The organ donor mark on a Thai driving licence is health data under Section 26, according to the Personal Data Protection Committee. A business that copies a licence without intending to use that status is not collecting health data. HR teams, car-rental firms and condominium managers will learn where the line sits and which mistakes turn a routine copy into sensitive data.
- The Committee considers the Thai Red Cross emblem and the words "organ donor" on a driving licence to be health data under Section 26.
- Copying a licence without intending to use the donor status or health information is not collecting health data under Section 26.
- Holders choose to show the mark, which may count as consent for people who see or receive a copy to use it as far as needed for that purpose.
- Using the status, for example tagging staff records or segmenting customers, becomes collecting health data. Section 84 fines reach THB 5 million.
- Holders can have the mark removed by amending the licence, possibly for a fee. Withdrawal does not undo earlier lawful use.
Since 2024, people applying for or renewing a Thai driving licence can ask for the Thai Red Cross emblem and the words "organ donor" to be printed in the right-hand corner. This follows a cooperation agreement between the Department of Land Transport (DLT) and the Thai Red Cross Society dated 9 August 2024. The aim is to let medical staff know the holder has registered an intention to donate organs, so they can coordinate with the Thai Red Cross when there is a medical need.
The catch is that a driving licence does not stay in its owner's wallet. Car-rental firms, hotels, condominium juristic persons, logistics companies and HR teams hiring drivers copy licences every day. A company referred to as Company Ng therefore asked the Office of the Personal Data Protection Committee (PDPC Office) whether the mark is sensitive data under Section 26, so it could set rules for keeping copies.
The question went up to the Personal Data Protection Committee itself, for interpretation and a ruling under Section 16(10), rather than stopping at subcommittee level. That gives the answer more weight than an ordinary advisory opinion, and it addresses something most businesses have never considered.
Is the organ donor mark on a driving licence health data?
Yes. The Committee considers that the status of having registered an intention to donate organs with the Thai Red Cross, as shown on a driving licence or a vehicle crew licence, is personal data concerning health under Section 26 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA).
Any collection of Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner, as prescribed by the Committee, is prohibited, without the explicit consent from the data subject, except where:
Neither the PDPA nor its secondary legislation defines "health data". The Committee therefore drew on two other documents, and both treat an intention to donate organs as health information.
| Source | What it says about organ donation | Status |
|---|---|---|
| A report by a subcommittee of the Public Health Committee of the National Legislative Assembly, noted by the Assembly on 17 March 2016 | Proposed that "personal health data" include data collected when a person donates, or declares an intention to donate, organs | A proposal made at the drafting stage; not a definition in the PDPA as enacted |
| The Primary Health Care System Committee's 2023 notification on protecting service users' health data | Defines health data to include a written declaration of intent to donate organs | A notification issued under the Primary Health Care System Act of 2019 |
The Committee also applied a test it set in opinion No. 2/2568 (2025): whether data belongs under Section 26 depends on whether it may affect a person's rights and freedoms seriously or excessively, and whether the exceptions in Section 26 suit that kind of data.
For the licence mark, the Committee found that the data concerns an expression of intent about receiving health services and serves mainly medical purposes, so it can affect rights in the same way as other health data. It then checked whether the Section 26 exceptions leave enough room for organ donation work to continue, and concluded that they do.
Who can use this data without explicit consent?
The Committee identified four situations, each read with Section 27, paragraph one, which allows use or disclosure of data collected under an exemption.
| Situation | Who uses it | PDPA basis |
|---|---|---|
| Providing health services or medical treatment directly to the person | The Thai Red Cross, hospitals, medical staff | Section 26(5)(a) |
| Organ donation work within each body's legal duties and powers | The Thai Red Cross, hospitals and related agencies | Possibly Section 26(5)(b), public interest in public health |
| Saving a life or treating someone in an emergency when they cannot consent | Whoever must save or treat them | Section 26(1) |
| The holder chose to print the mark, could expect others to see it, and can have it removed | People who are shown the licence | Possibly Section 26(3), data made public with explicit consent |
it is information that is disclosed to the public with the explicit consent of the data subject;
Conversely, if the Thai Red Cross obtained explicit consent when the person registered, it can use the data in the situations covered by that consent. The consent must meet Sections 19 and 20, and a withdrawal must be handled under Section 19, paragraphs five and six.
Do car-rental firms, condos and hotels need explicit consent to copy a licence?
No, provided they do not intend to use the donor status. The Committee considers that a data controller who keeps a copy of a driving licence without any purpose of using the organ donor status, or of using it for health purposes, is not collecting health data under Section 26. It drew this by analogy from opinion No. 10/2568 (2025) on Bank X and benefits for staff and their families.
That does not make licence copies a free-for-all. A copy is still ordinary personal data: it needs a legal basis under Section 24, the purpose must be stated under Section 23, and only what is necessary may be kept under Section 22. What changes is that the mark alone does not force a business to seek explicit consent.
The collection of Personal Data shall be limited to the extent necessary in relation to the lawful purpose of the Data Controller.
Why people who receive a copy may use what is on it
The Committee added an observation. Holders choose to have the mark printed, are free not to, and can remove it later. Choosing to display it may therefore be treated as an intention to consent to disclosure to anyone who is shown the licence or given a copy, as far as necessary for the purpose of showing or handing over the licence.
This matches an earlier PDPC Office opinion for the Medical Council on medical certificates, one form of which is used for driving licence applications and may record a history of epilepsy. Individuals may show their own health information to others, but the recipient's duties do not disappear. The relevant passage is quoted below in the original Thai.
บุคคลหรือหน่วยงานที่นำใบรับรองแพทย์/ใบรับรองสุขภาพดังกล่าวไปใช้ หรือมีการเก็บรวบรวมข้อมูลส่วนบุคคลจากใบรับรองแพทย์/ใบรับรองสุขภาพดังกล่าวจึงต้องจัดให้มีมาตรการรักษาความมั่นคงปลอดภัยและการคุ้มครองข้อมูลส่วนบุคคลดังกล่าวให้มีความเหมาะสมและเป็นไปตามวัตถุประสงค์ในการเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลส่วนบุคคลนั้นด้วยWhich mistakes turn an ordinary licence copy into sensitive data?
The Committee's answer turns on the words "without any purpose". As soon as a business starts using the donor status for something, the exception no longer helps. All examples below are hypothetical, and the grouping is our reading.
The copy serves identity checks and the contract, not the donor status. It still needs a Section 24 basis and must be kept only for the stated period.
Once the status becomes a searchable data point, it is hard to argue there was no purpose of using it. Configure the system not to extract that field at all.
There is now a purpose of using the status, so a Section 26 basis or the employee's explicit consent is required.
No Section 26 exception covers marketing. Explicit consent is required, and it must be freely given under Section 19, paragraph four.
This uses and discloses Section 26 data outside the reason the customer handed over the licence, in a way that may harm or embarrass them.
The last two cases are where penalties come in. Section 84 sets an administrative fine for a data controller that breaches Section 26, paragraph one. If using or disclosing Section 26 data in breach of Section 27 is likely to cause someone damage, loss of reputation or humiliation, Section 79 provides criminal penalties of up to six months' imprisonment, a fine of up to THB 500,000, or both.
Any Data Controller who violates section 26 paragraph one or three, or section 27 paragraph one or paragraph two, or section 28 in relation to the Personal Data under section 26, or fails to send or transfer the Personal Data under section 26 to be in accordance with section 29 paragraph one or paragraph three, shall be punished with an administrative fine not exceeding Baht five million.
Can holders have the mark removed from their licence?
Yes. The Committee states that holders can ask to amend their driving licence or vehicle crew licence and obtain a new one without the emblem and text, possibly for a fee set by the DLT. Doing so withdraws consent to the collection, use and disclosure of that data.
- When applying for a licenceThe applicant chooses whether to show the organ donor mark. The Committee recommends that the DLT turn this choice into an explicit consent request.Sections 19 and 20
- When handing the licence or a copy to someoneRecipients may use the data as far as needed for the purpose of handing it over. Without a purpose of using the donor status, it is not collecting health data.Sections 26(3) and 27
- When asking to remove the markThe holder amends the licence and receives a new card, possibly for a fee set by the DLT. This withdraws consent.Section 19, paragraph five
- After withdrawalCopies others obtained lawfully before do not become unlawful retroactively, but businesses must still keep only what is necessary and delete when the reason ends.Sections 19 and 22
However, the withdrawal of consent shall not affect the collection, use, or disclosure of personal data that the data subject has already given consent legally under this Chapter.
The last row of that sequence is our reading. The opinion does not discuss deleting copies a business already holds, but the necessity principle in Section 22 and the retention period that must be disclosed under Section 23 apply to these copies just as they do to any ID copy.
What should businesses that keep licence copies do now?
The checklist below is our recommendation based on the Committee's answer, not a requirement in the opinion. Working through it lets a business explain why it keeps copies and show that it does not use donor status.
- List every activity that asks for a licence copy, such as car rental, hotel check-in, building access or hiring drivers, and record the reason for each.
- Ask whether you need to keep a copy at all, or whether viewing the card and noting the necessary number is enough. No copy means no copy to protect.
- If you use automatic card reading, configure it not to capture fields you do not use, such as donor status, and check that the field has not leaked into your database.
- Do not use donor status for tagging, segmentation or reporting unless you have a Section 26 basis and have recorded why.
- Limit who can open copies and apply security measures under Section 37. Ban sending licence photos through personal chat apps.
- State in your privacy notice why you keep licence copies, for how long, and when you delete them.
What the Committee recommended to the DLT
The Committee suggested that the DLT revise its licence application form so that choosing to display the mark is an explicit consent request under Sections 19 and 20. It also suggested stating clearly that the choice means consenting to people who are shown the licence, or given a copy, collecting, using or disclosing the data only as far as needed for that purpose.
The opinion does not say whether the DLT has revised the form. If you are applying for or renewing a licence, read that part of the form carefully. If you choose to show the mark, the information travels with every copy you hand to someone else.
Frequently asked questions
If I did not choose the organ donor mark, does my licence contain health data?
The opinion addresses only the Thai Red Cross emblem and the words "organ donor" printed on the licence. If your card does not carry the mark, the opinion does not say there is other health data on its face.
Can I refuse when a car-rental firm wants to copy my licence with the donor mark?
Whether to hand over a copy is between you and the business; the opinion does not address it. What it does say is that a business keeping a copy without intending to use donor status is not collecting health data, and may use the data only as far as needed for the reason you gave it the licence.
Must a business obtain explicit consent every time it copies a licence?
No. If it does not intend to use the donor status or health information, the Committee considers it is not collecting health data under Section 26. The copy is still personal data that needs a Section 24 basis and a Section 23 notice.
How do I get the organ donor mark removed from my licence?
The Committee says you can ask to amend the licence and obtain a new one without the mark, possibly for a fee set by the DLT. Ask the DLT directly about the procedure and documents.
Does the same apply to vehicle crew licences, such as for bus drivers?
Yes. The Committee's opinion covers both driving licences and licences to work as vehicle crew.
You have read it. Now get it done
Open the demo account to see the real AIPDPA system with a sample company: RoPA, the 72-hour breach clock, data subject requests, cookie consent and ready-to-use documents, all in one place.
From 2,900 THB/year (11 modules) · all 24 modules from ENTERPRISE at 19,900 THB/year · demo account, no sign-up
No time? Have our lawyers handle it →Kooru's lawyers set it up and act as your DPO
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 16 (10) · 19 · 20 · 22 · 24 · 26 (1) (3) (4) (5) (a) (b) · 27 · 37 · 79 · 84
- Summaries of PDPC advisory opinions under the Personal Data Protection Act B.E. 2562 (Office of the Personal Data Protection Committee)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)