Thailand: Computer Crime Act, 2017 dishonest intent nor a requirement for serious harm. Even if anonymous conduct online were to cause harm, it could be adequately addressed by existing provisions in the criminal code. There is no legitimate purpose in punishing, on its own, anonymous speech. Doing so serves to chill many cases where anonymous speech protects and promotes freedom of expression. Moreover, we find it concerning that the Minister is granted unchecked power to control the nature, volume, and frequency of communications. This includes the ability to decide what communications based on content. It is incompatible freedom of expression and should be stricken. Finally, Section 26 problematically requires service providers to retain computer traffic data, order to be able to prohibit privacy-protective services and search engines which are designed not to log user information or IP-addresses. Cases where investigators require data to be retained can be handled on an individual basis involving court oversight; there is no reason for a blanket rule requiring providers to retain user data. Recommendations: Section 11 should be stricken in its entirety; The provisions of Section 11 allowing the Minister to decide the nature, volume, and frequency of e-mails grant absolute power to control and censor communications should be stricken out in their entirety; -data retention and mandating the collection of identifying information on users should be abolished. Enhanced penalty offences involving certain computer systems Section 12 and its subsections provide for severe penalties of up to ten to twenty times the original offence when the offence includes certain computer systems. The examples provided ARTICLE 19 is extremely concerned that these terms are broad and not formulated with sufficient precision to enable an individual to regulate his or her conduct. They do not require nalties of up to fifteen or twenty years imprisonment are unduly severe. sanction. This reading is consistent with international standards, including the Cybercrime Convention. The one subsection stipulating serious harm, Section 12(3), namely death without intention to kill, could be dealt with using existing offences in the criminal code relating to manslaughter and thus a separate computer crime is unnecessary. Recommendations: Section 12 and its subsections should be omitted as written. At a minimum, crimes against protected systems must be narrowly defined to critical infrastructure necessary for nd carry significantly less severe penalties; ARTICLE 19 Free Word Centre, 60 Farringdon Rd, London EC1R 3GA Page 17 of 24 www.article19.org +44 20 7324 2500