Bangkok: The Consumer Protection Board (CPB) has called on mobile phone companies to provide clarification regarding the facial scanning process associated with SIM card exchanges. This request follows allegations that employees were tricking students into scanning their faces in exchange for SIM cards, leading to the confiscation of 2,160 SIM cards.
According to Thai News Agency, on February 25, 2026, the Online Fraud Prevention Center of the Royal Thai Police (ACSC), together with the Central Investigation Bureau (CIB) and the Crime Suppression Division, initiated "SAFE DOI BOY," which involved raids on eight locations in Chiang Rai, Chiang Mai, Samut Prakan, and Prachuap Khiri Khan provinces. The operation uncovered a scheme where students were deceived into participating in a "free SIM card giveaway," with their information subsequently used to register fake SIM cards for scammer networks. Three suspects were arrested under arrest warrants, and authorities seized 2,160 SIM cards, two mobile phones, and documents related to the distribution and advertising of SIM cards. In response to this incident, the Personal Data Protection Board (PDPC) has accelerated its oversight of mobile phone service providers to ensure transparency and strict adherence to data protection measures.
Pol. Col. Surapong Plengkhum, Secretary-General of the Personal Data Protection Committee, emphasized that service-providing companies, acting as data controllers, must enforce measures to ensure their employees and agents are fully aware of and comply with the company's security protocols. This is crucial for safeguarding personal data and the rights of data subjects and service users. Additionally, after such incidents, companies are required to review their measures to prevent future occurrences.
The Office of the National Economic and Social Development Council (NESDC) will monitor companies to ensure they adhere to the Personal Data Protection Act (PDPA) to protect public rights as mandated. Schools are also advised to rigorously evaluate external parties involved in collecting students' personal data before granting permission, particularly for sensitive data like facial scanning, which can significantly affect the rights and freedoms of students-a group that requires meticulous care in the handling of personal information.