Shareholder data privacy under threat: Annual company filings expose personal information.
2017 presented a new concern for thousands of Thai companies which held their annual general meetings in April and May to meet the 31 May deadline for filing shareholder lists and audited accounts with the Ministry of Commerce (MOC). This year, filing the list of shareholders can result in identification numbers and passport numbers of shareholders being made publicly available.
There is nothing unusual in the public having the ability to search the list of shareholders of companies, but the Ministry of Commerce has issued a new version of the shareholders' list, which now requires the national identification number of Thai shareholders and passport numbers of foreign shareholders to be completed. Under the MOC's current practice, this form, known as the "Bor Or Jor 5", can be accessed by any person (regardless of whether they are connected with the company or not) once it has been filed with the MOC.
Many people would be reluctant to make their full name, address, occupation and identification number available to the public, but this is effectively what shareholders would be doing by providing all of the information set out in the revised Bor Or Jor 5 form.
Thailand's Civil and Commercial Code, which governs private companies, does not compel shareholders to provide identification numbers to the company, nor does it compel the company to provide this information to the MOC.
The MOC may have good reason to ask for this information. There have, after all, been recent cases when foreign nationals have used fraudulently obtained Thai identification cards to acquire illegitimate shareholdings in Thai companies. But it is one thing to collect personal information and another matter entirely to disclose personal information.
The Official Information Act does establish procedures for Government organisations to follow in relation to personal information, and while this includes obligations against disclosure of personal information, foreign shareholders need to be aware that their personal information will not be eligible for protection under the Official Information Act unless the shareholder resides in Thailand.
The current position is that shareholders are not legally obliged to provide their identification card or passport number to the company or to the MOC, but many companies asked their shareholders for this personal information as a matter of administrative expediency to complete the new Bor Or Jor 5 forms and lodge them with the MOC before the deadline. It is not always made clear to shareholders that this information will be made publicly available, and it is difficult to imagine that individuals of any nationality will be happy to have their ID card or passport numbers made public.
Companies that provide the identification numbers of shareholders to the MOC without obtaining the shareholder's consent risk civil liability in the case of identity theft. Directors who sign off on the Bor Or Jor 5 could also take on direct personal liability for any loss suffered by shareholders related to identity theft.
Companies should take the opportunity to inform their shareholders of the potential publication of identification numbers, and at the same time review their directors and officers and data protection insurance policies.
Chris Osborne is a partner and Manita Kansap is an associate at Watson Farley & Williams Thailand Ltd.