One Post Saying an Employee Had "Left", and Thailand's Regulator Ordered It Deleted Immediately. Even the Blurred Face Didn't Help

Introduction: the post that comes after the last working day

One post, under two minutes to make, ending in a regulator’s order to delete it immediately and report back within 7 days. This is not hypothetical. It has happened twice this year, to two beauty businesses.

A salesperson hands in a resignation, completes the handover and leaves on good terms. No dispute, no case. A few days later a friend sends a screenshot: the former employer’s page shows their photo, full name, nickname and the words “no longer an employee”.

Under the post, people ask what happened. Some guess fraud. Some guess dismissal. In reality, the person simply resigned.

The business has its reasons. Customers of beauty clinics, insurance agents and property firms often deal with a salesperson over personal LINE chats. If that person leaves and still collects deposits in the company’s name, who is responsible? Brand impersonation is no small problem: even in the US, the FTC is consulting on rules to make platforms liable for impersonation ads (in Thai). Warning customers looks prudent.

If you run a business, have you ever posted a notice like this, or is one still pinned to your page right now?

In 2026 the Expert Committee of Thailand’s Personal Data Protection Committee (PDPC) answered this question twice, less than a month apart, with the same outcome and almost the same wording. This is the first article in our series “PDPC Rulings, Decoded”. We separate the facts and rulings in the documents from the author’s own opinion, and finish with practical steps you can use tomorrow.

Is posting an employee departure notice a PDPA breach?

Yes, if the employee resigned voluntarily, committed no crime, and the company disclosed their name and face without consent. That is the line drawn by Expert Committee No. 2 in Orders 17/2569 and 30/2569.

The reasoning has three layers.

1. Name, surname, nickname and face are personal data under Section 6. Even a blurred face remains personal data if, read together with the names in the same image, it still lets people tell who the person is “indirectly”.
2. The company cannot rely on legitimate interest under Section 24(5), because publishing the name and photo of someone who resigned voluntarily goes beyond what is necessary to run the business, and the company’s interest weighs less than the person’s fundamental rights over their data.
3. With no lawful basis and no consent, the use and disclosure breaches Section 27 paragraph one.

The only exception written into both orders is where the employee has committed a criminal offence. As we explain below, that exception is narrower than many people assume.

The facts of the two orders, side by side

This section summarises the orders directly. We do not name the companies or individuals: the purpose of this series is to teach principles, not to point fingers.

Author’s note: the title on the copy of Order 30/2569 we received reads “notification of consent to copy health data”, which does not match its content about an employee departure notice. We therefore cite it by number and date and summarise its content. In Order 17/2569 the sentence about the defamation suit is ambiguous about which party filed it, so we do not say.

The most telling difference is in the last row. In the first case the company had already deleted the post and received only a warning. In the second the post was still up, so the company was ordered to delete it immediately and report back within seven days. Fixing it yourself before you are told to affects how heavy the measures are. That is lesson one.

Why do these two cases matter more than a one-off?

Expert Committee orders are not court judgments and do not bind other cases directly. But read together, three things show this is not a coincidence.

One: the wording is repeated almost paragraph for paragraph. “Beyond what is necessary for the benefit of business administration”, “less important than the fundamental rights in personal data”, and the exception “unless the employee has committed a criminal offence”. In the author’s view, this signals that the Committee has a settled approach to this type of case.

Two: different channels, same result. One notice was on a LINE OA sent directly to customers; the other was on public Facebook. A “narrower” channel did not save the company. What matters is what data was disclosed and how necessary it was.

Three: the later case closes the “blurring makes it fine” loophole, a belief that is very common among page admins.

If your business relies on salespeople who deal with customers one to one, such as beauty clinics, life insurance, property, car dealers, direct sales, travel or lending, treat these two orders as a risk map addressed to you, especially clinics that already hold customers’ health data.

Why is a blurred face still a breach? Indirect identification

Many admins believe that blurring a face, covering it with a sticker or adding a black bar across the eyes means no personal data is disclosed. Order 30/2569 answers this directly.

Although the face photo was blurred and unclear, considering the overall composition of the notice, which also showed the first name, surname and nickname, the photo is information that identifies the complainant indirectly.

Think of it as a jigsaw. Each piece may not identify anyone alone, but put together in one image, the page’s audience, mostly customers who dealt with that salesperson, will know at once who it is.

The lesson: blurring is a technique, not a lawful basis. If the image still carries a name or other details that reveal who the person is, blurring adds little. This applies well beyond departure notices: CCTV stills with blurred faces but a branch and timestamp, or customer review screenshots with the eyes covered but the chat name visible. The PDPC has answered several questions about posting other people’s photos, collected by AIPDPA in 8 answers the PDPC gave police on posting about others (in Thai).

Why does “no longer an employee” weigh so much?

Both cases share a phrase that is easy to overlook: in Thai, “พ้นสภาพการเป็นพนักงาน”, roughly “ceased to be an employee”.

To most readers it does not sound as neutral as “resigned” or “contract ended”. Many will read it as dismissal, wrongdoing or a falling-out. In Order 30/2569 the complainant made exactly this point: the post “may cause viewers to believe the complainant committed an offence”.

And social media never reads only the post. People read the comments, share it and screenshot it. Even if the company deletes it the next day, a screenshot can live in customers’ LINE groups for years and may reach that person’s next employer. Getting platforms to take it down afterwards is not simple either, as shown when the Bombay High Court said platforms are not the judges of defamation (in Thai).

In the author’s view, this is the substantive reason the Section 24(5) balancing test went against the companies. The likely harm to the former employee is high, while the company’s interest can be met in ways that identify nobody at all.

Why could the companies not rely on legitimate interest under Section 24(5)?

Legitimate interest is the basis businesses reach for most often when they would rather not ask for consent. To use it, you have to pass three questions, the framework commonly used for a Legitimate Interest Assessment (LIA). AIPDPA sets them out in three questions you must answer to rely on legitimate interest (in Thai). Here are the two cases against each one.

The Committee did not say the company’s reason carried no weight. It said the disclosure was “beyond what is necessary”. That phrase is the heart of this article: if you can reach the same purpose with less data, the law expects you to take that route. And whenever you rely on this basis elsewhere in the business, keep a written LIA (in Thai) on file.

Why not just ask for consent? In practice, consent obtained from an employee on their way out, or written into the employment contract in advance, is often questioned on whether it was freely given, because employees are rarely in a position to refuse, and they can withdraw it later. The author would not rest the risk on consent. Change how you announce instead. This is different from using models or presenters in marketing, where a separate photo licence agreement (in Thai) should be signed from the start, not buried in the employment contract.

How far does the “unless a criminal offence” exception go?

Both orders prohibit using or disclosing employee photos in departure notices “unless the employee has committed a criminal offence”. Some may read that as permission to post a photo of anyone who stole from the company.

The author would be very careful, for four reasons.

1. Who decides an offence was committed? If it is only a suspicion, not reported, or still in court, announcing it may become an accusation the company itself is liable for.
2. The exception does not remove the necessity test. Even with a real offence, you still need to justify why a photo is needed, how much data and to whom.
3. Criminal records are sensitive data under Section 26, with stricter conditions than ordinary data, and breaches in this area carry criminal penalties under Section 79.
4. Other laws still apply, especially criminal defamation. In Order 17/2569 a defamation suit over a notice of this kind is already on record.

If there really is fraud, the safer path is to report it to the police, inform affected customers individually through official channels, and talk to a lawyer before saying anything in public.

What is the exposure if the post stays up? Four layers

In these two cases the Committee issued warnings and corrective orders rather than fines. That does not mean the next case will end the same way, especially now that the line has been drawn twice.

There is also a cost that does not appear in the table. People thinking of applying to work for you read your page too. If they see a company publishing the names and photos of people who leave, they will assume it could be them one day. In a tight labour market, that employer image costs more than a fine.

How do you protect customers from impersonation without posting anyone’s photo?

This is the most important section. The impersonation risk is real, so we are not saying “do nothing”. We are saying move from announcing who left to announcing which channels are genuine.

Risk levels by type of notice

Six safer methods

1. Pin a permanent notice of official channels on your page, LINE OA and website: which account name and number you accept payment into, and that staff are never allowed to take payment into personal accounts.
2. Offer a “verify a staff member” channel where customers send the name or number that contacted them and you confirm case by case. No public list of names needed.
3. Tell customers individually. When a salesperson leaves, message the customers they handled: “From today, … will be looking after you.” No reason for the departure required.
4. Use company accounts, not personal ones. Have staff talk to customers through your LINE OA or company chat system. When they leave, the conversations stay with the business and impersonation drops at the source. LINE OA has its own PDPA duties, especially as LINE launches Chat Ads that let customers message without adding a friend (in Thai), so privacy notice must start from the first message.
5. Write the rules into contracts from day one. If salespeople earn commission, state in the sales commission agreement (in Thai) that payments into personal accounts are prohibited; if an outside agency runs your page, the page admin and chat agreement (in Thai) should bar posting staff or customer data without approval.
6. Put it in your employee privacy notice: how the company will tell relevant customers when someone leaves. Staff know in advance, and you have evidence you thought it through.

Ready-to-use wording

Pinned notice (names nobody):

To all customers: we accept payment only into accounts in the company’s name (account name …, bank …, number …). If anyone asks you to transfer to a personal account, or you are unsure whether the person contacting you works for us, please check first via LINE OA @… or by calling …

Individual message to customers:

Dear …, from … onwards, … will be looking after your service. For appointments or payments, please use our official channels at … Thank you for your continued trust.

Neither message says “no longer an employee”, shows a photo or names the person who left, yet both do the anti-impersonation job completely.

A PDPA offboarding checklist: 10 things HR often misses

A departure notice is only one of the places where an employee’s data lingers after they leave. Run this checklist every time someone resigns (for the full picture from hiring onward, see employee data from hiring to exit, in Thai).

• Check Facebook, LINE OA, Instagram and TikTok for posts using the person’s name or photo in ways no longer necessary
• Remove or update the “our team” page on your website within the time set in your policy
• Review ads and marketing materials featuring the employee: does your lawful basis still hold after they leave?
• Change passwords and revoke access to systems, email, drives, CRM and page admin roles; files often leak at exit, as in OpenAI’s claim that a former employee moved 100+ confidential files to Apple (in Thai), so have staff sign an IP and trade secret undertaking (in Thai) when they join
• Reassign their customers and tell those customers individually
• Set an auto-reply on their old email that points to official channels, without stating why they left
• Remove their account from LINE or chat groups used with customers
• Keep employment records for the periods labour and tax law require, and delete what is no longer needed (see how long to keep former staff records, in Thai)
• Record when each step was done and by whom, as evidence if a complaint arrives
• Remind page admins in writing: no departure notices with names or photos without sign-off from legal or your DPO

A checklist only works when the people using it understand why. A page admin who knows why a blurred face still counts will never post a notice like this in the first place. If you want HR, admins and sales staff to build this skill in their spare time, follow Skillno.com, an online learning platform for practical skills in digital law, PDPA and business, built on real cases like this one.

Already posted one? What to do within 24 hours

Order 17/2569 shows that fixing it before you are ordered to really helps. If your page still carries a notice like this:

1. Delete it everywhere: Facebook, LINE OA (including broadcasts already sent, if the system allows recall), pinned Instagram Stories and customer chat groups.
2. Keep evidence of the deletion: screenshots with date and time, and a note of who deleted it.
3. Replace it with an official-channels notice that names nobody, so the original purpose is still served.
4. Do not argue in the comments, and do not post explanations of why anyone left; that discloses even more.
5. If the former employee contacts you, reply politely that it has been removed, and if they exercise a right to erasure or objection, act within the legal time frame.
6. Update internal policy at once: add this to the offboarding checklist and brief the admin team in writing.

The employee’s side: what can someone who was posted about do?

This article is written mainly for business owners, but knowing the other side’s options sharpens your risk assessment. If you are the person in the post, the general legal options are:

• Keep evidence: screenshots, the link, the date and any comments showing harm.
• Ask the company to delete it, using your PDPA rights to object or request erasure, in writing. Companies receiving such a request should follow the 30-day framework for data subject requests (in Thai).
• Complain to the PDPC, the route both complainants in these orders took, which led to deletion orders and warnings.
• Consult a lawyer about damages under Section 77 or other proceedings.

For business owners, that list is a picture of what may follow a single post, and every step starts with one screenshot.

Let Kooru check before a screenshot reaches the PDPC

Neither case happened because an owner set out to hurt anyone. They happened because “standard business practice” had never been checked against PDPA. Many businesses still run practices like this without realising it. We can help at an affordable price, quoted clearly before any work begins.

1. Social channel review

We go through past posts on Facebook, LINE OA and your website, find posts that disclose more staff or customer data than necessary, and rank what to remove or fix first.

2. An SOP for departures

An offboarding procedure that both HR and page admins can actually follow, with sample wording, a staff verification channel and anti-impersonation steps that do not shame anyone.

3. PDPA documents for employees

An employee privacy notice, a Legitimate Interest Assessment (LIA) and a Record of Processing Activities (ROPA) that match what the company really does.

4. Monthly DPO service

For businesses that must appoint a Data Protection Officer under Sections 41 and 42, or that want an expert to ask before posting or deciding.

Contact us

Send your page or website link to LINE: @kooru with a short note on what your business does and how many salespeople deal with customers directly. We will tell you where the risk sits and where to start.

Talk to us on LINE @kooru

Something to think about

The person who resigns today may be your customer, partner, or the one who refers great talent to you tomorrow.

A post that takes two minutes to make can become a screenshot on someone else’s phone for years.

Blurring a face does not make the person disappear. It only makes us feel we were careful.

A better question than “may we announce it?” is “if we never say who left, can customers still be safe?” The answer is almost always yes.

And data that escapes through our posts can end up anywhere: the PDPC once found data on 29,000 Thais on a scammer’s computer (in Thai).

PDPA does not stop businesses protecting customers. It asks them to do it without harming anyone more than necessary.

Frequently asked questions about employee departure notices and PDPA

1. Is posting a departure notice with an employee’s photo a PDPA breach?

Under PDPC Expert Committee Orders 17/2569 and 30/2569, if the employee resigned voluntarily and committed no crime, disclosing their name and face without consent goes beyond what is necessary, cannot rely on Section 24(5), and breaches Section 27 paragraph one.

2. Is it still a breach if the face is blurred or the eyes are covered?

It can be. Order 30/2569 found that a blurred face, read together with the name, surname and nickname in the same notice, still identifies the person indirectly and therefore remains personal data.

3. Can we announce the name only, without a photo?

The risk is lower but not gone. A name identifies a person directly, and you still need to justify why naming them publicly is necessary. It is safer to announce official channels without naming anyone and to inform affected customers individually.

4. Is a LINE OA notice sent only to customers different from a Facebook post?

In Order 17/2569 the notice was on a LINE Official Account and was still found to breach the law, just like the Facebook case. A narrower channel does not make an unnecessary disclosure lawful.

5. If an employee stole from the company, can we post a notice with their photo?

Both orders make an exception for criminal offences, but it does not remove the necessity test. Criminal records are sensitive data under Section 26, and there is defamation risk while the facts are unresolved. Report it to the police and get legal advice before any public announcement.

6. Does a clause in the employment contract consenting to departure notices help?

Not much. Consent in employment is often questioned on whether it is freely given, because employees are rarely in a position to refuse, and they can withdraw it later. Changing the notice so it needs no personal data is safer.

7. If we have already deleted the post, can we still be the subject of a complaint?

Yes. In Order 17/2569 the company said it had deleted the post, yet the Committee still found a breach and issued a warning. Deleting it first did, however, lead to lighter measures than in the case where the post remained.

8. What is the maximum exposure for breaching Section 27 here?

Administratively, the Expert Committee can order corrections, issue warnings, or impose a fine of up to THB 3 million under Section 83. Civilly, the person harmed can claim damages under Section 77, and the court may add punitive damages of up to twice the actual damages under Section 78. Criminal defamation under the Criminal Code may also apply.

9. How can we stop former staff impersonating us to collect money?

Pin your official payment accounts and contact channels, offer a way for customers to verify staff, tell each affected customer who their new contact is, and have staff use the company’s LINE OA instead of personal accounts.

10. Do Expert Committee orders bind other businesses?

An order binds only the parties in that case. But when the same committee rules the same way twice with nearly identical wording, other businesses should treat it as the approach the PDPC will take in similar cases.

References

1. Expert Committee No. 2, Office of the Personal Data Protection Committee. (20 Feb 2026). Order No. 17/2569 on use and disclosure of personal data without the data subject’s consent.
2. Expert Committee No. 2, Office of the Personal Data Protection Committee. (13 Mar 2026). Order No. 30/2569 (the document’s title refers to consent to copy health data; its content concerns an employee departure notice).
3. Personal Data Protection Act B.E. 2562 (2019), Sections 6, 24(5), 26, 27, 72, 74, 77, 78, 79, 83 and 90.
4. Thai Criminal Code, Sections 326 and 328 (defamation).
5. AIPDPA. Articles and guides on employee data, legitimate interest and PDPA penalties. https://aipdpa.com

This article is general information for business decisions, not legal advice for any specific case. Facts and findings are summarised from the Expert Committee orders; passages marked as the author’s view are additional analysis and not part of the orders. Companies and individuals are not named so the focus stays on principles.

By: Khun Phuwara, Senior Advisor in Business Strategy and Legal-Tech at The Kooru

About the author: Phuwara Krobtaku

Licensed lawyer no. 477/2558 · Thai Barrister-at-Law · LL.M. IP & IT Law (gold medal) · DPO

More than 20 years in IT and digital marketing before law. Founder of Kooru, a tech-law advisory handling PDPA, AI governance and intellectual property for SMEs.

Ask the author on LINEFull profile