A Creditor Asks for a Debtor's Data: Disclose or Refuse?

Picture this: on a Monday morning HR opens an envelope from a law firm. Inside are a copy of a final judgment, a certificate that the case is final, and a letter asking for one employee's salary, pay date and bank account number. There is a court seal, a case number and a lawyer's signature. Every page looks official.

Many companies send the data at once because it seems to come from the court. Others refuse every request by citing the PDPA, even when the paper in front of them is a real summons. Both can be wrong, and each mistake has a section of the Personal Data Protection Act B.E. 2562 (2019) or another statute attached to it. The Office of the Personal Data Protection Committee (PDPC) has answered at least three advisory queries on the point. This article sorts the paper into what you must hand over and what you must think about first.

Can a creditor with a final judgment make a bank or employer disclose the debtor's data?

No. The question was put to the PDPC directly, in its advisory opinion on a judgment creditor asking a data controller to disclose the data of a judgment debtor under a final judgment. The applicant, Mr B, held a final judgment of a provincial court ordering the defendant to pay. He still had to trace assets himself, and banks refused to give deposit-account information on the ground that it was personal data.

The answer was not given lightly. The advisory sub-committee heard representatives of the Office of the Judiciary, the Thai Bankers' Association, the Bank of Thailand, the Lawyers Council and the Legal Execution Department, and put the issue to the Personal Data Protection Committee for interpretation under Section 16(10) before replying.

What the PDPC said about the Civil Procedure Code

Civil lawyers should read this part slowly. The opinion states that tracing the debtor's assets after a final civil judgment is the judgment creditor's job; once assets are found, the creditor informs the execution officer, who seizes, attaches or auctions them. The creditor is not left without a route, though. The PDPC pointed to two sections as amended by the Act Amending the Civil Procedure Code (No. 30) B.E. 2560 (2017).

• Section 277, as the opinion summarises it. Where the creditor has reasonable grounds to believe the debtor has more assets than the creditor knows of, or does not know where they are, the creditor may file an ex parte motion for a court inquiry. The court may summon the debtor or any other person likely to give useful statements, and may order that person to produce documents or material evidence relating to the debtor's assets, on such terms as the court sees fit.
• Section 283, as the opinion summarises it. Where there is reason to believe that assets, accounts, documents, letters or other objects relating to the debtor's property or business are in a place occupied by another person, the creditor may apply ex parte for a search warrant. The court inquires without delay and, if satisfied on the evidence, may issue a warrant for the execution officer to inspect and seize within the limits the court considers necessary.

The PDPC therefore concluded that the Civil Procedure Code already lays down the steps for reaching information about a judgment debtor's assets, and that Mr B could use them. The Code itself is not in our law corpus, so the paragraphs above report only the opinion's own summary. Anyone drafting a real motion must work from the current text of the Code.

Which letters must you obey at once, and which leave the decision to you?

Read together, the three opinions sort incoming paper into groups by the power of the sender. The lawful basis differs, and so does the burden on the company. In the first group there is nothing to weigh. In the others the company must reason, record and defend its own choice if the debtor complains.

The judgment-creditor opinion says that a controller receiving a summons or court order, or an order from another state agency or official with legal duties and powers, has a duty to disclose. For a request from the judgment creditor it switches wording: the controller has a duty to consider. The gap between those two phrases is the whole subject of this article.

With only a creditor's letter, how should the company weigh it?

The PDPC points to a three-step Legitimate Interest Assessment (LIA), with particular attention to whether the creditor's interest is no less weighty than the privacy the debtor would lose. If the request fails any step, disclosure needs the debtor's consent. Each step is explained in Legitimate Interest Under PDPA: Three Questions to Answer.

Step two is where creditors' letters most often fail, because the same opinion has just explained that a court route exists. A company that replies by pointing the requester to the Civil Procedure Code, and undertakes to comply with any summons or court order at once, has the opinion behind it and is not obstructing enforcement.

If the debtor objects

Data disclosed on the Section 24(5) basis is open to objection under Section 32(1). The opinion says that when the debtor objects, the controller must prove either a compelling legitimate ground or that the disclosure serves legal claims. That burden sits with the company, not with the creditor who already has the data.

Three opinions, three answers: which one is your company?

The mobile operator: a state requester does not switch the PDPA off

The operator asked whether the request fell under the Section 4(2) exemption for agencies charged with state security. The PDPC answered that the exemption covers only activities connected with maintaining state security; receiving consumer complaints and protecting consumer rights is broad work of a different kind. The PDPA therefore applies. That finding takes nothing from the agency's power, because the PDPC went straight on to say the operator must hand over what was demanded.

The lesson for companies is in the opinion's next sentence. A controller that discloses to a state-security agency is not itself exempt and keeps every PDPA duty. It is the same principle set out in Police Want Customer Data: What a Thai Company May Hand Over, which deals with criminal cases; this article is its civil and commercial counterpart.

The PDPC added that a telecom operator must also follow its sector rules under Section 3(1) of the PDPA: the frequency allocation law, the telecommunications business law, and the broadcasting and telecommunications regulator's notification of 17 August 2023 on protecting telecom users' personal data. Any regulated business, whether a bank, an insurer or a hospital, should open its own statute alongside the PDPA.

The loan company: one day your lender may ask for your whole debtor book

The company's lender required names, ID numbers, addresses, phone numbers, contract numbers, outstanding instalments and claim values for its borrowers, to prepare for a future assignment of claims, with the pool topped up monthly. The company asked whether it could simply write consent into its customers' loan contracts.

The PDPC also noted that consent can be withdrawn at any time, so collateral that depends on a continuing flow of data would rest on an uncertain basis. The route it left open is Section 24(5): a commercial interest can be a legitimate interest if the three-step assessment passes. Its examples include that an assignment does not make the customer liable for more than the existing debt, and that the customer could in good faith expect such use.

Conditions follow. Send only the items needed for the collateral; prefer less identifying data where it does the job; review the frequency; name this kind of recipient in the privacy notice under Section 23(4); provide a channel for objections under Section 32(1); and bind the lender not to use the data for anything else, under Section 27, paragraph two and Section 37(2).

A debt collector phones HR. What may you say?

This happens more often than a lawyer's letter, and a second statute comes in. Section 8 of the Debt Collection Act B.E. 2558 (2015) bars a debt collector from contacting anyone other than the debtor for the purpose of collection, apart from a person the debtor has designated, and narrowly limits what may be asked of anyone else.

Section 8 is a duty on the collector. It does not order the employer to answer and gives the employer no PDPA basis. It still helps HR a great deal. If the caller is a debt collector as defined in Section 3 and asks about salary or pay dates, or mentions that the employee owes money, the caller is going beyond what Sections 8 and 11(3) of that Act allow. The company has no reason to cooperate.

AIPDPA's suggested practice is one sentence for whoever takes the call: the company does not give employee information by phone, please write to the legal team. Then note the date, time and caller's name. This is good practice, not a legal duty, but it removes the risk of one member of staff disclosing on the company's behalf with no assessment at all.

Wrongly disclosing versus wrongly refusing: what does each cost?

The two mistakes are punished in different places. Disclosing without a basis falls under the PDPA: civil, administrative and, in some cases, criminal. Refusing when the law demands disclosure falls under the statute that empowers the requester. The table cites only sections in our corpus and what the opinions themselves state.

The defence a creditor's letter cannot give you

Section 77 lets a controller escape civil liability in two situations. The second is exactly on point.

On its wording, a company that discloses under a court summons or a competent official's demand has this defence available if the debtor sues. A company that discloses on a letter from a creditor or the creditor's lawyer does not: a creditor is not an official and a letter is not an order. This is AIPDPA's reading of the text, not a PDPC opinion, but it explains why the two kinds of paper carry such different risk for the person who signs the reply.

Who inside the company is exposed

Administrative fines and compensation fall on the data controller, meaning the company. Criminal liability under Section 79 is tied to Section 26 data, and where the company commits a criminal offence, Section 81 can reach individuals: those who gave the instruction, and those who had a duty to instruct or act and did nothing. A company in which nobody is assigned to check data requests before they are answered is exposed on that second limb.

A request for debtor data has arrived. What do you check before replying?

The list applies to any letter asking for data about a debtor, customer or employee. Items 1 to 3 place the letter in a row of the decision table. Items 4 to 8 apply whether you disclose or refuse. Where an item is AIPDPA's good practice and not a legal duty, it says so.

1. Who signed it? A court, an execution officer, a competent official of a state agency, or a party's lawyer? A court seal on an attached copy of the judgment does not turn a lawyer's letter into a court order.
2. What power does it cite? Does it name the statute and section that empower a demand for documents? If it only asks for cooperation, the mobile-operator opinion has already said Section 24(6) is unavailable.
3. Is it genuine? Call the court's or agency's switchboard, not the number printed on the letter. (Good practice.)
4. Whose data, which items, which period? If the request is broad, such as all information, ask in writing which items are needed and why.
5. On what basis was the data collected, and is Section 26 data mixed in? Check your record of processing first. Remove health data or criminal records, or pass the matter to a lawyer.
6. Assess and record. For a Section 24(5) request, run the three steps and have an authorised person sign. The PDPC advises entering the balancing reasons in the Section 39 record.
7. Send only what is necessary, and send it securely. Extract the named items, redact other people's data in the same document, and use a traceable channel, under Sections 22 and 37(1).
8. Log the disclosure or the refusal. Date, requester, document relied on, items sent, basis and approver, under Section 27, paragraph three.

A five-question self-test

Answer yes or no. Two or more noes mean your company could disclose wrongly, or refuse wrongly, with the very next envelope.

1. Do the staff who open post and answer phones know where every data request must go, and that they must not answer it themselves?
2. Can the company tell a court summons or order from a letter written by a party to the case?
3. Is there a three-step assessment form ready to use, and a named person with authority to sign it?
4. Do the customer and employee privacy notices list courts, state agencies and persons entitled by law as recipients under Section 23(4)?
5. How many disclosures to outsiders did the company make last year? Can you answer from your records, or only by asking each department?

A seven-day plan before the next letter arrives

1. Day 1
   Set one intake point. Every letter or call asking for personal data goes to legal or the DPO. Tell HR, accounts, sales and reception.Section 37(1)
2. Day 2
   Look back twelve months: what was sent to creditors, lawyers or agencies? Where nothing was recorded, record it now with whatever reasons the evidence supports.Section 27 para. 3 · 39
3. Day 3
   Write a one-page triage sheet from the decision table: court, empowered official, creditor, courtesy request.Section 24(5), (6)
4. Day 4
   Prepare the three-step assessment form for creditor requests, name the approver, and prepare a refusal letter that points to the court route the PDPC described.Section 24(5) · 32(1)
5. Day 5
   Review customer and employee privacy notices. Add the recipient categories and purposes for disclosures required by law.Section 23(1), (4)
6. Day 6
   If you routinely send debtor lists to a lender, an assignee or a collection agency, review the items, the frequency and the purpose-limitation clause in line with the loan-company opinion.Section 22 · 27 para. 2 · 37(2)
7. Day 7
   Run one drill with three hypothetical inputs: a court summons, a creditor's lawyer's letter, and a call from a debt collector. Does each reach the right person within a day?Good practice

For creditors and their lawyers: how do you ask and actually get the data?

Mr B's opinion tells creditors plainly that the route with compulsion behind it runs through the court. Once a court issues a summons or order, the bank or employer has a duty to disclose under Section 24(6) and no PDPA ground to refuse. A direct letter is still permitted, but the recipient may decline, and a careful recipient will decline unless the letter helps it pass the assessment.

• State a narrow purpose. Enforcement of which judgment, with proof that it is final and proof of your authority to act.
• Ask for no more than you need. Request the items that identify assets, not the personnel file. A broad request fails the necessity step every time.
• Explain why this route. The recipient has to answer whether a less intrusive way exists.
• Accept limits on use. Section 27, paragraph two binds you already. Confirming it in the letter helps the recipient decide.
• If you are a debt collector under the Debt Collection Act, do not tell the employer that the debtor owes money, and do not ask for more than contact location information. Sections 8 and 11(3) prohibit it.

What do the three opinions leave unanswered?

An advisory opinion is the sub-committee's view on the facts put to it. It is legal advice, not an order or a judgment. Mr B's opinion carries extra weight because the Personal Data Protection Committee interpreted the point under Section 16(10) before the reply went out. Even so, at least four matters are not settled, and this article does not settle them either.

• The outcome of the balancing in any given case. The PDPC set out the method. It did not say a judgment creditor always wins or always loses. Each request must be assessed on its own facts.
• Sector law for banks and state agencies. The opinion says only that the financial institutions business law and the Official Information Act B.E. 2540 must also be followed, and that controllers may consult the Bank of Thailand or the Office of the Official Information Commission.
• The form of a motion, time limits and the consequences of ignoring a summons. These are in the Civil Procedure Code, which is not in our corpus.
• Each type of paper an execution officer may send. The opinion speaks generally of orders from state agencies or officials with legal duties and powers and does not classify them one by one. If you cannot tell whether a document is an order, have a lawyer read it before replying.

If you are unsure on what basis each dataset in your company was collected, start with choosing the right PDPA lawful basis. For how to describe recipients in a notice, see a privacy notice people actually read, and for the full list of PDPA sanctions, the PDPA penalties guide.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)