies, Pichit added.
However, the Red Cross still can tell state agencies and humanitarian organizations “whether certain individuals had biometrics collected already and had the 13-digit I.D. or not,” according to Pichit.
Police impunity
Other precedents like police impunity in migrant-populated areas leave some cautious of how far officials may go to get information they want, especially with hospitals under the Ministry of Public Health.
“From my experience in the deep South, security, military officials often asked for individual information from hospitals,” said Supat Hasuwannakit, president of the Rural Doctor Society. “They have both official and unofficial channels to seek such data. When it is official with a government letter, we have to follow them.”
Additional legislation forthcoming from Thai authorities proposes a national database for DNA and other biometric information collected from 400,000 cases and 10,000 inmates per year.
The Red Cross said that in all cases, they would not risk the security of a patient by sharing facial or iris scans “to the police or any other agencies.”
However, the organization added it would have to share the data if it were court-ordered.
Thailand’s fledgling privacy policy, as well as a major data leak in 2023, has left others uncertain about data security.
In March 2023, Supat from the Rural Doctor Society became a whistleblower on a leak of 55 million Thai citizen identities. At that time, the society claimed the leak occurred from a private developer of the Mo Prom app.
Data privacy law
Thailand passed its first and only data privacy law in 2022, but critics say it is still too weak to provide adequate protection. It also has significant loopholes allowing data to be used and collected without explicit consent "for life-saving purposes, statistical research, public benefit or to protect one's rights and interests," if it is done "via contract and under the authority of law."
“Although that’s a good kind of basic legislation, it’s actually not efficient enough,” said the Myanmar Internet Project spokesperson.
For some, the project was eerily similar to one carried out in Bangladesh. In a controversial UN case in 2021, nearly a million identities of Rohingya refugees were turned over to the Bangladesh and Myanmar officials, causing some to go into hiding.
In the past, registering directly with the Ministry of Public made some migrants uneasy, even if it was to receive basic public health services, said Chai from the technology center.
Going through a non-government organization makes some feel more comfortable.
“You know, they’re quite afraid of showing themselves to the state by making an official registration,” he added. “But if they’re just giving a picture of their face or even their iris pattern, they don’t much care about showing themselves to the public.”
The Ministry of Public Health’s Department of Disease Control did not respond to RFA’s inquiries as of this writing.
Edited by Taejun Kang and Malcolm Foster.