An Approach for Disclosure of Official Information containing Personal Data

Abstract

Disclosure of official information which also contain personal data in accordance with the Official Information Act B.E. 2540 (1997) can be made without infringing a right to privacy of individuals. This disclosure can also be simultaneously deemed a lawful action under the Personal Data Protection Act B.E. 2562 (2019). However, this harmonization can only be achieved when a disclosing state agency strikes fair balance between transparency in the public sector and a right to privacy of individuals. This balancing activity can be conducted by analyzing and differentiating content of the information in question. Content of the information that appears necessary for public governance examination can be separated from the part that reveals identity of an individual. In addition, a state agency that is also a data controller under the Personal Data Protection Act B.E. 2562 (2019) owes a statutory duty to ensure security of personal data it possesses in accordance with Section 37(1) of the Personal Data Protection Act B.E. 2562 (2019). This implementation can contribute to a state agency’s responsibilities to prevent, handle, and mitigate risks associated with cyber threats.