Can you get a car owner's name from a licence plate?

Picture this: your car is parked outside your house, a pickup reverses into it and drives away. Your dashcam captured the plate clearly. But a plate number is not a defendant. To sue, you need the owner's name and address, and the agency that holds them is the Department of Land Transport (DLT).

Many people bring the same request to a DLT office: victims, lawyers preparing civil or criminal cases, judgment creditors trying to seize a vehicle, and state agencies chasing unpaid taxes. In its request for an opinion, the DLT admitted that its own practice on disclosure was not consistent. So it asked the Personal Data Protection Committee, through the Office of the Personal Data Protection Committee (PDPC Office), for guidance.

The advisory subcommittee did not answer with a simple yes or no. It laid out a full way of reasoning. In our view, other organisations that hold data about third parties, such as condominium juristic persons logging vehicles or car parks with plate-reading cameras, can borrow almost all of it.

Will the DLT give you a car owner's name from a plate number?

It can, but not for every request. The PDPC Office takes the view that the DLT may disclose owner details to a person who intends to sue or to enforce a judgment, without the owner's consent, under Section 24(5) read with Section 27, paragraph one, of the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The same opinion stresses that this provision does not oblige the DLT to hand over data every time someone asks.

The DLT holds a lot. The opinion lists the owner's name, the name of the person in possession of the vehicle, the registration number, the chassis number and the engine number. The Department collects these to regulate vehicle use and collect vehicle tax under the Land Transport Act and the Motor Vehicle Act, both of 1979. Passing them to outsiders is a use beyond that core task.

Can a lawyer or victim claim the PDPA does not apply under Section 4(5)?

No. Section 4(5) exempts court adjudication and the work of officials in the justice process. A lawyer or victim gathering information before filing suit remains fully subject to the PDPA.

Many assume that tracking down a defendant is already part of the justice process. The PDPC Office disagreed years earlier, in an opinion for Company J, whose in-house lawyer asked a bank for the name of the person who signed a bounced cheque so the company could prosecute the cheque offence itself. The relevant passage is quoted below in the original Thai.

The DLT opinion extends the same reasoning to enforcement. If a judgment creditor, or the creditor's lawyer, asks for data to enforce a judgment, that person is not an enforcement official, so the request is not exempt under Section 4(5) either.

On what legal basis can the DLT disclose an owner's details?

The main basis is legitimate interest under Section 24(5) read with Section 27, paragraph one. Here the interest belongs to the requester, not to the DLT, and Section 24(5) expressly allows for the interests of "other Persons or juristic persons".

The PDPC Office adds an observation worth noting: establishing, exercising or defending a legal claim is itself a legitimate interest of the person concerned. It links this to the state's duty to help people reach the justice system conveniently and quickly.

In the same passage, though, it is careful to say that Section 24(5) creates no direct duty on the DLT to disclose to every requester. The provision only makes a disclosure lawful when its conditions are met. The decision in each case stays with the DLT.

Section 24(5) also works as a fallback. The opinion applies it where the disclosure is neither a public-interest task or exercise of official authority by the DLT under Section 24(4), nor compliance with a legal obligation of the DLT under Section 24(6).

When the requested data is sensitive

Some data the DLT holds may be sensitive data under Section 26; the opinion gives health data as an example. The PDPC Office considers that if disclosing it is necessary to bring or exercise a legal claim, Section 26(4) allows disclosure without explicit consent. Health information connected with driving licences raises its own questions, covered in the organ donor mark on driving licences.

The three tests the DLT must run before saying yes

The DLT must be able to show that the requester's interest is not less important than the owner's fundamental rights in the data. The PDPC Office suggests a three-part Legitimate Interest Assessment (LIA), explained step by step in our LIA guide.

The table below applies the three tests to common requests. The two right-hand columns are our illustrations and our reading, not rulings of the PDPC Office.

The third test contains a question every organisation can use. The PDPC Office asks whether, at the time and in the context of collection, the data subject could reasonably expect the data to be used or disclosed for this purpose. A person registering a car can expect that, after a collision, the other party may trace them. They would not expect a stranger to obtain a list of every vehicle they own.

Do police, the Revenue Department or other agencies need to cite a legal power?

It depends on the capacity in which they ask. The PDPC Office separates two broad situations: requests made under a direct legal power, and requests made without one. The second splits again into two routes.

One line deserves a second reading by every public body: for disclosures under Section 24(4) or (5), the PDPC Office sees no need for a legal power under any other law. Agencies without a specific statutory provision can therefore still ask, but the DLT must still weigh each request before it answers.

After deciding to disclose, what else must the DLT do?

Saying yes is only half the job. The PDPC Office lists five further duties. A private company that discloses customer data to outsiders carries the same set, except the first, which applies to state agencies.

1. Apply the Official Information Act of 1997 first, then the PDPA in addition under Section 3(1), because the DLT is a state agency.
2. Record every use or disclosure made without consent in the record of processing activities (RoPA) under Section 39, as Section 27, paragraph three, requires.
3. Disclose only what is necessary for a lawful purpose under Section 22, and not beyond what the owner would normally expect.
4. State in the privacy notice under Section 23 the purposes for which data may be used or disclosed and the categories of recipients.
5. Maintain appropriate security measures under Section 37(1) and the Committee's 2022 notification on security measures for data controllers.

The opinion closes by noting that if data subjects consider themselves harmed by a state agency's discretionary disclosure, they can file complaints under the relevant laws. Car owners are not without recourse if their data is released without good reason.

What should you prepare before asking for an owner's details?

The opinion sets no application form or document list. It does say the DLT may ask for evidence of the requester's rights, need and legitimate interest. The checklist below is therefore our suggestion, built around the PDPC Office's three tests. Ask the DLT office which documents it actually requires before you go.

1. State clearly who you are in the matter: the victim, an authorised lawyer or a judgment creditor.
2. Attach evidence of what happened, such as a copy of the police daily report, dashcam footage, a repair estimate or a copy of the judgment.
3. Write your purpose in one sentence, for example to sue for damages from a collision on a given date and place.
4. Ask only for what you need, usually a name and address to serve the claim, not the vehicle's entire history.
5. Confirm in writing that you will use the data only for the stated purpose, which Section 27, paragraph two, already requires of recipients.

Once you have the owner's name, what can you do with it?

Only what you said you needed it for. Section 27, paragraph two, binds recipients directly.

If the recipient is a juristic person, such as an insurer, a leasing company or a law firm, and it uses the name and address for something else, such as collecting an unrelated debt, selling insurance or passing it on, it breaches Section 27, paragraph two. Section 83 sets an administrative fine of up to THB 3 million for a data controller in breach.

For individuals, the most common risk is posting the owner's name in a group or on a page. Whether such a post breaks the law, and which law, is a question the PDPC Office has answered for the police several times. See posting about other people online.

Lessons for businesses that log other people's vehicles

Condominium juristic persons, car parks, malls and security firms often log plates, and some run plate-reading cameras. When an incident happens and someone asks for the data, we think the same reasoning applies: first decide whether the requester is an official acting under a legal power or a private party relying on its own interest, then run the three tests before answering.

If the police are asking, how to check the request and what to ask them to state is covered in when the police ask for customer data. For a creditor asking a private company about a debtor, see when a creditor asks for a debtor's data.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)