Asking a bank for the name of a bounced cheque's signer before filing a criminal case is pre-trial work that is not exempt under Section 4(5) of Thailand's PDPA, according to a PDPC advisory opinion. The bank may still disclose the name under Section 24(5) or 24(6). This article is for bank legal teams and lawyers who handle cheque cases.
- A lawyer or injured party gathering evidence before filing a cheque case is not exempt under Section 4(5), so the PDPA applies.
- The PDPC Office reads 'criminal justice procedure' broadly, but only for work carried out by the officers involved.
- A lawyer is exempt only for activities inside court proceedings, such as making statements to the court.
- The bank holds the signer's name on the contract basis, Section 24(3), and may disclose it on Section 24(5) read with Section 27.
- The PDPC Office declined to notify every bank: its opinion is advice and does not bind the Expert Committee.
Any Thai business that sells on credit and accepts cheques knows the problem. A customer's cheque is dishonoured, and the business, as the injured party, brings a criminal case under the Cheque Offences Act B.E. 2534 (1991). Company Y always did this through its in-house lawyer, filing directly with the court rather than lodging a complaint with the police.
The difficulty comes before filing. When the lawyer could not tell who had signed the cheque, he used to ask the bank, and banks cooperated. Once the Personal Data Protection Act B.E. 2562 (2019) took effect, banks refused to give the name of the person who signed the cheque. The company ended up suing the wrong person, or not suing everyone responsible.
The company's legal adviser, who also acts as its litigation lawyer, put the question to the Office of the Personal Data Protection Committee (the PDPC Office): does an injured party's own cheque prosecution fall within the Section 4(5) exemption? And if it does, would the Office please tell every bank.
The opinion is listed on the PDPC Office's advisory opinions page, and the original Thai text is in the Company Y opinion file. We summarised it briefly in eight PDPC answers companies meet most often, and the same reasoning was later applied to vehicle owners' names from licence plates. This article looks at it from the bank's side of the counter.
Is a lawyer prosecuting a cheque case exempt under Section 4(5)?
Not when the request is made to gather evidence before filing. The PDPC Office ties Section 4(5) to the courts and to the work of officers, not to the type of case. A cheque offence is a criminal matter, but the person asking for the data is the injured party's lawyer, not an officer.
(5) trial and adjudication of courts and work operations of officers in legal proceedings, legal execution, and deposit of property, including work operations in accordance with the criminal justice procedure;
The adviser argued that the words 'including work operations in accordance with the criminal justice procedure' were wide enough to cover an injured party who files through its own lawyer. He pointed out that lawyers already search civil registration records at district offices to find a defendant's name and address. The PDPC Office disagreed and set out what the criminal justice procedure covers.
ทั้งนี้ กระบวนการยุติธรรมทางอาญาครอบคลุมตั้งแต่กระบวนการเพื่อให้รู้ถึงการกระทำความผิดอาญา ผู้กระทำความผิดอาญา ข้อเท็จจริงและรายละเอียดแห่งความผิดอาญา การติดตามหาตัวผู้กระทำความผิดอาญา การพิจารณาความผิดอาญา และการลงโทษผู้กระทำความผิดอาญา แต่จะต้องเป็นการดำเนินงานของเจ้าหน้าที่ที่เกี่ยวข้องในกระบวนการยุติธรรมทางอาญาเท่านั้นIn English: the criminal justice procedure runs from discovering the offence, the offender and the facts, through tracing the offender, to trial and punishment, but it must be work carried out by the officers involved in that procedure. The scope is broad; the condition is who does the work. A lawyer or a victim working on a criminal case is still not an officer.
Which stage of a case is exempt for a lawyer?
The opinion splits a lawyer's work into two stages: work that forms part of court proceedings, and work done before filing. The two stages are treated differently.
สำหรับการเก็บรวบรวม ใช้ และเปิดเผยข้อมูลส่วนบุคคลของทนายความ และ/หรือผู้เสียหายในฐานะผู้ควบคุมข้อมูลส่วนบุคคล ในบางกิจกรรมที่เป็นส่วนหนึ่งของกระบวนการพิจารณาพิพากษาคดีของศาล เช่น การแถลงต่อศาลซึ่งอยู่ในระหว่างกระบวนการพิจารณาพิพากษาคดี ย่อมเข้าข้อยกเว้นตามมาตรา ๔ (๕)แต่การเก็บรวบรวม ใช้ และเปิดเผยข้อมูลส่วนบุคคลโดยทนายความ และ/หรือผู้เสียหาย เพื่อรวบรวมพยานหลักฐาน เพื่อให้รู้ถึงการกระทำความผิดอาญา ผู้กระทำความผิดอาญา ตลอดจนข้อเท็จจริงและรายละเอียดแห่งความผิดอาญา ซึ่งเป็นกระบวนการก่อนการฟ้องคดีและการพิจารณาพิพากษาคดี และไม่ได้เป็นการดำเนินการโดยเจ้าหน้าที่ที่เกี่ยวข้องในกระบวนการยุติธรรมทางอาญา ไม่เข้าลักษณะตามมาตรา ๔ (๕) กรณีจึงไม่ได้รับยกเว้นไม่ให้นำพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒ มาใช้บังคับแต่อย่างใดPut simply, statements a lawyer makes to the court during the trial are exempt. Collecting, using or disclosing personal data to gather evidence and identify the offender before the case is filed is not, because it is pre-filing work and not carried out by officers in the criminal justice procedure. The PDPA therefore applies in full.
| Activity | Who does it | Exempt? | Source |
|---|---|---|---|
| Statements to the court during the trial | Lawyer or injured party | Exempt | Example given in the opinion |
| Asking the bank for the signer's name before filing | Lawyer or injured party | Not exempt; the PDPA applies | The core question of the opinion |
| Tracing the offender | Officers involved in the criminal justice procedure | Within the criminal justice procedure | The opinion's description of scope |
| Searching civil registration records before filing | Lawyer | Not answered separately; our team's view is that the pre-filing rule likely applies too | Raised by the company as an example |
Can the bank give a lawyer the cheque signer's name?
Yes, if the bank has a lawful basis for that disclosure. The PDPC Office starts with how the bank obtained the signer's name in the first place, because Section 27 paragraph one only allows use or disclosure without consent of data collected on a consent-exempt basis under Section 24 or 26.
The Data Controller shall not use or disclose Personal Data without the consent of the data subject, unless it is the Personal Data which is collected without requirement of consent under section 24 or section 26.
ธนาคารในฐานะผู้ควบคุมข้อมูลส่วนบุคคล สามารถเก็บรวบรวมข้อมูลส่วนบุคคลเกี่ยวกับชื่อของผู้ลงลายมือชื่อสั่งจ่ายเช็ค โดยได้รับยกเว้นไม่ต้องขอความยินยอมตามมาตรา ๒๔ (๓) แห่งพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒ เนื่องจากเป็นการจำเป็นเพื่อการปฏิบัติตามสัญญาซึ่งเจ้าของข้อมูลส่วนบุคคลเป็นคู่สัญญาThe opinion says the bank collects the signer's name without consent under Section 24(3), because it is necessary to perform the contract with the account holder. That satisfies the condition in Section 27 paragraph one. The PDPC Office then asks the bank to check which exemption covers this particular disclosure to the injured party's lawyer, and names two routes.
Route 1: the injured party's legitimate interest, Section 24(5)
การขอข้อมูลส่วนบุคคลเกี่ยวกับเจ้าของบัญชีหรือผู้ลงลายมือชื่อสั่งจ่ายเช็คโดยทนายความ และ/หรือผู้เสียหาย เพื่อรวบรวมพยานหลักฐานในการฟ้องคดี อาจเป็นกรณีที่ธนาคารสามารถเปิดเผยได้โดยได้รับยกเว้นไม่ต้องขอความยินยอมจากเจ้าของข้อมูลส่วนบุคคลหรือไม่(5) it is necessary for legitimate interests of the Data Controller or any other Persons or juristic persons other than the Data Controller, except where such interests are overridden by the fundamental rights of the data subject of his or her Personal Data;
Section 24(5) works here because of the words 'any other Persons or juristic persons other than the Data Controller'. The interest being weighed is the injured company's interest in suing the right people, not the bank's own interest.
The proviso still applies. If the bank concludes that the injured party's interest is overridden by the account holder's fundamental rights, the opinion says the bank does not disclose. In practice this means weighing each request on its own facts, rather than adopting a blanket policy of always disclosing or always refusing.
For a step-by-step balancing test, see three questions before relying on legitimate interest and the legitimate interest assessment guide.
Route 2: another law requires the bank to disclose, Section 24(6)
หรือมีกฎหมายอื่นกำหนดให้ธนาคารต้องเปิดเผยข้อมูลส่วนบุคคลดังกล่าว ตามมาตรา ๒๔ (๖) ประกอบมาตรา ๒๗ วรรคหนึ่ง ธนาคารก็ปฏิบัติตามกฎหมายที่เกี่ยวข้องดังกล่าวต่อไป(6) it is necessary for compliance with a law to which the Data Controller is subjected.
The opinion does not say which other law it has in mind. The bank therefore has to look at the document it receives and identify the legal power behind it. Court summonses and court orders are covered in a creditor asks for a debtor's data.
Can the PDPC Office tell every bank to disclose?
No. Company Y asked the Office to send its view to the banks directly. The reply was that an advisory opinion is legal advice that the requester may use in exercising its own judgment.
การตอบข้อหารือนี้เป็นความเห็นและคำแนะนำทางกฎหมายของคณะอนุกรรมการเฉพาะกิจตอบข้อหารือฯ ซึ่งท่านอาจใช้ประกอบดุลพินิจในการดำเนินการที่เกี่ยวข้อง แต่ความเห็นดังกล่าวนี้ไม่ผูกพันการใช้อำนาจและหน้าที่ของคณะกรรมการผู้เชี่ยวชาญตามกฎหมาย ในกรณีที่อาจมีการร้องเรียนตามพระราชบัญญัตินี้ต่อไปThe practical result is that each bank still decides for itself, and banks may decide differently. A lawyer who writes to several banks can get several different answers. If someone complains later, the Expert Committee is not bound by this opinion either.
A bank receives a request for a cheque signer's name: what should it check?
The steps below are AIPDPA team guidance drawn from the opinion and Sections 24 and 27. They are not a procedure set by the PDPC Office.
- Who is asking? The lawyer should show a letter of appointment from the injured party, and the injured party should show a real link to that cheque, such as a copy of the cheque and the return documents matching the account.
- What for? The letter should name the cheque and the case it will be used for, because Section 27 paragraph two bars the recipient from using the data for any other purpose than the one stated in the request.
- Only what is needed. The opinion deals with the signer's name. If the request asks for more about the account holder, weigh each item separately.
- Weigh the request under Section 24(5) and keep written reasons, whether you disclose or refuse.
- Record the disclosure in the Section 39 record, as Section 27 paragraph three requires.
- If you receive a summons or order issued under a law, have the legal team confirm the authority behind it, then follow Route 2.
The Person or juristic person who obtains Personal Data as a result of the disclosure under paragraph one shall not use or disclose such Personal Data for any purpose other than the purpose previously notified to the Data Controller in the request to obtain such Personal Data.
In the event that the Data Controller uses or discloses the Personal Data which is exempted from consent requirement in paragraph one, the Data Controller shall maintain a record of such use or disclosure in the record under section 39.
If your organisation keeps its RoPA in AIPDPA, a disclosure like this can be logged as an activity in the register and printed as a Section 39 report when an auditor asks. You can see how it looks in the demo account, and the RoPA guide explains how to build the register.
What should the injured company and its lawyer prepare?
Before filing, the opinion treats the lawyer and the injured party as data controllers, so both carry PDPA duties. A well-prepared request also makes the bank's balancing test easier. The list below is our team's advice.
- Write a request that identifies the cheque, the amount, the date the bank refused payment and the case the data will be used for.
- Attach the letter of appointment, a copy of the cheque and the return documents.
- Ask only for the data needed to identify the defendant.
- Use what you receive for that case only, as Section 27 paragraph two requires.
- Be ready for a refusal: the opinion does not oblige any bank to disclose.
Three scenarios: how should the bank respond?
These scenarios are hypothetical. They apply the reasoning of the Company Y opinion; the conclusion in each one is our team's interpretation.
Not within Section 4(5), because it is the lawyer's pre-filing work. The bank may disclose if the interest in suing the right person is not overridden by the account holder's rights, and it must record the disclosure under Section 39.
The opinion says the bank 'should consider' disclosure; it does not order it, and it does not bind the Expert Committee. The bank still has to decide.
The opinion deals with the signer's name. Anything beyond that intrudes further on the account holder, so the Section 24(5) balance may come out differently.
What does this opinion leave unanswered?
The Company Y opinion answers the facts the company described. Three points are left for organisations to decide for themselves.
- Civil registration searches at district offices: the company raised them as an example, but the opinion does not say on what basis the registry may release the data.
- Data beyond the name, such as the signer's address: the opinion does not address it.
- The 'other law' under Section 24(6): the opinion does not say which law that is.
If your facts differ, do not treat the opinion as a ready-made answer. Use it as a guide to how the PDPC Office reads Sections 4(5) and 24(5), and record your organisation's reasons each time. If the request comes from a police inquiry officer instead, see police ask for customer data.
Frequently asked questions
Is a lawyer fully exempt from the PDPA?
No. The PDPC Office said a lawyer is exempt under Section 4(5) only for activities that form part of court proceedings, such as statements to the court. Gathering evidence before filing is not exempt.
Must the bank get the account holder's consent before naming the cheque signer?
Not necessarily. The opinion says the bank may disclose without consent if the legitimate-interest basis in Section 24(5), read with Section 27 paragraph one, applies, or if another law requires disclosure under Section 24(6).
Can the bank refuse to give the name?
Yes, if it concludes that the requester's interest is overridden by the account holder's fundamental rights under the proviso to Section 24(5), and no other law requires disclosure.
Does this PDPC opinion bind banks?
No. It is legal advice to be used in exercising judgment, and it does not bind the Expert Committee if a complaint is filed.
Can a lawyer use the signer's name for another matter?
No. Section 27 paragraph two bars anyone who receives data through such a disclosure from using or disclosing it for any purpose other than the one stated to the bank in the request.
You have read it. Now get it done
Open the demo account to see the real AIPDPA system with a sample company: RoPA, the 72-hour breach clock, data subject requests, cookie consent and ready-to-use documents, all in one place.
From 2,900 THB/year (11 modules) · all 24 modules from ENTERPRISE at 19,900 THB/year · demo account, no sign-up
No time? Have our lawyers handle it →Kooru's lawyers set it up and act as your DPO
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 4 (5) · 24 (3) (5) (6) · 27
- Summaries of PDPC advisory opinions under the Personal Data Protection Act B.E. 2562 (Office of the Personal Data Protection Committee)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)