Artificial intelligence has transformed ordinary security cameras (CCTV) into smart surveillance systems capable of automatically detecting, identifying, and tracking people or events through video analytics, something traditional cameras simply couldn't do.
In Thailand, AI CCTV is being adopted across both the public and private sectors: government agencies use it to strengthen safety in public spaces, while businesses use it to improve operational efficiency. That said, deploying this technology comes with real challenges around privacy, transparency, and appropriate use, all of which must align with Thailand's Personal Data Protection Act (PDPA).
Today's AI CCTV systems can analyze people in the video frame at varying levels of depth. Understanding where a system falls on this spectrum is essential for PDPA compliance, especially when it comes to biometric data, one of the most sensitive categories of personal information.
There are two main levels of AI CCTV operation: Detection and Recognition, each carrying a different level of impact on individuals' rights and freedoms.
Detection means the system identifies that a person or object is present in a scene, for example counting people, spotting movement, or distinguishing a human silhouette from the background. The system cannot identify who that person is. From a legal standpoint, detection-level processing doesn't produce data that directly identifies individuals, so the risk to people's rights and freedoms is relatively low.
Recognition goes a step further. The system can link what it sees to a specific person, for example through Facial Recognition Technology (FRT), by matching a face against a database, or by analyzing unique biological features known as a biometric template to verify someone's identity.
Some AI CCTV systems now offer Live Facial Recognition Technology (LFT), which automatically scans and analyzes faces in real time as people walk past the camera, then checks them against a pre-loaded database. Even if the system is only looking for specific individuals, it technically has to process every face in the frame to do so, which has significant implications for everyone in that space.
This distinction matters enormously under data protection law. When AI processes a facial image to identify someone, that data may qualify as biometric data, a type of sensitive personal data under Section 26 of the PDPA, requiring a higher standard of protection than ordinary personal data.
As AI capabilities become increasingly woven into CCTV systems, from facial recognition and behavior analysis to movement tracking and emotion detection, the privacy stakes rise significantly, with growing potential to affect individuals' rights and freedoms.
Thailand is seeing wider adoption of AI CCTV across different settings. Take the Royal Thai Police, a public agency responsible for national security and public safety, which has deployed AI CCTV in public spaces to detect and identify suspects with active arrest warrants. The system uses facial recognition to compare faces against a criminal database and instantly alerts nearby officers through integration with the Criminal Investigation Bureau's warrant system. Under Section 4 of the PDPA, government agencies carrying out national security or public safety functions are exempt from the Act's requirements. Even so, these agencies still need legal authority from specific legislation, namely the National Police Act B.E. 2565 and the Criminal Procedure Code, which grant powers for investigation, evidence collection, and arrest under court-issued warrants. This approach aligns with the EU AI Act, which permits remote biometric identification in public spaces only for serious cases such as pursuing suspects in grave crimes, and only with prior judicial authorization.
For the private sector, shopping malls often use AI CCTV in ways that don't identify individuals, such as counting foot traffic, mapping how visitors move through the store, or analyzing shopping patterns. This kind of anonymous behavioral analysis can rely on the Legitimate Interest basis under Section 24(5) of the PDPA, since no individual is being singled out and the risk to personal rights is low. A Legitimate Interest Assessment (LIA) must still be conducted to weigh business interests against individuals' rights, and a clear Privacy Notice must be provided to visitors. This approach is consistent with the European Data Protection Board's Guidelines 5/2022 and the UK ICO's guidance on video surveillance.
That said, not all AI CCTV systems work the same way. In some cases, AI may only detect anomalies in a controlled access area, such as identifying that someone is attempting to enter a restricted zone, and alert the relevant staff to investigate further. This kind of system may operate purely at the detection level without identifying who that person is, and may rely on Legitimate Interest as its legal basis, provided the organization can demonstrate the necessity, appropriateness, and proportionality of the processing.
Some organizations also combine AI CCTV with facial recognition to control entry into restricted areas by pre-enrolling authorized employees' biometric templates in the system for identity verification. This is more legally complex. Technically, the system must scan and compare every face that appears in front of the camera before it can determine whether someone is permitted to enter, meaning the facial data being processed likely qualifies as biometric data under Section 26. For this reason, organizations should obtain Explicit Consent from every individual whose facial data will be enrolled in the system before any processing takes place.
Drawing from Thai and international examples, here are practical steps organizations should follow when deploying AI CCTV in line with personal data protection law.
AI CCTV is transforming ordinary security cameras into smart surveillance tools capable of analyzing and identifying individuals. Organizations deploying these systems must operate in full compliance with the PDPA, giving careful thought to biometric data processing, transparency, consent, risk assessment, and data security, in order to genuinely protect the rights and freedoms of the people whose data they collect.
References
