Thailand · PDPA · Personal data · Consumer rights · 2025–ongoing
It started with one phone call.
A debt-collection call concerned one financial product.
During the conversation, information connected with another financial product was referenced.
That led to a simple question:
Why could they see it?
What followed became a documented Thai PDPA case study involving data access, legal basis, complaint handling, evidence requests, regulators and court processes.
“The information comes as a set.”
Recorded in case materialsEvidentiary status: disputed / source-dependent
Why it matters
Why this case matters
This is not only a dispute about one phone call.
It raises practical questions about how personal data is accessed, used, explained, documented and challenged in real life.
Access
If an employee or processor is assigned to Product A, what information about Product B should they be able to access?
Purpose
Does lawful possession of information automatically permit its use in every interaction?
Necessity
How much personal information is actually necessary for the stated task?
Evidence
If the accuracy of a transcript is disputed, what evidence can verify it?
Accountability
When a complaint passes between a controller, processor, regulator and another authority, who owns the resolution process?
Case at a glance
- Starting event
24 June 2025
- Core question
Why was information connected with another financial product referenced during a collection interaction?
- Case themes
Data access
Purpose limitation
Data minimisation
Controller / processor
Data subject rights
Evidence integrity
Complaint handling
- Public process
Financial institution
Financial regulator
Consumer protection authority
Data protection authority
Court process
- Current status
Ongoing / subject to updates
The original question
Why could they see it?
- Product A — personal / express loan
- Collection activity
- Service provider
- Customer data
Product B — credit card / other financial product
?
Could Product B technically be seen?
If yes, by whom?
Was seeing it necessary?
Was it actually used?
For what purpose?
On what legal basis?
The documented journey
From one question to a multi-agency process
The Complainant
- Matter submitted
- Questions about why Product B information was referenced during a Product A collection contact, followed by direct data subject requests.
- Matter reviewed
- Prepared a written record of the interaction and requested the underlying records.
- Response recorded
- Acknowledgements were received at each stage of the process.
- Still unresolved
- Whether the original recording and the system logs can still be examined.
The archive
The paper trail
This case is documented through correspondence, official responses, complaint records, transcripts and procedural documents.
Referral letter to the data protection authority
Institution response 02
Preservation notice
Complainant position
One question became a complaint.
The complaint became a data rights dispute.
The dispute became a search for the original evidence.
Case chapters
The Call
A collection contact about Product A, during which information connected with Product B was referenced.
The Question
Why could information about a different product be seen during this conversation?
The Complaint Journey
From the institution to the financial regulator, the consumer protection authority, the data protection authority and court process.
The Explanations
A version history of the institutional explanations, side by side with what the complainant questioned.
The DPO Question
When does a data rights request become a complaint?
Show Me The Evidence
What was requested, what exists, what was provided — and what is not publicly resolved.
The Transcript Question
A transcript was provided. But what about the source recording?
The April Development
The matter was taken back for investigation, and the technical question returned.
Source classification
Confirmed procedural factComplainant-prepared transcriptDisputedOpen question
Every statement on this site carries a classification. A claim is never automatically converted into a fact, and no party is described as legally at fault unless an authoritative final determination establishes it.
- Last updated
- Source record last reviewed
- Case status