Staff Medical Claims and Family Data: When HR Needs Consent

Picture this: on Monday morning HR opens the in-tray and finds three reimbursement claims. The first is from an accounts clerk, with a medical certificate naming her illness. The second is the delivery driver's claim for his wife's childbirth. The third covers surgery for a department head's mother-in-law. All three will be scanned into the HR system, passed to accounts and, in some companies, passed on to an insurer.

Every one of those papers is health data. Section 26 of Thailand's Personal Data Protection Act B.E. 2562 (PDPA) forbids collecting it without explicit consent unless an exemption applies. Two of the three data subjects are not employees and have never signed a single document with the company.

Companies, a bank and a state agency were unsure enough about this to ask the Office of the Personal Data Protection Committee (PDPC) at least four times. The answers do not all point the same way. Some activities need no consent at all, others do, so a single blanket consent form signed by everyone can be wrong in both directions. This article sets the four answers side by side, then turns them into a document-by-document table and a seven-day plan.

Is a hospital receipt really sensitive data?

Yes. Many companies assume that only a medical certificate naming a disease is health data and that a receipt is a mere finance document. When the Digital Government Development Agency (DGA) asked, the PDPC said the claim form, the medical certificate and the receipt are all health data under Section 26.

The DGA's claim form asked for the name of the officer or family member, the illness treated, the hospital and the amount. Most private-sector claim forms ask much the same. A Thai hospital receipt usually shows the treating department and the medicines dispensed, so whoever reads it can tell what the patient has.

The consequence is that the whole benefits file sits under Section 26. The contract basis and the legitimate-interest basis in Section 24, which carry most ordinary staff data, do not work here. You need a Section 26 exemption, and if none fits you need explicit consent. For the wider picture of Section 26 data inside a company, see The Sensitive Data Your Company Holds Without Knowing It.

Does a private employer need consent to reimburse staff medical costs?

No, if the benefit is part of an agreement on conditions of employment that binds the employer under labour relations law. If it is not, explicit consent is required. That is the PDPC's answer in its opinion titled, in translation, Company W's query on collecting medical treatment data to reimburse welfare benefits.

Company W asked for consent, and staff refused

Company W's medical benefit came out of demands made by its labour union and covered both ordinary and serious illnesses. To claim, an employee handed HR a medical certificate stating the illness or symptoms, plus the receipt. HR checked them, keyed the data into the HR system, paid the money with salary, and kept the papers for 10 years for Revenue Department inspection.

Seeing health data, the company drew up a consent form that said no consent meant no payment. Some employees refused to sign. They argued that the exemption in Section 26 (5) (c) applied and that the company had to pay under the employment-conditions agreement anyway. Company W asked the PDPC what to do.

The PDPC sided with the employees' reading. An agreement on conditions of employment binds employer and employees under Section 19 of the Labour Relations Act B.E. 2518 (1975). If Company W considers that collecting health data to assess claims is part of that agreement, the collection is necessary to achieve a purpose relating to employment protection, and no explicit consent is needed. The exemption sits in Section 26 (5), which covers what is necessary for compliance with a law to achieve the purposes listed, including this one:

The PDPC listed other employer activities under the same exemption: asking for a medical certificate to support sick leave, sterilisation leave, maternity leave, and the temporary change of duties for a pregnant employee who produces a medical certificate, all under the Labour Protection Act. None of these needs a consent form.

"Entitled person by law" does not mean a private-sector employee

Section 26 (5) (c) also mentions health welfare "of the entitled person by law". A private-sector HR team could read that as covering its own benefit scheme. In the Company W opinion the PDPC observed that the phrase covers civil servants, permanent state employees and personnel of state bodies who are entitled under law, together with their family members. It does not cover employees of a private organisation who are not entitled persons under law.

For a benefit the company runs itself, a private employer therefore has to rely on the words "employment protection". To do that it must be able to point to labour law, or to a legally binding agreement on conditions of employment, as the source of the benefit.

When the benefit is not in an employment-conditions agreement

The same opinion deals with this. A medical or health benefit that the employer provides outside any agreement on conditions of employment binding under labour relations law does not fall within Section 26 (5) (c). Collecting health data to assess those claims requires the data subject's explicit consent.

Here the employer may make consent a condition: whoever wants to claim must consent, otherwise the company cannot assess the claim. The PDPC said this is consistent with Section 19, paragraph four, because the data is necessary for and related to assessing the claim. Before setting the condition, the employer must ask whether each item, such as the name of the illness on a certificate, is necessary for the assessment, and to what extent.

Two duties follow. First, tell people the possible effect of not providing the data or of withdrawing consent, under Section 23 (2) and Section 19, paragraph six. Second, the PDPC recommends explaining why consent is a condition of the claim, before or at the time of collection, so that staff understand it. For the elements of a valid consent form, see the valid consent guide.

What is the basis for a spouse's, child's or parent's data when they never signed anything?

The same exemption as for the employee, if the family benefit sits in a binding agreement on conditions of employment. After the Company W opinion was published, Bank X took the family question to the PDPC, in the opinion titled, in translation, Bank X's query on the lawful basis for processing personal data of employees and employees' family members for welfare entitlements.

The bank asked activity by activity. For employees: medical and health check-up reimbursement, sick leave of three consecutive days or more, maternity leave, sterilisation leave, leave for Buddhist ordination or the Hajj, and interest-free medical loans. For families: medical costs of a spouse or child, medical loans for a spouse, child, parent or parent-in-law, a marriage loan, and leave to help a wife who has given birth.

The bank had two worries. The family benefits came from the employer's own proposal, not from union demands as at Company W. And the data subjects were not the bank's employees.

What the PDPC told Bank X

The PDPC said an agreement on conditions of employment binds employer and employees whether it arose from the employees' proposal or the employer's, and whether the benefit goes to the employee, a spouse, a child, the employee's parents or the spouse's parents. If the bank considers that collecting religious belief, health, disability or other Section 26 data is necessary for claiming and assessing a right or benefit under law or under that agreement, Section 26 (5) (c) applies.

On that footing the bank may collect, use and disclose the data without explicit consent, under Section 26 (5) (c) read with Section 27, paragraph one. The PDPC attached two conditions. The bank must collect only what is necessary under Section 22, and must have suitable measures to protect the data subjects' fundamental rights and interests.

The opinion also explains the labour law behind its reasoning. We report only what the opinion says, because the labour statutes are not in our corpus. According to the opinion, Section 10 of the Labour Relations Act requires an establishment with 20 or more employees to have an agreement on conditions of employment, and where it is doubtful whether one exists, the work rules an employer must have under labour protection law are deemed to be that agreement.

That matters for companies without a union. A benefit written into the work rules has a chance of meeting the same condition as Bank X's. A perk that management announces from time to time, recorded in no such document, is something the PDPC did not say qualifies. Have a labour lawyer read your actual documents before you conclude either way.

If the condition is not met, whose consent is needed?

The PDPC went on: where Section 26 data is not collected for a right or benefit under law, is not part of an agreement on conditions of employment, and fits no other Section 26 exemption, the data subject's explicit consent is required under Section 26, paragraph one. The request must comply with Sections 19 and 20.

The data subject here is the spouse, the child or the parent. The employee cannot sign for them, except in the situations Section 20 provides for, such as a minor child, where consent comes from the holder of parental responsibility on the conditions of that section. See children's data and parental consent.

Is a same-sex marriage certificate Section 26 data?

Bank X raised a point every HR team will meet. A spouse's claim documents may reveal, from a title or a related document, that the marriage is between two people of the same sex. Does that make it data about sexual behaviour under Section 26?

The PDPC said no, provided the bank has no purpose of using the data to identify sexual behaviour. It compared the case to a photograph of a woman wearing a hijab that is not collected to identify religion, and to a person's weight that is not collected to identify a health condition or risk. Marital status therefore rests on whichever Section 24 basis matches the purpose.

A warning follows. The data could be used to identify or infer sexual behaviour, so the bank must keep to the notified purpose under Section 21, collect only what is necessary under Section 22, give notice under Section 23, and secure the data under Section 37 (1) to the minimum standard in the PDPC Notification on Security Measures of Data Controllers B.E. 2565 (2022), with suitable organisational and technical measures and any physical measures needed.

Family data arrives through the employee. Must the family be told?

A spouse's or parent's data reaches the company through the employee, which is collection from a source other than the data subject. Section 25, paragraph one (2) allows that where the collection is exempt from consent under Section 24 or Section 26. In the DGA opinion the PDPC applied this provision and said the agency could collect family members' health data without first notifying them and obtaining their consent.

The Bank X opinion does not discuss Section 25 directly, but it stresses the Section 23 notice duty in the passage on marital status. The safe course for a private company is to print a short notice on the claim form for the employee to pass on, saying what the company collects about family members, what for and for how long. This is the AIPDPA team's good-practice suggestion, not wording from the opinion.

Does the same exemption cover data sent to a group insurer?

No. This is the easiest mistake for HR to make: if no consent is needed when the company pays claims itself, surely none is needed to send the data to an insurer. In the DGA opinion the PDPC separated the two.

The PDPC's reason is that disclosure to an insurance company is disclosure to another person and is not directly necessary for compliance with a law. The insurer is a separate data controller. The PDPC also gave a way through: the agency may make it a condition that personnel or family members who want the benefit consent to their data going to the insurer, because that is necessary for and related to the benefit under Section 19, paragraph four.

The private-sector opinion points the same way. In Company K.'s query about group insurance, the PDPC said that Section 19, read with Sections 24, 26 and 27, paragraph one, requires the collection, use or disclosure by the controllers involved in that case to have the data subject's consent before or at the time it happens.

The insurer asks HR to certify that staff have consented. Can you sign?

You can, as long as you know what you are certifying. Company K. had held a group policy with one insurer for four to five years. The insurer then asked it to sign a certificate that consent had been obtained from insured members and dependants, failing which it would accept no new members and would not renew. Company K.'s data protection officer saw this as the employer consenting on its employees' behalf, and asked the PDPC.

The PDPC said the certificate does not make Company K. consent for its staff. It is a statement to the insurer that Company K. has made the insurer's privacy policy known to members, that the data supplied is accurate, and that Company K. has taken the insurer's consent form to its employees and obtained their consent. Delegating the task of asking for consent in this way is lawful, provided the consent obtained meets Sections 19 and 20.

The part to read closely is what comes with the signature. The opinion summarises that part of the certificate as follows.

For HR that means four jobs. Obtain consent from each employee and each dependant individually. Keep the evidence at all times and produce it when the insurer asks. Have a procedure for withdrawals. Accept liability to the insurer or broker as the document provides. If you sign while consent forms are missing for some of the names, the company is certifying something that is not true.

If the terms are unacceptable, the PDPC named two options: negotiate with the insurer, or look at other life insurers' terms. It classed the certificate as a juristic act under the Civil and Commercial Code that the parties are free to amend, and noted that nothing in the PDPA says Company K. must or must not sign. As for the insurer refusing service without a signature, the PDPC treated that as a matter of contract between private parties, governed by the contract terms and the Civil and Commercial Code.

A defective consent form cannot support the certificate either. Section 19, paragraph three requires a consent request to be clearly distinguishable from other matters and to state the purpose. A consent clause buried in an employment contract or an insurance enrolment form, without that separation, risks the outcome in the last paragraph of the same section.

Which basis applies to each document in the benefits file, and what must HR do?

This table turns the four PDPC answers into a list by document. "In the agreement" means the benefit or right is part of an agreement on conditions of employment that binds the employer, or is a right under labour law. Every row that relies on Section 26 (5) (c) carries the same condition: the employer must consider the data necessary for assessing the entitlement, and must protect the data subject with suitable measures.

How do the four opinions differ?

All four turn on Section 26 (5) (c), but the organisations asking stood in different positions and relied on different words inside paragraph (c). Read one in isolation and it is easy to draw the wrong conclusion, especially for a private company borrowing an answer given to a state agency.

The DGA opinion records that the Personal Data Protection Committee itself was consulted at its meeting no. 6/2566 to interpret the Act under Section 16 (10). The other three are views of the sub-committee that answers queries. All of them respond to the facts as told by the organisation that asked. They are not legislation and not penalty orders, so check that your own facts match before relying on one.

Note the PDPC's wording for Company W and Bank X. The answers begin with "if" the employer considers the collection necessary and part of the agreement. The assessment is the employer's to make, and the employer must be able to explain it when asked. Put that reasoning in writing.

Six hypothetical situations: which one is your company?

What does the Act attach to getting health data in the HR file wrong?

The PDPA provides three kinds of consequence: administrative fines, criminal penalties and civil liability. Section 26 data carries the highest administrative fine ceiling in the Act, and it is the only category for which Section 79 provides imprisonment for a data controller. The provisions quoted below are the ones that fit benefits administration.

Administrative fines

Collecting health data with neither an exemption nor explicit consent is a breach of Section 26, paragraph one. Using or passing it on without a basis is a breach of Section 27, paragraph one. Both fall under Section 84. Under Section 90 the expert committee may order rectification or issue a warning first, and must take into account the severity of the conduct and the size of the business.

Two lower tiers also touch this file. Section 83 sets an administrative fine of up to 3 million baht for failing to comply with Section 22 on necessity or Section 37 on security measures. Section 82 sets up to 1 million baht for failing to give the Section 23 notice or to tell people the effect of withdrawing consent under Section 19, paragraph six.

Criminal penalties, and directors' liability

Section 79 applies to the use or disclosure of Section 26 data in breach of Section 27. Its second paragraph raises the penalty to imprisonment of up to one year, a fine of up to 1 million baht, or both, where the act is done to gain an unlawful benefit. The offences are compoundable.

Suppose HR sends claim histories naming employees' illnesses to an outside party with no consent and no exemption to support it, in a way likely to cause those employees damage or humiliation. Facts of that kind are what Section 79 addresses. Whether an offence has been committed is for a court to decide on the evidence in each case.

Section 81 makes this personal. A director, manager or person responsible for the juristic person's operations is punished too where the offence results from their instruction or act, and also where they had a duty to instruct or act and failed to. Letting HR send health data out when nobody has ever checked the lawful basis is therefore a risk for management as well.

Civil liability

An injured data subject does not have to prove intent or negligence, and the court may add punitive damages of up to twice the actual compensation. Under Section 78, paragraph two, the claim is barred three years after the injured person learns of the damage and of who is liable, or ten years after the wrongful act. The people who can sue include the employee's spouse and parents whose data sits in the company's file.

A five-question test: would your benefits file pass?

Ask the head of HR to answer these five questions without opening a file. Two or more answers of "not sure" mean the seven-day plan below should start now.

1. For each medical benefit for staff and families: is it written in an agreement on conditions of employment, in the work rules, or only in a management announcement?
2. If HR stopped asking for the name of the illness on the medical certificate, could it still approve the claim?
3. Does every employee and dependant named in the group policy have a consent form for sending data to the insurer, and where are the forms kept?
4. What exactly did the company certify in the last certificate it signed for the insurer, and who signed it?
5. How many people can open employees' and family members' medical certificates today, and does each of them need to?

A seven-day plan to put the benefits file on the right basis

The plan follows the four PDPC answers. HR and the DPO can carry it out without buying a new system. Days 1 to 4 deal with the lawful basis. Days 5 to 7 deal with notice, security and records.

1. Day 1
   Gather every document that grants a benefit: the agreement on conditions of employment, the work rules, benefit announcements and the group policy. Sort the benefits into two groups: those in the agreement or granted by labour law, and those that are not.Section 26 (5) (c)
2. Day 2
   Go through the claim form and the list of attachments field by field. Ask whether the claim could still be assessed without each item, and remove what is not needed, for example the name of the illness where the benefit is paid on the receipt total.Section 22
3. Day 3
   For benefits outside the agreement, prepare an explicit consent request, separate from other documents. State the purpose, say that the benefit cannot be claimed without consent or after withdrawal, and explain why consent is a condition.Section 19, paragraphs three, four and six; Section 23 (2)
4. Day 4
   Open the list of insured members and dependants and match it to the consent forms held, name by name. Collect the missing ones. Read the certificate already signed; if a duty in it cannot be met, negotiate the wording with the insurer or broker.Sections 19 and 20; Section 26, paragraph one
5. Day 5
   Add a notice for family members to the claim form, and update the staff privacy notice to cover benefits, recipients such as the insurer, and retention. For minor children, check the Section 20 route wherever consent is needed.Sections 23 and 25
6. Day 6
   Lock the cabinets. Restrict the benefits folder and the benefits menu in the HR system to the people who approve claims. Line managers should see the approval result, not the medical certificate. Cover organisational, technical and physical measures, as the PDPC stressed to Bank X.Section 37 (1)
7. Day 7
   Enter the benefits activities in the record of processing: lawful basis per activity, recipients and retention. Record uses and disclosures that rely on an exemption, and write down why the company considers the data necessary for assessing entitlements.Section 39; Section 27, paragraph three

On retention: Company W told the PDPC it keeps claim papers for 10 years from the payment date, citing the period within which the Revenue Department may assess tax, and then destroys them. The PDPC gave no view on that period, so each company has to set its own and be able to justify it. For how to separate what may be kept from what must go, see Former Employees' Records: What You May Keep and When You Must Erase.

What the four opinions leave unanswered

An opinion answers what was asked. Four questions HR often meets are not covered by any of the four, so this article does not answer them on the PDPC's behalf.

• How long to keep claim papers. Company W uses 10 years, and the PDPC did not say whether that is appropriate.
• Benefits that exist only in a management announcement. Whether they count as an agreement on conditions of employment is a labour-law question the opinions do not settle.
• How a private employer should notify family members. The Bank X opinion stresses the Section 23 duty without prescribing a method.
• Claims administrators, contracted hospitals and insurance brokers. Whether each is a controller or a processor depends on the contract and the work, case by case.

HR holds many more datasets than the benefits file, from the job application to the exit interview. Continue with Employee data from hire to exit, and for other PDPC answers to common business questions see The PDPC Has Answered: 8 Real PDPA Questions.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)