Employee Benefits and the Personal Data of Family Members

Employee benefit programs frequently require employers to process personal data not only of their employees, but also of their employees’ spouses, children, parents, or other family members. Typical examples include medical benefits, insurance coverage, educational allowances, travel benefits, and other welfare programs. While such processing is routine from an HR perspective, it raises an important question under the Personal Data Protection Act B.E. 2562 (2019) (PDPA): can an employer rely on the same lawful basis for the employee and the employee’s family members?

This issue was addressed by the Office of the Personal Data Protection Committee (PDPC Office) in Consultation No. 10/2568 concerning a bank’s processing of personal data of employees and their family members for employee benefits. The consultation is particularly useful because it illustrates a point that is sometimes overlooked in HR privacy compliance: identifying a legitimate business purpose is not enough. The data controller must identify the appropriate lawful basis in relation to each data subject whose personal data is being processed. The consultation also refers to the PDPA provisions concerning minors and purpose limitation, making the issue especially relevant where employee benefits extend to children.

The Employee and the Family Member Are Different Data Subjects:

For the employee, the analysis is relatively straightforward. Where benefits form part of the employee’s employment package, the employer may need to process the employee’s personal data to administer those benefits. Section 24 of the PDPA permits processing without consent in several circumstances, including where processing is necessary for the performance of a contract to which the data subject is a party, compliance with a legal obligation, or legitimate interests, subject to the applicable conditions.

Accordingly, where a benefit arises from the employment relationship, the contractual basis may potentially support processing of the employee’s personal data if that processing is objectively necessary to perform the employer’s obligations under the employment arrangement. Other benefits may instead be supported by a legal obligation or legitimate interests, depending on their nature and purpose.

The position becomes more complicated when the same benefit requires information about the employee’s spouse, child, parent, or other family member. Those individuals are separate data subjects. More importantly, they will ordinarily not be parties to the employment contract between the employer and the employee. The fact that processing their data enables the employer to provide a contractual benefit to the employee does not automatically make the family member a party to that contract.

This distinction matters because the contractual basis under the PDPA focuses on a contract to which the data subject is a party. Employers should therefore be cautious about treating the employment contract as a blanket lawful basis covering everyone whose information happens to be required for HR administration.

What Lawful Basis Can Apply to Family Members?

The appropriate basis must instead be considered according to the particular processing activity. Depending on the circumstances, an employer may be able to rely on legitimate interests, provided that the processing is necessary for a legitimate purpose and the employer has appropriately considered the rights and interests of the affected family members. Consent may be relevant where no other lawful basis is available, although it should not automatically be treated as the default solution merely because the individual is not an employee.

This distinction becomes even more important where benefits involve sensitive personal data under Section 26, particularly health information. Medical reimbursement and health insurance schemes, for example, may require medical certificates, diagnoses, treatment information, disability information, or other health data concerning an employee or family member. A lawful basis for ordinary personal data under Section 24 does not by itself resolve the processing of sensitive personal data. The employer must separately determine whether one of the conditions under Section 26 applies or whether explicit consent is required.

Children introduce an additional layer of compliance. If an employee submits personal data concerning a child for educational, medical, insurance, or other benefits, the employer must consider the PDPA requirements applicable to minors, including the rules governing consent where consent is the basis relied upon. Consultation No. 10/2568 expressly refers to Section 20 of the PDPA, which contains the statutory framework governing consent involving minors.

Do Not Forget the Privacy Notice:

Another practical issue is transparency. Section 21 requires personal data to be collected, used, and disclosed consistently with the purposes communicated to the data subject, subject to the statutory exceptions. Employers therefore need to consider not only whether they have a lawful basis, but also whether the relevant family members have been properly informed about the processing of their data.

An employee privacy notice that describes how the employer processes employee information does not necessarily solve this problem. The spouse, child, or parent remains a separate data subject. In many organizations, however, the employer obtains the family member’s information indirectly through the employee rather than directly from that family member.

HR teams should therefore review how their privacy notices deal with this situation. Depending on the circumstances, organizations may consider a separate notice for family members and beneficiaries, or incorporate appropriately drafted provisions into the HR privacy framework together with a mechanism for ensuring that the relevant information reaches those individuals. The notice should explain, among other matters, the purposes of processing, categories of information involved, applicable lawful bases, disclosures to insurers or other benefit providers, retention arrangements, and data subject rights.

Practical Implications for Employers:

Consultation No. 10/2568 is a useful reminder that an HR database should not be analyzed simply as a database containing “employee information.” A single employee record may contain personal data belonging to several legally distinct data subjects, and the lawful basis may differ among them.

Employers should therefore map benefit-related processing at the data-subject level. For each benefit, HR and privacy teams should identify whose information is collected, why it is required, whether ordinary or sensitive personal data is involved, the lawful basis applicable to each category of data subject, how the required privacy information is provided, and whether information is transferred to insurers, hospitals, benefit administrators, payroll providers, or other third parties.

This approach is particularly important because many HR processes were designed long before privacy compliance became a formal legal requirement. Forms asking employees to provide the names, identification numbers, dates of birth, relationship information, bank details, or medical information of family members may have existed for years. Their operational familiarity does not remove the need to identify a lawful basis and comply with the PDPA’s transparency, data minimization, security, and retention requirements.

Key Takeaways:

• Do not automatically extend the employee’s lawful basis to family members. The employee and each family member are separate data subjects.
• Contractual necessity requires particular attention. A spouse, child, or parent will ordinarily not be a party to the employment contract merely because the employee receives a benefit relating to that person.
• Consider legitimate interests or another appropriate lawful basis for family-member data rather than treating consent as the automatic solution.
• Analyze sensitive personal data separately. Health and similar information requires a basis permitted under Section 26 in addition to the analysis applicable to ordinary personal data.
• Children require additional consideration, particularly where processing relies on consent.
• Review privacy notices and indirect collection procedures. An employee privacy notice should not automatically be assumed to satisfy transparency obligations toward family members.
• Audit existing benefit forms and HR systems. Employers should identify exactly what family-member information they collect and whether each data field remains necessary for administering the relevant benefit.

Author: Panisa Suwanmatajarn, Managing Partner.

Related Articles in the “PDPA Insights: Building Effective Privacy Governance” Series

• Government Support for Small and Medium Enterprises (SMEs): Four New Economic Working Groups
• Cabinet Approves Draft Ministerial Regulation Introducing Per-Item Fees for DBD Data Linkage Services
• Employee Benefits and the Personal Data of Family Members
• Consumer Protection: Proposed Labeling Rules for Solar Panels, Inverters and Energy-Storage Batteries
• From Grants to Equity: Government Innovation Agency Can Now Invest in Startups
• Cabinet Approves Major Expansion of Home Worker Protections