THAI PDPA FILES

The case · eight chapters

From one call to the evidence

Chapter 0124 JUN 2025

The Call

A collection contact about Product A, during which information connected with Product B was referenced.

On 24 June 2025, a service provider acting for the institution contacted the customer about one financial product (Product A).

Case materials record that information relating to another financial product (Product B) was referenced during the same interaction, in statements broadly equivalent to “I can see all the information”, “the information comes as a set” and “the customer's loans are handled together”.

These statements are not presented as independently proven facts. They are described as statements recorded in case materials or complainant-prepared transcripts.

Complainant-prepared transcript

Evidence references

Chapter 02

The Question

Why could information about a different product be seen during this conversation?

Why could they see it?

  1. 01Product A
  2. 02Collection activity
  3. 03Service provider
  4. 04Customer data
?

Product B

Product B was not the subject of the contact, yet case materials record that connected information was referenced.

01

Could they technically access Product B?

Open question
02

Was that access necessary?

Open question
03

Was Product B information actually used?

Open question
04

What lawful purpose justified that processing?

Open question
Chapter 03

The Complaint Journey

From the institution to the financial regulator, the consumer protection authority, the data protection authority and court process.

The Complainant

Complainant position
What was submitted
Questions about why Product B information was referenced during a Product A collection contact, followed by direct data subject requests.
What the organisation did
Prepared a written record of the interaction and requested the underlying records.
What response was received
Acknowledgements were received at each stage of the process.
What remained unresolved
Whether the original recording and the system logs can still be examined.
Supporting evidence
Response 0118 JUL 2025Institution position

What the institution said

  • Debt collection was delegated to an appointed service provider.
  • Access to customer information was necessary for the assigned task.
  • Access controls are applied to staff and service providers.
  • Activity follows the applicable debt collection framework.

What the complainant questioned

  • Whether necessity for Product A extends to visibility of Product B.
  • What the access controls actually permitted in this interaction.

What remained unresolved

  • The recorded scope of authorisation for the specific contact.
Chapter 05

The DPO Question

When does a data rights request become a complaint?

When does a data rights request become a complaint?

Request to the DPO — reconstruction

TO: dpo@redacted

DATE: 15 SEP 2025

SUBJECT: Data subject request

  • 01ROPA extracts
  • 02Processor arrangements
  • 03Legal basis relied upon
  • 04Consent evidence where applicable
  • 05Access controls
  • 06Processing scope

What happened next

The reply routed the matter into complaint handling rather than answering the requested items individually.

Complainant position

Educational question

What is the operational role of a DPO when a data subject directly challenges the lawfulness or scope of processing?

Read: Role of the DPO
Chapter 06

Does the original recording exist?

This matrix never infers an answer. Unknown items are labelled not publicly resolved or not confirmed in the public record.

RecordRequestedExistence confirmedProvidedRedacted versionDisputedStatus
Original recording●?—?●Not publicly resolved
Call log●?—??Not confirmed in the public record
Call reference ID●?—??Not confirmed in the public record
Metadata●?—??Not confirmed in the public record
Access log●?—?●Not publicly resolved
Audit log●?—?●Not publicly resolved
Retention record●?—??Not confirmed in the public record
Transcript●●●●●Provided — accuracy disputed, source not verified
ROPA●?—??Not confirmed in the public record
Processor documentation●◐—??Referred to in correspondence; copies not in the public archive

● Yes   — No / not provided   ? Unknown — never inferred   ◐ Partial

Chapter 07

The Transcript Question

A transcript was provided. But what about the source recording?

A transcript was provided.

But what about the source recording?

Position relayed

During a follow-up communication, the institution's position was relayed as being that the original audio could not be provided because it also contained personal information relating to another individual.

Institution position

Complainant's response

Could the other individual's information be masked, muted or redacted so the underlying recording could still be verified?

Complainant position

Status

The original recording was requested and was not provided to the complainant in the materials currently included in the public archive.

Not publicly resolved

How do you verify a transcript without access to the source?

Read: Original evidence vs transcript
Chapter 0822 APR 2026

The April Development

The matter was taken back for investigation, and the technical question returned.

22 APR 2026Complainant-prepared transcriptComplainant-prepared record / follow-up document

Matter taken back for investigation

Case materials record that the service provider stated the institution had taken the matter back for investigation and to locate the recording, and that the service provider would no longer continue the negotiation.

Complainant-prepared record / follow-up document. No independent verification is implied.

27 APR 2026DisputedComplainant-prepared record / follow-up document

The technical question returned

A further statement recorded in the follow-up was that certain credit-card information remaining in the system could be visible even when the collection contact related to another lending product.

What the collector could actually see remains an open technical question, not a determination.

The technical question returned.

What could the collector actually see?