A request for government records that name other people is a request under Thailand's Official Information Act of 1997, and the PDPC Office tells state agencies to apply that Act first and the PDPA on top of it under Section 3(1). Drawing on seven advisory opinions, this article shows citizens, journalists and NGOs what they can obtain, and gives officials a decision table.
- State agencies decide requests under the Official Information Act 1997 first, then apply the PDPA additionally under Section 3(1).
- Concession and procurement contracts must be open to inspection; parts barred by Sections 14 or 15 are redacted, not the whole file.
- Minutes naming committee members and their views from routine official work may be disclosed: no unreasonable intrusion, says the PDPC Office.
- Data about companies and other juristic persons falls outside the PDPA; only the Official Information Act applies.
- Consent-free disclosure can rest on Section 24(4) or (6) with Section 27, limited to what is necessary and logged in the Section 39 record.
A road-safety and passenger-rights network wrote to the Bangkok Mass Transit Authority (BMTA) asking to inspect and copy the joint-operation contracts for 55 bus routes. It relied on Thailand's Official Information Act B.E. 2540 (1997).
Those files held a great deal about individuals and companies: names, status, occupations and finances. Before answering, the BMTA asked the Office of the Personal Data Protection Committee (PDPC Office) whether letting an unrelated outsider see them would breach the Personal Data Protection Act B.E. 2562 (2019) (PDPA).
Several other state bodies have put similar questions to the PDPC Office. This article gathers seven of those opinions, covering construction contracts, meeting minutes, a register of auditors and environmental impact reports. It is written both for the people who ask for documents and for the officials who must answer them.
Must a Thai agency release records that name other people?
It must consider the request under the law; "the PDPA forbids it" is not an answer on its own. Every opinion discussed here points the same way: a document held by a state agency is official information, its release is governed by the Official Information Act, and the PDPA applies in addition.
The rule comes from Section 3 of the PDPA. A sector-specific law takes priority, but with carve-outs: on collection, use and disclosure of personal data, and on data subject rights, the PDPA always applies alongside it.
In the event that there is any sector-specific law governing the protection of Personal Data in any manner, any business or any entity, the provisions of such law shall apply, except: (1) for the provisions with respect to the collection, use, or disclosure of Personal Data and the provisions with respect to the rights of data subjects including relevant penalties, the provisions of this Act shall apply additionally, regardless of whether they are repetitious with the above specific law;
Our reading: an official has two questions to answer, in order. First, under the Official Information Act, how much of this document can be released? Second, under the PDPA, does releasing the parts that contain personal data have a lawful basis? Passing the first test does not remove the second, because the PDPA applies additionally rather than being displaced.
The PDPC Office used the same Section 3(1) logic when the Department of Land Transport asked about releasing vehicle owner details. See how it plays out for lawyers and accident victims in Will the DLT give you a car owner's name from a plate number?
Official Information Act or PDPA: which does an agency apply first?
The Official Information Act comes first, followed by the PDPA. The BMTA opinion states the order most clearly. The passage is quoted below in the original Thai.
ดังนั้น ขสมก. ในฐานะหน่วยงานของรัฐตามกฎหมายว่าด้วยข้อมูลข่าวสารของราชการ จึงควรพิจารณาดำเนินการให้เป็นไปตามพระราชบัญญัติข้อมูลข่าวสารของราชการ พ.ศ. ๒๕๔๐ ซึ่งได้กำหนดเรื่องการเปิดเผยข้อมูลข่าวสารของราชการของหน่วยงานของรัฐ รวมถึงข้อมูลข่าวสารส่วนบุคคลที่อยู่ในความควบคุมดูแลของหน่วยงานของรัฐไว้โดยเฉพาะแล้ว และให้ ขสมก. พิจารณาดำเนินการให้เป็นไปตามพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒ เป็นการเพิ่มเติมThe Student Loan Fund and the Federation of Accounting Professions received answers built on the same principle. The opinion for the Immigration Bureau adds that concealing or disclosing official information follows the Official Information Act, described there as the specific law that applies to state agencies.
Who counts as a state agency here
In these opinions, "state agency" is wider than ministries and departments. The PDPC Office treated the BMTA as a state agency under Section 4 of the Official Information Act. It also treated the Federation of Accounting Professions, a body that regulates a profession, as a state agency, so the Federation is bound by both Acts at once.
Another point worth knowing: information held by a state agency counts as official information whether it concerns the agency's own work or private parties. The BMTA opinion says so expressly. Contracts naming private operators therefore fall within the Official Information Act too.
| Agency that asked | Records or data | Who asked, or what required disclosure | Short view |
|---|---|---|---|
| Bangkok Mass Transit Authority (BMTA) | Copies of joint-operation contracts for 55 routes and related letters | A citizens' network on passenger rights | Official Information Act first, PDPA additionally; concession contracts must be open to inspection; juristic-person data is outside the PDPA |
| Department of Public Works and Town and Country Planning | A copy of a construction contract the Department awarded to a private firm | A requester (not identified in the opinion) | Procurement contracts must be disclosed; personal information whose release would unreasonably intrude on privacy may be redacted |
| Immigration Bureau | Minutes showing committee members' ranks, names and views | A retired official who had chaired that committee | May be disclosed: the information arises from routine official duties |
| Student Loan Fund | Selection exam scores, committee score sheets, other staff's appraisals and pay rises | An employee of the Fund | Decide under the Official Information Act and check for a basis under PDPA Sections 24 and 27 |
| Federation of Accounting Professions | Auditors' names, licence numbers, licence status, phone numbers, addresses and ethics penalty orders | Members of the public hiring an auditor | Name, licence number and status may be disclosed under Section 24(4) with 27; phone and address need consent |
| Office of the National Anti-Corruption Commission (NACC) | Tax or national ID numbers of selected bidders in public procurement | ITA assessment criteria following Comptroller General's Department guidance | Compliance with law under Section 24(6) with 27; not a personal data breach |
| Office of Natural Resources and Environmental Policy and Planning (ONEP) | Environmental impact assessment reports containing personal data | Local complainants, NGOs, the National Human Rights Commission, parliamentary committees | Requests under Section 11 follow the Official Information Act, weigh necessity, and must also comply with the PDPA |
How much of a concession or procurement contract can the public see?
The public can see it, and does not have to show any personal stake. The BMTA opinion cites Section 9 of the Official Information Act, which requires state agencies to keep certain records open for public inspection. They include concession contracts, contracts of a monopoly nature, and joint-venture contracts with private parties for public services.
โดยบุคคลไม่ว่าจะมีส่วนได้เสียเกี่ยวข้องหรือไม่ก็ตาม ย่อมมีสิทธิเข้าตรวจดู ขอสำเนา หรือขอสำเนาที่มีคำรับรองถูกต้องของข้อมูลข่าวสารดังกล่าวได้ และถ้ามีส่วนที่ต้องห้ามมิให้เปิดเผยตามมาตรา ๑๔ หรือมาตรา ๑๕ อยู่ด้วย ให้ลบหรือตัดทอนหรือทำโดยประการอื่นใดที่ไม่เป็นการเปิดเผยข้อมูลข่าวสารส่วนนั้นThe last clause is how names in a contract are handled. The agency does not have to choose between releasing everything and releasing nothing. It removes the parts barred under Section 14 or 15 and opens the rest.
Where a contract contains personal data, the PDPC Office asked the BMTA to weigh transparency, accountability and the avoidance of unreasonable intrusion on privacy. The test is how necessary disclosure is for the purpose of the Official Information Act, the BMTA's legal duties, the public interest and the interests of the private parties involved, in line with Section 15.
Construction contracts and published bidder details
The Department of Public Works asked about a copy of a construction contract it had awarded. The PDPC Office relied on the view of the subcommittee that answers questions under the Official Information Act: an approved procurement contract must be disclosed under the 2003 Royal Decree on good governance (Section 44), the Public Procurement Act 2017 (Section 8(2)) and Section 9(8) of the Official Information Act.
As for personal data inside the contract, the opinion says the Department may delete, cut or withhold only the parts whose release would unreasonably intrude on privacy. The same opinion explains that a requester may appeal a refusal under Section 15, paragraph two. The Department must also meet its PDPA duties, such as giving notice under Section 23 and keeping security measures under Section 37(1).
A related question came from the NACC Office. Under the public-disclosure measure (OIT) of the Integrity and Transparency Assessment (ITA), state agencies post the tax or national ID numbers of selected bidders on their websites. Was that a personal data breach?
The Personal Data Protection Committee said no. Publication follows Section 66, paragraph one, and Section 98 of the Public Procurement Act, and the information is also covered by Section 9(8) of the Official Information Act. Agencies may therefore disclose it on the basis of legal compliance.
(6) it is necessary for compliance with a law to which the Data Controller is subjected.
The Committee added that the Comptroller General's Department should review whether the full number needs to be shown, or whether part of it could be hidden or masked to reduce future misuse. Our recommendation: agencies that publish documents on their own initiative can apply that idea now, without waiting for a request.
Can you get meeting minutes that name committee members and their views?
In the case the PDPC Office answered for the Immigration Bureau, yes. The record was the minutes of a committee drafting technical specifications. They showed each attending member's rank and full name, and what each person said.
The requester was a retired official who had chaired that committee and needed the minutes to answer allegations by the NACC Office about a project. The PDPC Office saw the minutes as both official information and personal data, but found that releasing them intruded on no one's rights. The key passage is quoted below in Thai.
ข้อมูลข่าวสารดังกล่าวเป็นข้อมูลข่าวสารในการปฏิบัติหน้าที่ราชการตามปกติของเจ้าหน้าที่ของรัฐ และการเปิดเผยรายชื่อและข้อมูลเกี่ยวกับบุคคล และรายละเอียดเกี่ยวกับการแสดงความคิดเห็นในเรื่องดังกล่าว ไม่ได้ส่งผลกระทบหรือจะเป็นการรุกล้ำสิทธิส่วนบุคคลโดยไม่สมควรแต่อย่างใด ในทางตรงกันข้ามการเปิดเผยข้อมูลข่าวสารดังกล่าวจะแสดงถึงความโปร่งใสและตรวจสอบได้The core reasoning is that names and views in the minutes arise from official work, not from members' private lives, and that openness builds confidence in the agency itself.
Why other people's scores and pay are different
The Student Loan Fund case went another way. An employee asked for the promotion exam scores of successful candidates, every committee member's score sheet, and the pay rises of all division directors. The Fund's own legal subcommittee suggested giving the requester only his own scores, without showing which committee member gave which mark.
The PDPC Office did not say yes or no. It sent the Fund back to Section 3(1): decide under the Official Information Act first, then check whether PDPA Section 24 with Section 27, paragraph one, offers a basis for disclosure without consent.
In our view the difference from the minutes case lies in the data itself. Exam scores, appraisals and pay concern the person directly, while views expressed in a meeting are the product of official duty. The first kind calls for a more careful balance.
Does the PDPA protect information about contracting companies?
No. The PDPA covers only natural persons. Information about companies and other juristic persons in a contract is decided under the Official Information Act alone. The BMTA received exactly this answer.
ส่วนกรณีการเปิดเผยข้อมูลของนิติบุคคลอื่นตามที่ ขสมก. หารือมา ไม่อยู่ในบังคับของพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒ เนื่องจากข้อมูลส่วนบุคคลตามพระราชบัญญัติดังกล่าวครอบคลุมเฉพาะข้อมูลเกี่ยวกับบุคคลธรรมดาซึ่งทำให้สามารถระบุตัวบุคคลนั้นได้ไม่ว่าทางตรงหรือทางอ้อมตามมาตรา ๖In practice, a company's name, standing and financial details do not need a PDPA check. The names of directors or signatories who appear in the contract, however, are data about natural persons. That is our reading, based on the BMTA's statement that its files mixed data on individuals and on companies.
The opinion also notes that disclosure of juristic-person data lies outside the PDPC Office's remit. An agency unsure about company information should look for guidance under the Official Information Act, not from the PDPC Office.
Which PDPA basis lets an agency disclose names in its records?
Two bases come up most often: a public task or the exercise of official authority under Section 24(4), and legal compliance under Section 24(6), discussed above for procurement. Both work together with Section 27, paragraph one, which allows data collected without consent on those bases to be used or disclosed without consent.
(4) it is necessary for the performance of a task carried out in the public interest by the Data Controller, or it is necessary for the exercising of official authority vested in the Data Controller;
The Federation of Accounting Professions illustrates Section 24(4). The PDPC Office agreed it may publish every licensed auditor's name, licence number and licence status online, and confirm status by phone, without consent. Phone numbers and home addresses are not needed to check status, so publishing them requires consent.
On ethics penalty orders, the PDPC Office said posting the details on the website for everyone may unreasonably intrude on privacy, yet members of the public or interested parties can still ask to inspect them case by case under the Official Information Act. Publishing to the world and answering one request are judged separately.
The BMTA opinion lists both bases as examples and asks the BMTA to check whether a disclosure fits Section 24 or Section 26, read with Section 27, paragraph one. Section 26 covers sensitive data such as health information, which the ONEP opinion on environmental impact reports also discusses.
Disclosing without consent brings one more duty that is easy to forget: logging the disclosure in the record of processing under Section 39. The opinion for the Federation of Accounting Professions spells this out.
In the event that the Data Controller uses or discloses the Personal Data which is exempted from consent requirement in paragraph one, the Data Controller shall maintain a record of such use or disclosure in the record under section 39.
How should an official decide a request?
The table below is built from the opinions above. The step 1 and step 2 columns are our summary of each opinion, not a form issued by the PDPC Office, and they do not replace the views of the Official Information Commission.
| If the request is for | Step 1: Official Information Act | Step 2: PDPA | Opinion to cite |
|---|---|---|---|
| A concession, monopoly or public-private joint-venture contract | Open for inspection and copying; redact parts barred under Section 14 or 15 | Find a basis under Section 24(4) or (6) with 27, then log it under Section 39 | BMTA |
| An approved procurement contract | Disclose; redact personal information whose release would unreasonably intrude on privacy | Meet PDPA duties such as notice under Section 23 and security under Section 37(1) | Public Works |
| Selected-bidder details the agency publishes itself under Comptroller General's guidance | Information under Section 9(8) and the Official Information Commission's notification | Section 24(6) with 27, with a recommendation to consider partial masking | NACC |
| Minutes naming officials and their views from routine official work | May be disclosed: no unreasonable intrusion, and it shows transparency | The Official Information Act is the specific law under Section 3 | Immigration Bureau |
| Other people's scores, appraisals or pay | Decide under the Official Information Act (the opinion gives no final answer) | Check for a basis under Section 24 with Section 27, paragraph one | Student Loan Fund |
| A register of licensed professionals | Names and licence numbers may be released; phone and address may intrude under Section 15(5) | Section 24(4) with 27 to the extent necessary; anything beyond needs consent | Federation of Accounting Professions |
| An EIA report requested by complainants or NGOs under Section 11 | Follow the Official Information Act; weigh how necessary disclosure is, in line with Section 15 | Must comply with the PDPA as well | ONEP |
| Information about a company or other juristic person | Decide under the Official Information Act alone | Not subject to the PDPA | BMTA |
Common misunderstandings
Every opinion above starts from the Official Information Act, and the PDPA offers consent-free bases for disclosure.
Under Section 24(4) or (6) with Section 27, paragraph one, disclosure needs no consent. Consent matters for anything beyond what is necessary, such as auditors' phone numbers and addresses.
Section 3(1) makes the PDPA apply additionally to collection, use, disclosure and data subject rights.
The PDPA protects only natural persons under Section 6. Company data is decided under the Official Information Act.
For the Federation of Accounting Professions, ethics orders may be inspected case by case, but posting their details for everyone may unreasonably intrude on privacy.
What should a requester prepare?
The recommendations below are ours, drawn from what the opinions give weight to; they are not any agency's official procedure. The opinions say nothing about request forms, fees or time limits, so check those with the agency that holds the records.
- Identify the record precisely. If it is a concession, joint-venture or procurement contract, say that it belongs to the categories the BMTA and Public Works opinions describe as open to public inspection.
- State in the request that you will accept a copy with barred parts removed, so the agency does not face an all-or-nothing choice.
- If you genuinely need the names or details of individuals, explain which transparency or accountability issue they relate to, because that is what the agency must weigh, as the BMTA and ONEP opinions explain.
- If part of the request is refused, ask for the reasons and consider an appeal under Section 15, paragraph two, as described in the Public Works opinion.
- Once you have the records, use them for the purpose you gave and take care before publishing personal data further; see the FAQ on journalists below.
Planning to post documents or photos that show other people online? See Posting about other people online: is it a PDPA breach?
The limits of this article
PDPC Office opinions are advice to the agency that asked. They are not rulings of the Official Information Commission. On questions that turn on the Official Information Act itself, the PDPC Office advised the Marine Department to consult that Commission, which gives advice under Section 28(2) of the Act.
Sections of the Official Information Act mentioned here, such as Sections 9, 11, 14 and 15, are described only as far as the PDPC Office opinions cite or explain them. Read the full text of the Act before answering a real request.
Frequently asked questions
Do I have to say why I want a government record?
For records listed in Section 9 of the Official Information Act, such as concession contracts, the BMTA opinion explains that anyone, with or without a stake, may inspect and copy them. If you want personal data in the record released, explaining why it is needed helps the agency carry out its balancing.
Must the agency get consent from everyone named in the record?
Not always. If disclosure fits Section 24(4) or (6) read with Section 27, paragraph one, no consent is needed, but the agency must limit it to what is necessary and log it in the Section 39 record. Data beyond that, such as auditors' phone numbers and addresses, needs consent first.
Can a journalist publish the names found in records obtained this way?
These opinions do not answer that directly. The ONEP opinion explains that Section 4(3) of the PDPA exempts use or disclosure of data collected only for mass media work that follows professional ethics or serves the public interest. In our view, anyone outside that exemption should use the data for the purpose stated in the request, because Section 27, paragraph two, bars recipients from using it for other purposes.
Can I see everything about the company that won a tender?
The PDPA does not protect juristic-person data, according to the BMTA opinion, so disclosure is decided under the Official Information Act alone. For the tax or national ID numbers of selected bidders, the Personal Data Protection Committee found that publication under Comptroller General's guidance complies with Section 24(6) read with Section 27.
An agency published records before the PDPA took effect. Must it take them down?
The ONEP opinion on environmental impact reports says publication before the PDPA took effect was done under the Official Information Act, but once the PDPA applies, disclosure must meet Section 27, paragraph one, with Section 24 or 26. It did not order everything removed; it asked ONEP to decide whether and how far disclosure can continue, given the purpose of disclosure.
You have read it. Now get it done
Open the demo account to see the real AIPDPA system with a sample company: RoPA, the 72-hour breach clock, data subject requests, cookie consent and ready-to-use documents, all in one place.
From 2,900 THB/year (11 modules) · all 24 modules from ENTERPRISE at 19,900 THB/year · demo account, no sign-up
No time? Have our lawyers handle it →Kooru's lawyers set it up and act as your DPO
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 3 (1) · 4 (3) · 6 · 24 (4) (6) · 26 · 27 · 39
- Summaries of PDPC advisory opinions under the Personal Data Protection Act B.E. 2562 (Office of the Personal Data Protection Committee)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)