PDPA: Disclosure of Personal Data to Third Parties for Legal Proceedings

A recurring practical question under the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) is whether an organization may disclose personal data to a third party who needs the information to pursue a legal claim. Organizations often take a conservative position that personal data cannot be disclosed without the data subject’s consent. However, consent is only one of the legal bases under the PDPA, and the fact that information constitutes personal data does not, by itself, prohibit its disclosure. A recent opinion issued in response to a consultation by the Department of Land Transport (“DLT Opinion”) provides useful guidance on this issue and is particularly relevant to requests for personal data made for the purpose of exercising legal rights or pursuing legal proceedings.

Disclosure Does Not Necessarily Require Consent:

The DLT Opinion illustrates an important distinction between two questions: whether the information constitutes personal data and, if so, whether there is a lawful basis for its disclosure. Once information falls within the definition of personal data, its collection, use, or disclosure must comply with the PDPA, but this does not mean that disclosure is prohibited unless the data subject has given consent. Section 24 recognizes several legal bases for processing personal data without consent. Depending on the circumstances, disclosure to a third party may therefore be permissible where an appropriate legal basis exists. This is particularly important where the requesting party requires information to establish or exercise a legal right, claim damages, identify a responsible party, or commence legal proceedings. For example, a person who suffers damage involving a vehicle may know the vehicle registration number but may not know the identity of the person against whom a claim should be made. Similarly, a person injured in an incident recorded by CCTV may need the footage to establish the circumstances of the incident and pursue a claim. Treating the PDPA as an absolute prohibition against disclosure in such circumstances could prevent a person from effectively exercising legitimate legal rights.

Legitimate Interests and Legal Claims:

One potentially relevant legal basis is legitimate interests under Section 24(5) of the PDPA. This provision permits processing where it is necessary for the legitimate interests of the controller or another person, except where those interests are overridden by the fundamental rights of the data subject. A genuine need to obtain information for the establishment, exercise, or defense of a legal claim may constitute a significant legitimate interest. However, merely stating that information will be used in litigation should not automatically entitle a requester to obtain another person’s personal data. The controller should consider whether the claimed legal interest is genuine, whether disclosure of the requested information is necessary to pursue that interest, and whether the interests of the requester outweigh the privacy interests and fundamental rights of the data subject. In practical terms, this can be approached through a purpose–necessity–balancing analysis. The controller should first identify the legal purpose for which the information is requested; determine whether disclosure is reasonably necessary to achieve that purpose; and then balance that interest against the potential impact on the data subject. Supporting documents, such as a police report, evidence of damage, a demand letter, court documents, or other evidence demonstrating an actual or reasonably contemplated legal claim, may assist the controller in making and documenting this assessment.

The same reasoning has broader significance beyond vehicle-registration information. Government guidance discussing requests for CCTV footage has referred to the DLT Opinion by analogy when considering whether personal data may be disclosed to enable an injured person to exercise legal rights. This suggests that the Opinion may become an important reference point for third-party disclosure requests generally. Comparable issues arise frequently in the private sector: condominium juristic persons receive requests for CCTV footage following accidents or disputes; employers receive requests concerning former employees; insurers may hold information concerning parties to an accident; property owners may receive requests concerning tenants; and online service providers may receive requests for information identifying persons alleged to have committed a civil wrong. In each case, the correct question should not simply be whether the requested information is personal data, but whether the proposed disclosure has an appropriate legal basis and satisfies the requirements of necessity and proportionality.

Disclosure Should Be Limited to What Is Necessary:

Even where a lawful basis exists, the controller should not assume that all information in its possession may be disclosed. The scope of disclosure should be limited to information reasonably necessary for the stated legal purpose. If a requester needs information to identify a person against whom proceedings may be commenced, disclosure of the person’s name and information necessary for the relevant legal process may potentially be justified, while disclosure of unrelated information—such as identification numbers, telephone numbers, dates of birth, historical records, or other data not required for the claim—may not be. Redaction, partial disclosure, controlled access, or other safeguards should therefore be considered where appropriate. This distinction can be expressed simply as two separate questions: “Can the information lawfully be disclosed?” and “How much information is necessary to disclose?” Establishing a legal basis answers only the first question; the principles of necessity, proportionality, purpose limitation, and data minimization remain relevant to the second.

Organizations should also distinguish ordinary personal data under Section 24 from sensitive personal data under Section 26. Section 26 contains specific exceptions relating to processing necessary for the establishment, compliance, exercise, or defense of legal claims. Where sensitive personal data is involved, the requirements of Section 26 should therefore be considered separately rather than assuming that the legal basis applicable to ordinary personal data automatically applies. In all cases, organizations should consider implementing a documented Third-Party Personal Data Disclosure Request Procedure requiring verification of the requester’s identity, the purpose of the request, evidence supporting the claimed legal interest, the categories of information genuinely required, possible effects on the data subject, appropriate redaction or other safeguards, and a record of the reasons for approving or rejecting the request. Such documentation can be particularly important where the controller relies on legitimate interests and must subsequently demonstrate how the competing interests were assessed.

Key Takeaways:

The DLT Opinion is significant because it reinforces that the PDPA should not be treated as an automatic barrier to disclosure whenever personal data is involved. Consent is not the only legal basis for disclosure, and a genuine need to obtain information for the establishment, exercise, or defense of legal rights may support disclosure where the applicable requirements of the PDPA are satisfied. At the same time, an assertion that information is required for litigation does not create an unrestricted right of access to another person’s personal data. Controllers should assess the purpose, necessity, and balancing of interests, require appropriate evidence where necessary, limit disclosure to the minimum information reasonably required, and document the decision-making process. The broader lesson is that the PDPA is not intended to make personal data permanently inaccessible; rather, it establishes a framework for determining when disclosure is lawful, why it is necessary, and how much information may appropriately be disclosed.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• PDPA: Cross-Border Data Transfer Compliance for Bank Z Under Thailand’s Data Protection Law – Key Takeaways
• PDPA: Does Removing a Name Make Data Anonymous?
• PDPA: Disclosure of Personal Data to Third Parties for Legal Proceedings
• PDPA: Applicability to a Facebook User’s Posting of Personal Data – Key Takeaways
• Consumer Protection: Proposed Labeling Rules for Solar Panels, Inverters and Energy-Storage Batteries
• Generative AI and Music: Copyright Risks Highlighted by the DIP