132 Dictating the Internet: Appropriate cybersecurity legislation should have, at the very least, avoided reproducing and incorporating existing vague and overbroad provisions from the Penal Code, such as “propaganda” or “defamation” (which should not be criminalized). The process should have involved a multi-stakeholder review and input into the drafting process –from ICT companies, civil society, academics and technical experts. Thailand In May 2019, the Cybersecurity Act B.E. 2562 (2019) (‘Cybersecurity Act’) came into force in Thailand. It was passed by the National Legislative Assembly without opposition508, despite concerns raised by civil society, academics, opposition politicians and internet companies that the law’s overbroad provisions and lack of oversight and accountability mechanisms allowed for potential government abuse of power to mass surveil private data and online communications.509 In September 2019, non-governmental organization Manushya Foundation published a report detailing difficulties and deficiencies evident in the Act and proposed a series of recommendations following consultations with academics, digital rights advocates, civil society and the government sector.510 These pertained to overbroad, undefined provisions which allowed for overly expansive exercise of executive authority in implementing the Act, intrusive surveillance powers provided to the State to monitor online activity and expression, an absence of checks and balances against the executive in the implementation of the Act and inadequate provisions for remedies in the event of rights violations or abuses.511 opinion and expression, 6 April 2018, A/HRC/38/35 (‘A/HRC/38/35’), para 17. 508 13 votes approved, 16 abstained and none opposed. 509 Patpicha Tanakasempipat, ‘Thailand passes internet security law decried as ‘cyber martial law’’, Reuters, 28 February 2019, Available at: https://www.reuters.com/article/us-thailand-cyber/ thailand-passes-internet-security-law-decried-as-cyber-martial-law-idUSKCN1QH1OB; Baker and McKenzie, ‘Thailand Cybersecurity Act, B.E. 2562 (2019) is Effective’, May 2019, Available at: http://bakerxchange.com/rv/ff004c3c7fb28fa5221d901d0f4f9b725497f42f; Tech Crunch, ‘Thailand passes controversial cybersecurity law that could enable government surveillance’, 28 February 2019, Available at: https://techcrunch.com/2019/02/28/thailand-passes-controversialcybersecurity-law/; Pravit Rojanaphruk, ‘Future Forward Seeks To Amend Junta’s Cyber Law’, Khaosod English, 24 September 2019, Available at: http://www.khaosodenglish.com/ politics/2019/09/24/future-forward-seeks-to-amend-juntas-cyber-law/ 510 The ICJ participated in the Experts’ Meeting held by Manushya Foundation in preparation of its report. 511 Manushya Foundation, ‘Thailand’s Cybersecurity Act: Towards A Human-Centered Act Protecting Online Freedom And Privacy, While Tackling Cyber Threats’, September 2019 (‘Manushya Foundation 2019 report’) Available at: file:///C:/Users/User/Desktop/Manushya%20TH%20 Cybersecurity%20Act%20report.pdf