Same Facebook Post About a Tenant: the Landlord Walked Free Under the PDPA, the Rental Company Breached It. And a Condo Board Chasing 11 Months of Parking Fees in a 290-Member LINE Group Did Nothing Wrong

Introduction: the tenant disappears, and the owner opens Facebook

A company that rents out rooms posted a photo of a defaulting tenant’s national ID card on Facebook to pressure him into paying damages. The Expert Committee found that the company had breached Section 27 of the PDPA.

In another case, a landlord who is a private individual photographed the lease and the state of the house after the tenant moved out, and posted them on Facebook. She hid the tenant’s name but not his address. That case fell outside the PDPA entirely.

One poster was a company and the other a private person. Both faced the same problem, a tenant who did not keep to the lease. Both made the same choice: they opened Facebook and posted. The outcomes were opposite.

There is a third story. In a condominium, a member of the building’s juristic person committee wrote a message chasing parking fees that were 11 months overdue, in a LINE group with 290 co-owners. The owner who owed the money felt humiliated and complained. That message was not unlawful either.

If you rent out property, run a dormitory, sit on a condo committee, or have ever been tempted to chase a debt in public, can you say what separates these three cases?

This is episode 4 of the “PDPA Case Files” series. This time we take 3 real complaints that all started with unpaid money, tell them in plain language, and end with a checklist to run before anyone hits “post”. If you missed the earlier episodes, episode 1 is the company that posted that an employee had been “removed”, episode 2 is 5 real CCTV camera-angle cases and episode 3 is 5 real HR cases.

What personal data sits inside a debt post?

Almost every debt post contains something that identifies the debtor, even after the name is hidden. Under Section 6, personal data is any information that identifies a person directly or indirectly. An address, a unit number, a profile picture, or an overdue amount that everyone in the building can attach to a name can all do the work of a name.

Here is how the things people usually put in a debt post compare.

For the wider picture of how posting about other people is treated, AIPDPA summarises the answers the PDPC gave to the police in Is posting photos of other people a PDPA breach? 8 answers to the police.

Before you read on: the stories in this article are summarised from published complaint decisions of Expert Committee Panel 2 of the Office of the Personal Data Protection Committee (PDPC). We tell only the facts that appear in the decisions, add nothing they do not say, and do not identify any person or organisation. Anything marked as commentary or advice is the author’s own view.

Story 1: a landlord posted the lease and the state of the house on Facebook. Why was the PDPA not engaged?

Because the landlord was a private individual acting for personal purposes, which falls under the Section 4(1) exemption, so the PDPA did not apply at all. That does not make the post safe. The Committee said itself that this was a dispute between the parties, to be resolved under other applicable laws.

The complainant was a man who rented a house from a landlord who is a private individual. He did not stay for the full term of the lease and did not get his deposit back.

The landlord then photographed the lease agreement and the condition of the house after it was handed back, and posted the photos on Facebook. She covered the complainant’s first name and surname, but did not cover his registered home address or the address of the rented house. He felt his reputation had been damaged and complained.

The Committee did not decide who was right about the deposit. It looked first at the threshold question: does this law apply here at all?

• Posting photos of the lease and the rented house on Facebook was a collection, use or disclosure of personal data done for personal benefit.
• It therefore fell under the exemption in Section 4(1) and was not subject to the PDPA.
• The matter was a dispute between the complainant and the landlord, governed by other relevant laws.

The complaint was closed (Decision 5/2567, 24 January 2024).

What exactly is Section 4(1)? The Act states that it does not apply to the collection, use or disclosure of personal data by a person who does so only for personal benefit or for that person’s family activities. Put simply, the PDPA is designed to govern organisations and people who handle data in a business or official capacity. It is not designed to police every part of a private person’s life.

Author’s commentary: do not read this case as “private individuals can post anything”. What dropped away was one statute, the PDPA. A post like this still faces other laws. The most common is criminal defamation under Section 326 of the Thai Criminal Code; when it is done by publication, such as a public post, Section 328 applies, with up to 2 years’ imprisonment and a fine of up to ฿200,000. A civil claim in tort is also possible. And to the question “how can telling the truth be defamation?”: truth is not a defence in every case. Section 330 does not allow proof of truth where the imputation concerns a private matter and proving it would not benefit the public. A dispute over one tenant’s deposit is usually exactly that kind of private matter.

Note also that hiding the name did very little. The registered address and the rental address identified the tenant more clearly than his name would have. Neighbours, people on the same street and relatives who know the address recognise him at once. This mirrors episode 3, where a company blurred a former employee’s face and colleagues still knew who it was.

A landlord who wants to avoid deposit disputes in the first place does better by spelling out in the lease when the deposit can be deducted, by how much, and how many days it takes to return it. OK Contracts has a model house lease (detached house or townhouse) that lists every clause it should contain (in Thai).

Story 2: a rental company posted a tenant’s ID card to chase damages. Why was that a breach?

Because the company is a data controller. It obtained the data to perform the lease, then used it to chase a debt on Facebook without consent, which breached Section 27, paragraph one. The personal-purposes exemption that helped the landlord in Story 1 is not available to a company. This is the case from the introduction.

The complainant was a man who rented a room to live in from a company. He later breached the lease and could not be contacted. The company then disclosed his data through a Facebook account, namely:

• a photo of his national ID card, showing his first name, surname, address and date of birth
• his Facebook profile picture

The aim was to make him pay damages for breaching the lease. He asked the company to take the post down, but the company ignored him. He felt disgraced and humiliated, and complained, asking for the data to be erased or destroyed and for the company to take responsibility for the harm.

The Committee reasoned step by step.

1. The company is a data controller under Section 6. It is a juristic person that rents out rooms and has the power to decide how personal data is collected, used or disclosed.
2. Its basis for collecting the data was sound. Collecting data when the lease was signed, to make the contract and to contact the tenant about the tenancy, was necessary to perform a contract to which the tenant was a party, under Section 24(3).
3. But it used the data for the wrong purpose. Posting it to chase damages did not match the purpose of the contract, and it was disclosed without consent, so the company breached Section 27, paragraph one.
4. The case closed because the company had fixed it. The company complied with the complainant’s request and stopped publishing his data on that Facebook account, so there was nothing further to decide.

The Committee closed the complaint under Section 74 together with clause 13(6) of the PDPC Regulation on the Filing, Rejection, Termination, Consideration and Time Frame for Complaints B.E. 2565 (2022) (Decision 8/2568, 24 January 2025).

The line to remember: “obtained lawfully” does not mean “usable for anything”. The company collected the ID copy properly when the lease was signed. But the Section 24(3) basis covers only what is necessary to perform the contract. Putting the card on Facebook was not necessary to perform a lease; it was a way of using the data to apply pressure, a new purpose that nobody had consented to.

Author’s commentary: this case ended quickly because the company eventually took the post down. Look at the timeline, though. The tenant asked for removal and was ignored until the matter reached the regulator. Had the company removed the post on the day it was asked, there might be no decision for us to write about. Had it refused to remove it, the risk would not have stopped at a closed file. Using or disclosing data in breach of Section 27 carries an administrative fine of up to ฿3,000,000 under Section 83, and the data subject can still claim civil compensation under Section 77.

Landlords also forget that a copy of an ID card is easy to misuse once it leaks: it holds a name, address, date of birth and the national ID number. Some card versions also show religion, and religious belief is sensitive data under Section 26. Abroad there was a clear warning recently when Denmark’s population register leaked 8.8 million records and officials said the personal ID number can no longer be used to verify identity; TechLawNow sets out what Thai businesses that still ask for ID numbers should change (in Thai).

Story 1 and Story 2 side by side

If your company rents out rooms or condominium units, a well-drafted lease saves you from ever reaching the “post” stage. See the model condominium unit lease (in Thai), and if you are unsure which lawful basis covers tenant data, read the guide to choosing a lawful basis under Section 24.

Story 3: a condo board chased 11 months of parking fees in a 290-member LINE group. Why was it lawful?

Because the message named no one, gave no address or unit number, and nobody in the group replied, so it could not identify the complainant and was not personal data. A second reason was that the juristic person had not created the LINE group, so it was not the controller of that group.

The complainant owned a unit in a condominium. He was a member of a LINE group set up by one of the unit owners (it could not be established which one) for members to communicate. The group had 290 members, and members of the building’s juristic person committee were in it.

One day a committee member posted a message in the group that amounted to chasing parking fees overdue for 11 months. The complainant felt humiliated and complained about the juristic person.

The Committee looked at 2 layers.

The conclusion was that the juristic person’s conduct was not unlawful. But the Committee did not simply wave it through. It added a recommendation that the juristic person should be strict and careful about using or disclosing co-owners’ personal data beyond the purpose for which it was collected and without their consent, as that could breach the PDPA. It then closed the complaint (Decision 13/2567, 30 April 2024).

Author’s commentary: this was a narrow escape, and it turned on 2 small details: no unit number, and nobody replied. Change one thing. If the message had said “Unit 12xx owes 11 months of parking fees”, or a resident had replied “the white car that parks by the lift?”, the message would start to identify someone. And the juristic person, which holds the owner list and the arrears ledger as a data controller, would then face the same question as the company in Story 2: did it use data beyond its purpose?

That is why the recommendation at the end of the decision matters more than the closure. The safer route is to send arrears notices to the owner directly, not to the whole group. On group chats that turn into public shaming, TechLawNow’s Is exposing people in a LINE OpenChat illegal? Admins, sharers and members explains who is liable and how far (in Thai). If your juristic person is also handling other resident data, such as cameras or face scans, AIPDPA has CCTV in offices, shops and condos: what the PDPA requires and Face-scan entry to a condo: is a general meeting resolution enough?

Why does a private person escape the PDPA for the same post when a company does not?

Because the Section 4(1) exemption is written for a person acting only for personal or family purposes, and a juristic person has no private life to rely on. Everything a company does with customer data is done in the name of the business, so it stands as a data controller at all times and needs a lawful basis every time it uses or discloses data.

Run through these 3 questions before deciding whether a post is within the PDPA.

Author’s commentary: if you are an individual landlord, do not treat question 1 as a permanent pass. “Personal benefit” fits someone renting out one house, as in Story 1. If you rent out many units as a living, have staff, run a business page or use tenant-management software, it becomes harder and harder to argue you are acting privately. These three decisions do not answer that point directly, so treat it as a grey area. It is safer to act as though the Act applies.

How do you chase a tenant’s debt without ending up in a complaint?

Deal with the debtor directly, put it in writing, and use legal channels when talking fails. None of these steps needs social media, and each one creates evidence you can use in court, which a Facebook post does not.

If your business hires someone else to collect debts, or lends money in the ordinary course of business, the Debt Collection Act B.E. 2558 (2015) also prohibits disclosing a person’s indebtedness to people who are not involved. Write that prohibition into any debt collection services agreement (in Thai). Whether that Act applies depends on the facts of each business. For the extreme end of debt shaming, see TechLawNow’s latest story on illegal loan apps that shame borrowers using their contact lists (in Thai).

If another creditor asks your company for a debtor’s details, different rules apply; read A creditor asks for a debtor’s data: hand it over or refuse?

What should you check before posting about a debtor? A 10-point checklist

If you cannot answer any one of these, do not post yet. All 10 points trace back to the real complaints above. Landlords, dormitory managers and condo committee members can use them today at no cost beyond 2 minutes of thought before pressing the button, and in practice point 1 on its own removes most of the risk.

1. Always chase the debtor directly first: private chat, phone and a written demand.
2. If you are a company, do not count on the personal-purposes exemption. A juristic person is always a controller (Story 2).
3. Data obtained for a contract is for performing that contract. Do not use it to apply public pressure (Story 2).
4. Never post an ID card, a copy of the lease or the debtor’s face, whatever you cover up.
5. Hiding the name is not enough. Addresses, unit numbers and licence plates identify people too (Story 1).
6. Arrears notices in a group must identify no one, and the details should go to the unit owner directly (Story 3).
7. If someone asks you to take a post down, take it down first and argue about the money later. Ignoring the request is what turned Story 2 into a complaint.
8. Decide who may post on behalf of the company or juristic person, and have every post about a customer reviewed.
9. Keep tenants’ ID copies and leases locked away, and delete them when no longer needed.
10. Train page admins, committee members and building managers, because all three stories began with a person pressing “post”, not with a system.

Point 10 is what makes the other nine stick. If you want your team to build this skill, take a look at the workplace upskilling courses at SkiLLNo. And if your company genuinely needs to post about someone for work, first answer the three questions behind legitimate interest.

If you are the one being shamed online for a debt, what can you do?

Start by preserving evidence, then ask in writing for the post to be removed. If that fails, complain or see a lawyer. Owing money does not take away your rights over your own data, and complaining about your data does not cancel the debt. These 2 issues are separate.

1. Screenshot everything with the date, time and link: the post, the comments and how many people saw or shared it.
2. Check who posted it, a private individual or a company, because the routes differ (Story 1 versus Story 2).
3. Ask in writing for removal. Against a company or juristic person you can use your PDPA rights, such as erasure under Section 33 or objection under Section 32.
4. If the company ignores you, you can file a complaint with the PDPC, giving your name, address and contact details in full.
5. If a private individual posted it for personal reasons, the usable routes are usually other laws, such as defamation or tort. Speak to a lawyer before deciding.
6. Settle the debt on a separate track. If the debt is real, a written instalment agreement gives both sides a reason to stop fighting in public.

If you are the company receiving requests like these, Kooru’s data subject rights form set helps you log the request, verify identity and reply on time. For the full system, read Customers asking to see, erase or stop using their data: how to answer on time.

What are the risks of chasing debts the wrong way? 4 layers business owners should know

The risk comes from the PDPA, criminal law, civil law and the reputation of the business itself. And the amount being chased is often far smaller than the damage one post can do. If a tenant owes one month’s rent but you lose several new tenants because of reviews saying “this place shames its customers”, the post was a loss from day one.

For the full picture of PDPA penalties, see the guide to PDPA penalties.

Let Kooru set up your tenant and resident data before anyone complains

Kooru puts the documents, rules and people in place to look after tenant and resident data, from the day the lease is signed to the day a debt has to be chased. All three stories here share one thread: data that was obtained properly was used on the day tempers ran highest. The Kooru legal team makes sure that day has a procedure behind it, instead of a “post” button.

1. Privacy notices for tenants and residents

Tell people from the day they sign what data you collect, what it is used for and which channel you will use for arrears. Start with the customer privacy notice, which can be adapted in a day.

2. A debt-chasing procedure that never touches social media

We draft guidance for page admins, building managers and committee members on how to chase arrears, through which channels, and what must never be posted.

3. A system for erasure requests and complaints

Use the data subject rights form set so that a request to take down a post is never ignored, as it was in Story 2.

4. Monthly DPO service

If you run a dormitory, an apartment building or a condominium juristic person and want someone to handle these matters continuously, see Kooru’s DPO as a Service.

Contact us

Message us on LINE at @kooru and tell us briefly how many units you rent out or what kind of building you manage. The Kooru legal team replies during business hours, and the first consultation is free.

Thoughts to leave you with

Unpaid money is a matter between two people. A post makes it a matter for all of Facebook.

Hiding the name does not mean nobody knows who it is.

A tenant’s ID copy is a sign of trust, not a weapon.

The LINE message survived because it had no unit number, not because any kind of chasing is allowed.

And the question to ask before posting is not “are they really in the wrong?” but “if this goes to court, will this post help us or hurt us?”

Frequently asked questions (FAQ) about debt collection and the PDPA

1. Is posting about someone’s debt on Facebook a breach of the Thai PDPA?

It depends on who posts and what is posted. A private individual posting for personal reasons usually falls under the Section 4(1) exemption, so the PDPA does not apply, though other laws such as defamation still might. A company posting customer data to chase a debt is likely to breach Section 27, as in Decision 8/2568.

2. Does a private landlord have to comply with the PDPA?

If they collect and use tenant data purely for personal purposes, such as renting out a single house, they may fall under the Section 4(1) exemption, as in Decision 5/2567. As the activity becomes more business-like, with many units, staff or a business page, the exemption becomes harder to claim, so it is safer to comply.

3. Can a company post the ID card of a tenant who breached the lease?

No. In Decision 8/2568 the company had collected the tenant’s data to perform the lease under Section 24(3), but posted his ID card and profile picture to chase damages. That went beyond the purpose without consent, and the Committee found a breach of Section 27, paragraph one.

4. Is it still a problem if I hide the tenant’s name in the post?

It can be. If the post still shows an address, a unit number or details that let people tell who it is, the person is identified indirectly. In Decision 5/2567 the landlord hid the name but left the registered address and the rental address visible.

5. Can a condo juristic person chase common fees or parking fees in a LINE group?

In Decision 13/2567 a message chasing 11 months of parking fees in a 290-member group was lawful because it had no name, address or unit number and identified no one, and the juristic person had not created the group. The Committee still advised care about using co-owners’ data beyond its purpose. The safe route is to notify the unit owner directly.

6. What if the debt post includes the unit number?

The decisions discussed here do not answer this directly. In the author’s view the risk is high, because inside one building a unit number indirectly identifies its owner. Once it is personal data, the juristic person as controller needs a lawful basis to disclose it to every resident in the group, which is hard to find.

7. What is the Section 4(1) exemption?

Section 4(1) states that the PDPA does not apply to the collection, use or disclosure of personal data by a person who does so only for personal benefit or for family activities. It covers private individuals, not companies or juristic persons acting in the name of a business.

8. Someone is shaming me online over a debt. What should I do?

Preserve evidence with dates and times and ask in writing for removal. If the poster is a company and ignores you, you can complain to the PDPC, giving your name and contact details in full. If the poster is a private individual, the usable routes are usually other laws such as defamation or tort; consult a lawyer.

9. How can stating a true debt be defamation?

Truth is not a defence in every case. Section 330 of the Thai Criminal Code does not allow proof of truth where the imputation concerns a private matter and proving it would not benefit the public. A debt between one landlord and one tenant is usually a private matter, so demand letters and the courts are the better route.

10. If the company takes the post down, is the matter over?

In Decision 8/2568, once the company stopped publishing the data, the Committee closed the complaint because nothing further needed deciding. But removal does not undo the fact that Section 27 was breached, and a data subject who suffered harm can still claim civil compensation under Section 77.

References

1. Expert Committee Panel 2, Office of the Personal Data Protection Committee. (24 Jan 2024). Decision 5/2567 (landlord posted the lease and the rented house on Facebook; Section 4(1))
2. Expert Committee Panel 2. (24 Jan 2025). Decision 8/2568 (rental company posted a tenant’s ID card to chase damages; Sections 6, 24(3), 27)
3. Expert Committee Panel 2. (30 Apr 2024). Decision 13/2567 (parking fee arrears chased in a co-owners’ LINE group; Section 6)
4. Personal Data Protection Act B.E. 2562 (2019), Sections 4(1), 6, 24(3), 26, 27, 32, 33, 74, 77, 78, 83 and 90
5. PDPC Regulation on the Filing, Rejection, Termination, Consideration and Time Frame for Complaints B.E. 2565 (2022)
6. Thai Criminal Code, Sections 326, 328 and 330
7. Debt Collection Act B.E. 2558 (2015)
8. AIPDPA. Articles and guides on posting about others and lawful bases, available at https://aipdpa.com

This article is general information to support business decisions and is not legal advice for any specific case. The stories are summarised from publicly released complaint decisions. Anything marked as the author’s commentary is additional analysis and not part of the decisions. We do not name the people or organisations involved so that the focus stays on the principles.

By: Khun Phuwara – Senior Advisor in Business Strategy and Legal-Tech, The Kooru

About the author: Phuwara Krobtaku

Licensed lawyer no. 477/2558 · Thai Barrister-at-Law · LL.M. IP & IT Law (gold medal) · DPO

More than 20 years in IT and digital marketing before law. Founder of Kooru, a tech-law advisory handling PDPA, AI governance and intellectual property for SMEs.

Ask the author on LINEFull profile