PROTECT THE PUBLIC [Vol. 34: 128 

 

128 

PROTECTING THE PUBLIC AND OUR PHYSICIANS’ 

INTERESTS: A PROPOSAL TO RECTIFY INCONSISTENCIES 

AND DEVELOP GUIDELINES ON PHYSICIANS’ 

DISCLOSURE OF PATIENTS’ HEALTH DATA TO THIRD 

PARTIES IN THAILAND 
 

Khajorndej Direksoonthorn 

Court of Appeal, Thailand 

khajorndej.d@coj.go.th 

 

 This article argues for law reform in Thailand 

concerning the protection of health data, particularly laws 

involving the data’s disclosure to third parties. It has been found 

that several pieces of Thai legislation governing this area are 

conflicting, causing confusion and disquiet to Thai physicians. 

Recently, Parliament has enacted the Personal Data Protection 

Act 2019. The said GDPR-style Act should have clarified all 

already-existing confusion regarding the inconsistency of 

legislation, but it has further complicated the matter instead. 

Doctors cannot disclose patients’ health data to third parties, 

even to protect others or public interests. Court cases from other 

jurisdictions show that courts are willing to impose on 

physicians the duty to disclose patients’ health data to third 

parties under certain circumstances, which makes the issue 

more significant to the Thai legal and medical communities. The 

article provides proposals to rectify the issue by amending 

relevant statutes and calling for professional guidance on this 

area which should be addressed by pertinent legislation. The 

relevant professional guidelines alongside the amended 

legislation will serve the interests of medical professionals, 

patients, and society at large.  

 

Keywords: health data governance in Thailand, disclosure 

of patients’ health data to third parties, physician’s duty of 

health data disclosure  

 
 Judge in the Research Justice Division, Court of Appeal, Thailand. M.D. 

(First Class Honors, Chulalongkorn University, Thailand), LL.M. (Rector’s 

Award for Academic Excellence, Assumption University, Thailand), LL.M. 

(Harvard Law School, the United States). The author would like to thank 

Associate Professor Mark Taylor, Melbourne Law School, for encouraging 

him to publish this article, and the editors of the Columbia Journal of Asian 

Law for their editorial assistance. The views expressed in this article are those 

of the author and should not be attributed to any other member of the Thai 

judiciary. 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

129 

Health data governance in Thailand is still in its infancy. 

Many laws govern this area of data protection, including the 

National Health Act, B.E. 2550 (2007), which is the primary law 

tasked with promoting the health and well-being of the Thai 

people, and the Official Information Act, B.E. 2540 (1997), 

which covers the collecting, processing, and disclosing of 

personal information held by public authorities. However, the 

National Health Act seemingly contradicts other laws 

concerning health information protection in several contexts. 

These conflicts are compounded by the fact that Thai laws 

addressing the provision or disclosure of patients’ information to 

third parties are not settled. Doctors and other health 

professionals cannot be certain that they are not running afoul of 

the law when disclosing their patients’ information to others. 

Under current laws in Thailand, it is unclear whether doctors can 

disclose patients’ genetic information to their genetic relatives. 

Professional guidance remains silent on the matter. This article 

will discuss the problems of health data governance in Thailand 

with particular regard to the physicians who practice medicine 

in Thailand. 

The Ministry of Public Health of Thailand (MOPH) has 

apparently confused the issue. It has promulgated the 

‘Regulation on the Protection and Management of Personal 

Health Data, B.E. 2561 (2018).’ Despite its status as a 

subordinate law, this Regulation contradicts its superior laws, 

the National Health Act and the Official Information Act. This 

Regulation strictly prohibits data disclosure which causes 

damage to the data subject. Accordingly, most doctors in the 

public sector and some in the private sector who share a health 

database with the MOPH cannot disclose patients’ information 

to patients’ genetic relatives or other third parties without 

contravening the Regulation. 

This article will then turn to the comparative aspect of 

the issue to illuminate the problem in Thailand. It will explore 

the laws and court cases in other countries with advanced health 

data protection, namely the United Kingdom, the United States, 

and Australia, focusing on physicians’ disclosure of patients’ 

health data to third parties, including patients’ genetic relatives. 

Courts in these countries are willing to impose on the doctor the 

duty to disclose the patient’s health data to third parties in certain 

circumstances. 

However, at least initially, it appears that doctors can pin 

their hopes on the advent of a new law entitled ‘Personal Data 

Protection Act, B.E. 2562 (2019)’ to clarify their legal 

obligations regarding the confidentiality of their patients’ 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

130 

information. Unfortunately, the Thai Government postponed the 

Act’s enforcement date for some entities, including those 

involved in medicine and public health, until 1 June 2021. The 

new law will not alleviate the problem until then at the earliest. 

Nor will it help elucidate the matter even then. Rather, it will 

probably make the existing problem obscurer and more complex, 

especially with respect to health data that may be disclosed to 

third parties or genetic relatives. This article will explore these 

problems by comparing the Personal Data Protection Act and 

its origin, the EU General Data Protection Regulation (GDPR).  

In order to rectify the situation in Thailand, the author 

proposes amendments to the National Health Act and the 

MOPH’s Regulation, which would eliminate the confusion 

arising from the conflicts they have with other legislation. 

However, the duty to warn third parties, if the Thai courts would 

impose it, should accord with professional guidance developed 

by the relevant professional bodies. A paucity of such 

professional guidance in Thailand has troubled doctors in their 

practice and demanded that they exercise discretion and 

professional judgement at their own risk. Furthermore, 

contradicting internal policies of different institutions make 

health data protection inconsistent throughout the country. Clear 

guidelines would ameliorate inconsistent policies by providing 

criteria for sound judgement about the disclosure to third parties. 

The author also proposes amendments to the Personal 

Data Protection Act, supposedly the main data protection regime 

in Thailand in the near future, so that disclosure to third parties 

in certain circumstances would be allowed, and professional 

guidance would be issued in accordance with the Act. The 

relevant professional guidelines alongside the new personal data 

protection legislation would serve the interests of both medical 

professionals and patients as well as society at large.  

  

I. DOCTOR’S DUTY OF CONFIDENTIALITY IN THAILAND 

 

Doctors in Thailand have long observed the duty of 

confidentiality.1 This duty has the same origin as its Western 

counterparts,2 that is, the Hippocratic oath. The Hippocratic oath 

in relevant part states:  

 
1  Sakda Sathirareuangchai, (การรักษาความลบัของผูป่้วย) [Duty of Confidentiality], 

6(2) (เวชบนัทึกศิริราช.) [SIRIRAJ MED. BULL.] 78, 78 (2013) (Thai.). 
2  See The Ministry of Public Health’s Regulation on the Protection and 

Management of Personal Health Data, B.E. 2561 Article 4 (2018) (Thai.).  

 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

131 

 

What I may see or hear in the course of the 

treatment or even outside of the treatment in 

regard to the life of men, which on no account one 

must spread abroad, I will keep to myself holding 

such things shameful to be spoken about.3 

 

This duty has been believed to forge the doctor-patient 

relationship, which is premised on trust. Patients can trust their 

doctors as long as their revealed information are kept secret.4 

Due to the characteristics of health data, they can immensely 

impact the data’s owners. Data may cause embarrassment to 

their owner or even people related to the owner, such as data on 

infection of transmissible diseases.5 This can obviously be seen 

in the wake of the COVID-19 pandemic. Data may reflect 

intimate relationships between people they would like to keep 

secret. Closely related to the concept of the duty of 

confidentiality is the concept of privacy. The two concepts are 

fundamentally distinct from each other, especially in Western 

societies.6 Regarding the concept of privacy, in the simplest of 

terms, people have reasonable expectations in certain situations. 

For instance, people may not reasonably expect their conversion 

in public places to be recorded, but they may have that 

expectation in their own home arguably. Subsumed under the 

concept of privacy is informational privacy. 7  Information 

privacy involves “the establishment of rules governing the 

collection and handling of personal data such as credit 

information, and medical and government records. It is also 

known as ‘data protection.’”8 

In order to comprehensively understand health data 

governance in Thailand, statutes and regulations that govern 

both respects of the system, namely the physician’s duty of 

 
3 LEWIS VAUGHN, BIOETHICS: PRINCIPLES, ISSUES, AND CASES 83 (3d ed. 

2017). 
4 MARK A HALL, MARY ANNE BOBINSKI & DAVID ORENTLICHER, MEDICAL 

LIABILITY AND TREATMENT RELATIONSHIPS 169-71 (Wolters Kluwer Law & 

Bus., 3d ed. 2013). 
5 Raanan Gillon, Confidentiality, in A COMPANION TO BIOETHICS 425, 425-

31 (Helga Kuhse & Peter Singer eds., Blackwell 1st ed. 1998). 
6  BEN WHITE, FIONA MCDONALD & LINDY WILLMOTT, HEALTH LAW IN 

AUSTRALIA 407 (3d ed., 2018). 
7 MARK TAYLOR, GENETIC DATA AND THE LAW: A CRITICAL PERSPECTIVE 

ON PRIVACY PROTECTION 17 (2012). 
8  AUSTL. L. REFORM COMM’, REPORT NO. 108 VOL. 1, FOR YOUR 

INFORMATION: AUSTRALIAN PRIVACY LAW AND PRACTICE 142 (2008). 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

132 

confidentiality and informational privacy in relation to health 

data, should be thoroughly examined.  

 

A. Duty of Confidentiality 

 

The medical profession in Thailand is overseen by the 

Medical Council of Thailand (TMC). The TMC has been 

conferred several powers, including registering, issuing medical 

licenses, and controlling the conduct of medical practitioners so 

as to ensure that their conduct is in compliance with the ethics of 

the medical profession.9 Practicing physicians in Thailand need 

to observe the rules and regulations enacted by the TMC; 

otherwise disciplinary actions may ensue.10 The Code of Ethics 

for Doctors in Thailand provides: “A physician must not disclose 

their patient’s secret which they obtained in a professional 

capacity unless the patient’s lawful consent is given or that 

disclosure is required by law or duty.”11 The TMC, alongside 

other health care professional bodies, also issued the 

“Declaration of Patients’ Rights” in 1998. Article 7 of the 

Declaration reads: “The patient has the right to expect that their 

personal information is kept confidential by the medical 

practitioner, the only exception being in cases with the consent 

of the patient or due to legal obligation.”12 “Even though said 

Declaration is not the law, it reflects the initiative and intent of 

those professions. Moreover, apart from the moral or 

administrative binding, the Thai Supreme Court usually cite the 

professional organization’s own regulations or initiatives to hold 

defendants liable when their conduct contradicts those 

provisions.”13 

Reflecting on those provisions, the duty of 

confidentiality on Thai physicians is quite strict. The doctor has 

few excuses to justify divulging the patient’s information, 

including by receiving the patient’s consent or having to disclose 

the information required by law and duty.  

 

 

 
9 See Medical Profession Act, B.E. 2525 §§ 7, 8 (1982) (Thai.).  
10 See Medical Profession Act, B.E. 2525 §§ 31, 32 (1982) (Thai.). 
11 Medical Council’s Rule on the Observance of the Code of Ethics, B.E. 2549 

Article 27 (2006) (Thai.). 
12 The Declaration of Patients’ Rights, 

http://www.thaiclinic.com/pt_right.html (last visited Apr. 16, 2021) (Thai). 
13 Khajorndej Direksoonthorn, Informed Consent in Thailand: What Standard 

Is It? Which One Should It Be? 12(3) ASIA PACIFIC J. OF HEALTH L. & ETHICS 

1, 10 (2019). 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

133 

B. Informational Privacy 

 

Both the right to privacy and the right to personal data 

protection are enshrined in the current Thai Constitution Section 

32.14 Unlike the duty of confidentiality, personal data held by the 

public and private sectors are governed by several different 

legislative acts concerning informational privacy. Personal data 

held by the public sector is covered by the Official Information 

Act, B.E. 2540 (1997). 15  This Act governs the collecting, 

processing, and disclosing of all personal information, including 

personal health information in possession or control of a 

governmental agency. 16  Further, personal health information 

possessed by both the public and private sectors is also governed 

by the National Health Act, B.E. 2550 (2007). 

An important subordinate law in this area is the Ministry 

of Public Health’s Regulation on the Protection and 

Management of Personal Health Data, B.E. 2561 (2018). This 

Regulation concerns the disclosure of health data held by all 

entities under the control of the Ministry of Public Health.17 

Therefore, the Regulation does not concern the entities under the 

oversight of other public authorities, such as university teaching 

hospitals overseen by relevant universities and Veterans Affairs 

hospitals supervised by the Thai Military. 

 

II. THE PROBLEM OF CONFLICTING LAWS: THE NATIONAL 

HEALTH ACT AND OTHER LAW 

 

The National Health Act, B.E. 2550 (2007), which has 

been in force since 2007, is the main piece of health care 

legislation and the first parliamentary Act to refer to ‘personal 

 
14 Constitution of the Kingdom of Thailand, B.E. 2560 § 32 (2017) (Thai.) (A 

person shall enjoy the rights of privacy, dignity, reputation and family. An act 

violating or affecting the right of a person under paragraph one, or an 

exploitation of personal information in any manner whatsoever shall not be 

permitted, except by virtue of a provision of law enacted only to the extent of 

necessity of public interest.). 
15 See Official Information Act, B.E. 2540 (1997) (Thai.). 
16  Official Information Act, B.E. 2540 § 4 (1997) (Thai.) (“official 

information” means an information in possession or control of a State agency, 

whether it is the information relating to the operation of the State or the 

information relating to a private individual.). 
17 Ministry of Public Health’s Regulation on the Protection and Management 

of Personal Health Data, B.E. 2561 Article 4 (2018) (Thai.) (defines a data 

controller as “all entities under the control of the Ministry as well as other 

entities, whether public or private, which wish to share the health database 

with the Ministry.”).  



 PROTECT THE PUBLIC [Vol. 34: 128 

 

134 

health information’ clearly. 18  However, the Act creates 

difficulties in its interpretation and enforcement. That may worry 

the physician when dealing with this kind of sensitive 

information.19 

Section 7 of the Act reads: “Personal health information 

shall be kept confidential. No person shall disclose it in such a 

manner as to cause damage to him or her, unless it is done 

according to his or her will or is required by a specific law to do 

so. In any case whatsoever, no person shall have the power or 

right under the law on official information or other laws to 

request a document related to personal health information of any 

person other than himself or herself.”20 (emphasis added). The 

last sentence of the Section is problematic. To illustrate, the first 

part of the Section provides two exceptions to the duty of 

confidentiality, which justifies the physician’s breach of 

confidence which correspond with the exceptions set forth in the 

Code of Ethics for Doctors in Thailand.21 The first exception is 

by consent given by the patient. The second is by the physician’s 

legal duty required by specific laws such as the Official 

Information Act, the Communicable Diseases Act, and the 

Mental Health Act.22 However, the last sentence of the National 

Health Act strictly prohibits, without exception and regardless of 

any other law that may be invoked, a request for a document 

related to personal health information of any person other than 

the one requesting the document himself or herself.  

The Official Information Act, B.E. 2540 (1997), which 

has been in force since 1997, covers the collecting, processing, 

and disclosing of personal information held by State Agencies.23 

 
18 Sathirareuangchai, supra note 1, at 78.  
19  See Crime News Team, ดต.ฟอ้งหมอเปิดเผยขอ้มลูลูกเป็นเด็กดาวน์ฯ [Police Officer 

Alleges Doctor Disclosed His Child’s Down Syndrome], MGR ONLINE (Jan. 

15, 2013), https://mgronline.com/crime/detail/9560000005805.  
20 National Health Act, B.E. 2550 § 7 (2007) (Thai.). 
21 Medical Council’s Rule on the Observance of the Code of Ethics, B.E. 2549 

Article 27 (2006) (Thai.). 
22  See Hathaichanok Raiwong, ปัญหาเกี่ยวกบัการคุม้ครองขอ้มลูส่วนบุคคลดา้นสุขภาพ  

[Problems Relating to the Protection of Personal Health Information] 11(3) 

วารสารบณัฑิตศึกษานิติศาสตร์ [GRADUATE L. J.] 695 (2018) (Thai.). 
23  See Official Information Act, B.E. 2540 Chapter III (1997) (Thai.) 

(According to Section 4 of the Act, "State agency" means a central 

administration, provincial administration, local administration, State 

enterprise, Government agency attached to the National Assembly, Court 

only in respect of the affairs unassociated with the trial and adjudication of 

cases, professional supervisory organization, independent agency of the State 

and such other agency as prescribed in the Ministerial Regulation.).  

 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

135 

Section 24 of this legislation prohibits disclosure of personal 

information without prior or immediate consent given in writing 

by the person who is the subject thereof except for disclosure in 

certain circumstances.24 Such exceptions include the disclosure 

in ordinary use of the information within the objectives of the 

provision for such personal information system 25 , and the 

disclosure to the court, state officials, state agencies or persons 

having power under law to make a request for such 

information.26 It turns out, pursuant to Section 7 of the National 

Health Act, even Thai courts cannot request or subpoena a 

document related to personal health information other than that 

of the person who requests or subpoenas.  

Likewise, the Communicable Diseases Act, B.E. 2558 

(2015), which has been in effect since 2016 27 , stipulates 

notifiable diseases. Section 31 of the Act imposes on certain 

persons the duty to notify a communicable disease control 

officer of the occurrence of a dangerous communicable disease, 

a communicable disease under surveillance or an epidemic, all 

of which are enumerated in the Act.28 Section 34 of the same Act 

then grants communicable disease control officers the power to 

require persons who are infected or reasonably suspected of 

being infected with the dangerous communicable disease or 

epidemic, or are contacts or carriers, to have a check-up or 

treatment or medical examination. In addition, for the purpose of 

safety, such persons may be isolated, quarantined or controlled 

for observation at places specified by communicable disease 

control officers until such persons have had a checkup and 

medical examination and it is confirmed that the period of 

communicability has passed, or such suspicion has been 

dispelled. 29  In those circumstances, it may be the case that 

 
24 Official Information Act, B.E. 2540 § 24 (1997) (Thai.) (A State agency 

shall not disclose personal information in its control to other State agencies 

or other persons without prior or immediate consent given in writing by the 

person who is the subject thereof except for the disclosure in the following 

circumstances…). 
25 Official Information Act, B.E. 2540 § 24(2) (1997) (Thai.). 
26 Id. § 24(8). 
27 Communicable Diseases Act, B.E. 2558 § 2 (2015) (Thai.) (Section 2 of 

the Act reads: ‘This Act shall come into force after the expiration of one 

hundred and eighty days from the date of its publication in the Government 

Gazette.’ It was published in the Government Gazette on September 8th, 

2015). 
28 Id. § 31 (In the case of occurrence of a dangerous communicable disease, a 

communicable disease under surveillance or an epidemic, the following 

persons shall notify a communicable disease control officer….). 
29  Id. § 34 (For the purpose of prevention and control of communicable 

diseases, when a dangerous communicable disease or an epidemic has 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

136 

communicable disease control officers may request, from 

relevant health care professionals or institutions, documents 

concerning the personal health information of the persons who 

are infected or suspected of being infected with the specified 

categories of communicable diseases. However, pursuant to the 

last sentence of Section 7 of the National Health Act, the 

communicable disease control officer concerned cannot request 

such a document without any exception. 

By the same token, the Mental Health Act, B.E. 2551 

(2008), which has been in force since 2008, provides a legal 

framework for treatment of a person with mental disorders to 

protect the theirs and society as a whole’s safety. Section 16 of 

the Act provides that no person shall disclose health information 

of a patient in such a way that is likely to cause damage to the 

patient, except (1) in a case where harm may be caused to the 

patient or to others; (2) for the safety of the public; (3) where 

there is a special law prescribing the disclosure. Therefore, a 

psychiatrist may be requested to produce a document related to 

a patient’s personal health information after informing the 

relevant parties for the safety of the public or due to special laws. 

Again, it turns out that such a request or production of document 

is strictly prohibited by the Section 7 of the National Health Act. 

In sum, the formulation of Section 7 of the National 

Health Act has caused confusion and concern to physicians 

practicing in Thailand. Considering the right to personal 

information is recognized in the Constitution, and the Code of 

Ethics for doctors in Thailand prescribes a strict duty of 

confidentiality for doctors, the inconsistencies and uncertainty 

caused by Section 7 of the National Health Act may render the 

disclosure of the patient’s health data to third parties practically 

prohibitive.30 

Furthermore, the laws on doctors’ disclosure to third 

parties have been deficient, complicating the aforementioned 

matters more. Next, this article will discuss the disclosure of 

patient information to third parties to demonstrate physicians’ 

lack of certainty regarding disclosures.  

 

 
occurred or is suspected of having occurred in any area, a communicable 

disease control officer in such area shall have the power to carry out, or issue 

a written order instructing any person to carry out the following….). 
30 See generally Medical Dilemma II: Confidentiality, Patient’s Rights and 

Medical Ethics, หมอชาวบ้าน [Thai Traditional Medicine] (Oct. 1, 2007), 

https://www.doctor.or.th/clinic/detail/7453 (Pointing out the uncertainty Thai 

doctors confront in general when revealing patients’ information to others).   



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

137 

III. THE DISCLOSURE OF PATIENT DATA TO THIRD PARTIES: 

DEFICIENCIES OF LAW AND GUIDANCE 

 

The internal inconsistency contained in the National 

Health Act and its conflicts with other relevant laws as discussed 

above are further compounded by doctors’ duty to third parties. 

Medical malpractice law in Thailand is still highly 

underdeveloped. 31  Apparently, only a few relevant textbooks 

exist not to mention the fact that those have been written only in 

the Thai language. It has been claimed that judges in Thailand 

have “few sources of guidance in malpractice cases, as there are 

very few statutes, books, or articles that discuss malpractice 

jurisprudence.”32 Few precedents from the Supreme Court of 

Thailand are ascertainable to guide trial judges in adjudicating a 

medical malpractice case.33 The standard of care for medical 

malpractice is unsettled.34 In one court case, the Supreme Court 

of Thailand used testimony from a general practitioner, notably 

not a pediatrician, to speak to the standard of care in pediatric 

treatment. 35  As a result, physicians in Thailand may find it 

difficult, if not impossible, to base their informed judgement 

upon guidance about their legal duty to third parties from court 

rulings. Arguably, health care professionals can look to their 

professional guidelines and assume that the respective guidelines 

accord with the law.36 Yet, the Medical Council of Thailand is 

silent on the matter regarding disclosure to third parties. The 

Code of Ethics for Doctors is quite rigid with respect to the duty 

of confidentiality.37 According to the Code, doctors in Thailand 

can breach the duty of confidentiality on only two grounds: when 

the disclosure is required by law or required by duty.38 We have 

discussed the requirements for disclosure required by law, e.g., 

disclosure requirements for notifiable diseases. However, 

 
31 Nathan Cortez, Recalibrating the Legal Risks of Cross-Border Health Care 

10 YALE J. OF HEALTH POL’Y, L., AND ETHICS 1, 43 (2010). 
32 Nathan Cortez, A Medical Malpractice Model for Developing Countries? 

4 DREXEL L. REV. 217, 228 (2011). 
33 Yot Teerawattananon et al., Health Sector Regulation in Thailand: Recent 

Progress and the Future Agenda 63 HEALTH POLICY 323 (2003). 
34 Tanaroj Lortanapaisan, ปัญหากฎหมายเกี่ยวกับการคุ้มครองสิทธิผู้เสียหายจากบริการทางการแพทย์: 
กรณีศึกษาเปรียบเทียบในอาเซียน [Legal Problems in Protecting Injured People’s Rights 

Arising from Medical Services: A Comparative Study of ASEAN Countries] 

10 วารสารนิติศาสตร์ มหาวิทยาลัยอัสสัมชัญ [ASSUMPTION U. L. J.] 138, 142 (2019). 
35 ค าพิพากษาศาลฎีกาที่ ๑๒๔๙๘/๒๕๕๘ (2015) Thai. Sup. Ct. No. 12498/2558. 
36 JONATHAN HERRING, MEDICAL LAW AND ETHICS 237–8 (7th ed. 2018). 
37 See The Medical Council’s Rule on the Observance of the Code of Ethics, 

B.E. 2549 Article 27 (2006) (Thai.). 
38 Id. 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

138 

requirements for disclosure required by duty have never been 

clarified by any guidance or guidelines.39 The Medical Council 

has never expounded this issue. Given the uncertainties due to 

the confusingly conflicting laws, it is doubtful that, without 

patient consent, physicians would decide to divulge patients’ 

confidential information to third parties to protect the third 

parties, the public at large or other public interest.40 

It should be noted that, generally speaking, there are 

currently no law nor professional guidance prescribing 

physicians’ duty to disclose the patient health data to others in 

order to protect third parties or other public interest in 

Thailand.41 The few exceptions are to report child abuse42 or 

notifiable diseases43 to relevant competent officials. Therefore, 

virtually all laws on the issue exist to justify doctors’ breach of 

confidence in disclosing patient health information rather than to 

obligate the doctor to breach the duty of confidentiality. To the 

author’s knowledge, there are no court cases associated with the 

duty to disclose the patient’s confidential information to third 

parties or genetic relatives in Thailand.  

Court cases from other jurisdictions merit further 

exploration to shed light on the likelihood of Thai courts 

 
39 One of the fundamental objectives of the Medical Council of Thailand, 

according to the Medical Profession Act, B.E. 2525 (1982) section 7, is to 

control conduct of medical practitioners so as to be in compliance with 

the ethics of the medical profession. Accordingly, the Medical Council has 

the power, under section 21 of the said Act, to issue any rules and guidelines 

on such relevant matters. 
40 Medical Dilemma II: Confidentiality, Patient’s Rights and Medical Ethics, 

supra note 30. 
41 Sathirareuangchai, supra note 1, at 80; See also Official Information Act, 

B.E. 2540 § 24 (1997) (Thai.); Mental Health Act, B.E. 2551 § 16 (2008) 

(Thai.). 
42 Child Protection Act, B.E. 2546 § 29 (2003) (Thai.) (If it clearly appears or 

is suspected that a child has been tortured or is sick due to illegal care, a 

medical doctor, nurse, psychologist or public health official who admits a 

child for medical treatment or a teacher, instructor or employer having the 

duty to take care of a child as student or employee, shall report, without delay, 

the competent official or person having duty to provide welfare protection to 

a child under section 24 or the administrative official or police officer.). 
43 Communicable Diseases Act, B.E. 2558 § 31 (2015) (Thai.) (In the case of 

occurrence of a dangerous communicable disease, a communicable disease 

under surveillance or an epidemic, the following persons shall notify a 

communicable disease control officer: (1) in the case where a person infected 

or reasonably suspected of being infected with such communicable disease is 

found in a house, an owner of the house or a person in charge of the house or 

a physician who provides treatment; (2) in the case where a person infected 

or reasonably suspected of being infected with such communicable disease is 

found in a sanatorium, a person responsible for the sanatorium…). 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

139 

imposing on physicians the duty to disclose health data to third 

parties. If it is found that the judiciary is willing to impose such 

a duty, professional guidelines may be urgently needed for 

physicians to avoid liability. 

This article will now turn to related court cases in other 

countries: the United States, the United Kingdom, and Australia. 

 

A. Physicians’ Duty of Disclosure to Third Parties 

 

In the United States, Tarasoff v. Regents of University of 

California44 was the first and arguably the most famous case in 

which the Supreme Court of California imposed a duty to 

disclose patient information on psychotherapists when their 

patients posed a serious threat to others.45 The Court laid down 

the oft-cited decision: “The [Psychotherapist’s] revelation of a 

[patient’s] communication[s] is not a breach of trust or a 

violation of professional ethics [where such disclosure is 

necessary to avert danger to others]…public policy favoring 

protection of the confidential character of patient-

psychotherapist communications must yield to the extent to 

which disclosure is essential to avert danger to others. The 

protective privilege ends where the public peril begins.” 46 

(Emphasis added.) A therapist has a duty “to use reasonable care 

to protect [a potential victim when they determine], or under 

applicable professional standards reasonably should have 

determined, that a patient poses a serious danger of violence to 

others.”47 However, the Californian Legislature has limited the 

Tarasoff decision by legislation. The Californian statute imposes 

a duty to a psychotherapist only if “the patient has 

communicated to the psychotherapist a serious threat of physical 

violence against a reasonably identifiable victim or victims.” 

(Emphasis added.)48 “The statute represents ‘a legislative effort 

to strike an appropriate balance between conflicting policy 

interests. On the one hand, the need to preserve a patient 

confidence recognizes that effective diagnosis and treatment of 

a mental illness or an emotional problem is severely undermined 

when a patient cannot be assured that a statement made in the 

 
44 Tarasoff v. Regents of University of California, 17 Cal. 3d 425, 551 P.2d 

334 (1976). 
45 Wendy Nixson, Has the Right to Breach Patient Confidentiality Created A 

Common Law Duty to Warn Genetic Relatives? 17 QUT L. REV. 147, 155 

(2017). 
46  Tarasoff, 17 Cal. 3d 425, 347. 
47 Id.  
48 Cal. Civ. Code § 43.92(a). 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

140 

privacy of his therapist’s office will not be revealed. On the other 

hand, is the recognition that, under limited circumstances, 

preserving a confidence is less important than protecting the 

safety of someone whom the patient intends to 

harm.’”49 Tarasoff is an important opinion, almost always cited 

by courts and legislative bodies whether it is followed or 

rejected.50 

As to the duty to third parties in non-mental disorder 

cases, the Supreme Court of Tennessee ruled that a physician 

owed a duty to warn a patient’s wife of the risk of contracting 

Rocky Mountain spotted fever, a noncontagious disease, from 

the patient due to a phenomenon called clustering, the 

transmission of the disease to humans by infected ticks. 51 

Furthermore, “physicians have been held liable for failing to 

warn the daughter of a patient with scarlet fever, a wife about the 

danger of infection from a patient’s wounds, and a neighbor 

about [a] patient’s smallpox.”52  

In the United Kingdom, the UK court appears to allow 

doctors to reveal patients’ confidential information if it is 

necessary to protect the public interest in maintaining others’ 

safety and welfare.53 The General Medical Council (GMC), a 

professional body which oversees the practice of medicine in the 

UK54, has issued relevant guidelines. The GMC’s guidance on 

confidentiality states: ‘There can be a public interest in 

disclosing information if the benefits to an individual or society 

outweigh both the public and the patient’s interest in keeping the 

information confidential. For example, disclosure may be 

justified to protect individuals or society from risks of serious 

harm, such as from serious communicable diseases or serious 

crime.’55 However, ‘it is far from clear whether [a therapist’s 

obligation to use reasonable care to protect the victim set by 

Tarasoff] would be followed in England and Wales. The general 

 
49 Regents of Univ. of Cal. v. Superior Ct., 29 Cal. App. 5th 890, 240 Cal. 

Rptr. 3d 675, 686 (2018). 
50 MARY ANNE BOBINSKI ET AL, BIOETHICS AND PUBLIC HEALTH LAW 151 

(4th ed. 2018). 
51 Bradshaw v. Daniel, 854 S.W.2d 865 (Tenn, 1993). 
52 BARRY R FURROW ET AL, HEALTH LAW 208 (3rd ed. 2015). 
53 Saha v. General Medical Council, EWHC 1907 (2009) (U.K.). See also W 

v. Egdell, 2 WLR 471 (1990) (U.K.). 
54  EMILY JACKSON, MEDICAL LAW: TEXT, CASES, AND MATERIALS 176-7 

(4th ed. 2016). 
55  GEN. MED. COUNCIL, CONFIDENTIALITY: GOOD PRACTICE IN HANDLING 

PATIENT INFORMATION 18 (2017). 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

141 

view seems to be that it would not, because normally, in tort law, 

one is not responsible for the acts of a third party.’56  

In Australia, the Australian courts seem to stop short of 

clearly imposing a duty to warn non-patients on physicians even 

though they sometimes stipulate a duty owed by physician to 

third parties.57 In Harvey v. PD, the Court ruled that a doctor 

breached his common law duty in not providing pre-test 

counselling when two patients had unprotected sextual 

intercourse with each other following a joint consultation for 

HIV screening. 58  The plaintiff tested HIV-negative, but the 

doctor denied her access to her then-fiancé’s test result (which 

was HIV-positive). Her then-fiancé lied about his test result to 

engage in unprotected sexual intercourse with her.59 Spigelman 

CJ stated that the doctor has the duty to advise the plaintiff and 

her then fiancé of “the need for each to consent to the supply of 

their results to the other. His failure to do so led to the damage 

suffered by [the plaintiff] on the basis that if [her then-fiancé] 

had agreed, she would have been fully informed of his HIV 

status and if [he] had not agreed, she would have terminated the 

relationship.”60  

One important category of physicians’ duty to warn third 

parties of patients’ confidential information concerns genetic 

data. Numerous scholarly articles on the subject have been 

written. For the purposes of this article, the author will not 

discuss it in detail, but will illuminate the same problem that 

need to be addressed in the duty of confidentiality of physicians 

in Thailand in the near future. This article will not deal with the 

relevant professional guidance in other countries or theoretical 

concepts, such as an argument that the genetic information is 

shared information61, the revelation of which to at-risk genetic 

relatives is not considered breach of confidence on the part of 

the doctor. Rather, this article will take pertinent court cases to 

enlighten the legal duty and uncertainties that Thai doctors may 

face. 

 
56 HERRING, supra note 36, at 250. 
57 See BT v. Oei  NSWSC 1082 (1999) (Austl.). See also BILL MADDEN, 

JANINE MCILWRAITH & BENJAMIN MADDEN, AUSTRALIAN MEDICAL 

LIABILITY 88-9 (3rd ed., 2017). 
58 Harvey v. PD 59 NSWLR 639 (2004) (Austl.). 
59 Id. 
60 Id. at 1. 
61 See Anneke Lucassen & Roy Gilbar, Alerting Relatives about Heritable 

Risks: The Limits of Confidentiality  BMJ 2018 at 361. See also Michael 

Parker and Anneke Lucassen, Using a Genetic Test Result in the Care of 

Family Members: How Does the Duty of Confidentiality Apply? 26 EUR. J. 

OF HUM. GENETICS 955 (2018). 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

142 

B. Revealing Patients’ Genetic Data to Genetic 

Relatives 

 

There are no ascertainable reported Australian court 

cases addressing physicians’ duty to patients’ genetic relatives.62 

In the United States, the Supreme Court of Florida ruled that a 

doctor may owe a duty to children of patients concerning 

genetically transmissible diseases. 63  “When the prevailing 

standard of care creates a duty that is obviously for the benefit 

of certain identified third parties [in this case, the children of the 

patient] and the physician knows of the existence of those third 

parties, then the physician's duty runs to those third parties.”64 

However, the Court added: “In any circumstances in which the 

physician has a duty to warn of a genetically transferable disease, 

that duty will be satisfied by warning the patient”65 The Superior 

Court of New Jersey (Appellate Division), however, declined to 

follow its Floridian counterpart, holding that it may be necessary 

that the duty to warn be satisfied by warning the patient’s genetic 

relative directly in cases where the patient insists that nothing be 

disclosed to family members.66 

In the United Kingdom, a woman whose father was 

diagnosed with Huntington’s disease, a genetic condition which 

can be inherited through an autosomal dominant gene (i.e. she 

had a 50 per cent chance of having the disease given the 

diagnosis of her father), sued the NHS trust.67 She alleged that 

her father’s doctor, who knew of the diagnosis, was negligent in 

not contradicting her father’s preference to warn her of her risk 

of having Huntington’s disease.68 She was pregnant at the time 

of alleged negligence and would have decided to terminate her 

pregnancy.69 Although the Court dismissed the case, finding no 

breach of duty, it ruled that “it is fair, just and reasonable to 

impose on the [doctor] a legal duty to the claimant to balance her 

interest in being informed of her genetic risk against her father's 

interest in preserving confidentiality in relation to his diagnosis 

 
62 MADDEN, MCILWRAITH AND MADDEN, supra note 57, at 91. 
63 Pate v. Threlkel, 661 So. 2d 278, 282 (Fla. 1995). 
64 Id.  
65 Id. 
66 Safer v. Estate of Pack, 677 A.2d 1188, 1192-3 (N.J. Super. Ct. App. Div. 

1996). 
67 ABC v. St George's Healthcare NHS Trust and others, EWHC 455 (2020) 

(U.K.). 
68 Id. 
69 Id. 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

143 

and the public interest in maintaining medical confidentiality 

generally.”70    

In Australia, even though no court has imposed the duty 

to warn genetic relatives on physicians, there are guidelines on 

the use and disclosure of genetic information to a patient’s 

genetic relatives under Section 95AA of the Privacy Act 1988.71 

Nevertheless, there are arguments over the guideline regarding 

whether psychological harm to genetic relatives constitutes harm 

justifying the disclosure to such relatives. 72  Moreover, some 

suggest that “there is a practical tendency that once something is 

made an ethical norm, legal obligations typically follow.”73 In 

other words, once the guidelines are set, the physician’s legal 

duty to disclose to genetic relatives may later ensue even though 

such guidelines are only permissive rather than prescriptive of 

the disclosure. 

To summarize, the US courts are willing to impose on 

physician a duty to disclose patients’ health data to third parties 

in certain circumstances.74 Likewise, the UK court imposes on 

doctors a legal duty to third parties to balance their interest in 

being informed against the patient’s interest in preserving 

confidentiality and the public interest in maintaining medical 

confidentiality generally.75 The medical education and practice 

in Thailand have been heavily influenced by the US system.76 

While Thailand is a civil law jurisdiction, Thai courts generally 

employ the adversarial system because the court system was 

modernized and westernized by many UK-educated scholars, 

including Prince Raphi 77 . Accordingly, it is likely that Thai 

 
70 Id. at 188. 
71  NATIONAL HEALTH AND MEDICAL RESEARCH COUNCIL, USE AND 

DISCLOSURE OF GENETIC INFORMATION TO A PATIENT’S GENETIC RELATIVES 

UNDER SECTION 95AA OF THE PRIVACY ACT 1988 (CTH) (2014). 
72  Rebekah McWhirter, Carolyn Johnston and Jo Burke, Disclosure of 

Genetic Results to At-Risk Relatives without Consent: Issues for Health Care 

Professionals in Australia. 27 J. OF L. AND MED. 108, 114–8 (2019). 
73 Margaret Otlowski & Lisa Eckstein, Genetic Privacy in TENSIONS AND 

TRAUMAS IN HEALTH LAW 289 (Ian Freckelton & Kerry Petersen eds., 2017). 
74 See Pate v. Threlkel, 661 So. 2d 278, 282 (Fla. 1995); Safer v. Estate of 

Pack, 677 A.2d 1188, 1192-3 (N.J. Super. Ct. App. Div. 1996); Tarasoff v. 

Regents of University of California, 17 Cal. 3d 425 (1976). 
75 ABC, EWHC 455, at 188. 
76 Khajorndej Direksoonthorn, ความยินยอมที่ได้รับการบอกกล่าวในบริบทของระบบกฎหมายไทย: 
เร่ืองทีศ่าลต้องวางหลกัในอนาคตอันใกล้ [Informed Consent in Thai Legal System: The 

Urgent Matter Requiring the Court’s Attention] 66 ดุลพาห [J. OF THE OFF. OF 

THE JUDICIARY OF THAI.] 120, 123 (2019). 
77 พระบิดาแห่งกฎหมายไทย [The Father of the Thai Law], เนติบณัฑิตยสภา [THE THAI 

BAR], http://www.thethaibar.or.th/thaibarweb/index.php/th/องค์กร/เนติบณัฑิตยสภา/



 PROTECT THE PUBLIC [Vol. 34: 128 

 

144 

courts may impose such a duty on physicians in Thailand in the 

future.  

While it is unclear when and whether Thai courts will 

impose on doctors the duty to disclose, inconsistencies and 

uncertainty over conflicting statutes should still be ameliorated. 

Guidance should be clarified to allow doctors to  divulge 

patients’ health data to protect the public interest without fear of 

criminal or and civil liability.      

 

C. The MOPH’s Regulation on the Protection and Management 

of Personal Health Data: The Legal Instrument Only to 

Confuse the Issue 

 

The Ministry of Public Health of Thailand (MOPH) 

enacted the ‘Regulation on the Protection and Management of 

Personal Health Data, B.E. 2561 (2018),’ only to confuse the 

issue. This Regulation pertains to the disclosure of health data 

held by all entities under the control of the Ministry of Public 

Health.78 Article 13 of the Regulation reads: “Personal health 

data is personal confidential information which can be disclosed 

only if the data subject’s consent is given or it is required by law. 

In any event, the disclosure must not cause damage to the data 

subject. 79 (Emphasis added.) The last sentence causes confusion 

to physicians again, especially when disclosure to third parties 

would conflict with patients’ own preference. Divulging 

confidential information in contradiction of patients’ self-

determination when the public interest in protecting others 

outweighs the interests of confidentiality (generally and of the 

patient) may unavoidably be deemed as causing damage to the 

patient or data subject. As a consequence, strictly following the 

Regulation will preclude any disclosure in favor of the public 

interest that runs afoul of the patient’s own interest if they 

decline to consent to such disclosure. Another problem is that 

this Regulation may be in contravention of the Official 

Information Act, which also governs the disclosure of health data 

 
พระบิดาแห่งกฎหมายไทย.html (Prince Raphi, who is known as Father of Thai 

Modern Legal System, studied at Oxford and came back to Thailand in order 

to establish the westernized court system employing an adversarial system.). 
78 See also Asia Pacific Observatory on Health Systems and Policies, The 

Kingdom of Thailand Health System Review, HEALTH SYSTEMS IN 

TRANSITION, Vol. 5 No. 5 at 38 (2015) (In 2008, some 77% of hospitals in 

Thailand were public, the vast majority owned by the MOPH, a few by other 

ministries.). 
79  The Ministry of Public Health’s Regulation on the Protection and 

Management of Personal Health Data, B.E. 2561 Article 13 (2018) (Thai.). 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

145 

possessed by the MOPH. The Official Information Act permits 

“the disclosure necessary for the prevention or elimination of 

harm to the life or health of persons.” 80  Under the Official 

Information Act, the harm which can justify the disclosure to 

third parties need not even be imminent or serious.81 Disclosure 

when there are no imminent or serious threats to third parties 

may be deemed as causing damage to the patient or data subject, 

therefore prohibited by the MOPH’s Regulation.  

In even starker contrast to the MOPH’s Regulation is the 

Mental Health Act. That Act permits the disclosure of health 

information of patients suffering from mental disorder(s) where 

harm may be caused to the patient or to others, even if the 

disclosure may cause damage to the patient.82 For example, they 

may be restrained or even arrested. 

 

IV. RESOLVING THE CONFLICTS OF HEALTH DATA PROTECTION 

LAWS: GAINING THE PERSPECTIVES FROM AUSTRALIA AND 

EUROPE 

 

To illuminate this important issue in Thailand, it is worth 

considering how Australian and European laws deal with it.  

 

A. Australia’s Privacy Act 1988 (Cth) 

 

The Privacy Act 1988 (Cth) sets out thirteen Australian 

Privacy Principles (APPs) which regulate the management, 

collection, storage, use, disclosure, correction and integrity of, 

and access to personal information. 83  Health and genetic 

information are categorized as sensitive information, a subset of 

 
80 Official Information Act, B.E. 2540 § 24(7) (1997) (Thai.). 
81 This contention is because of how this provision is framed. Unlike Section 

67 and 68 of the Thai Criminal Code, the provision is framed in a manner that 

excludes the requirements of imminent or serious harm. The contention also 

corresponds with the Select Parliamentary Committee of the Personal Data 

Protection Bill’s interpretation of the similar provisions of the Personal Data 

Protection Act having been framed in the same manner. The Committee has 

suggested that a danger to life, body or health of the Person need not be 

imminent, nor the situation be urgent to constitute the permitted situation. See 

NAT’L ASSEMBLY OF THAI. SELECT PARLIAMENTARY COMM., REPORT ON 

THE PERSONAL DATA PROTECTION ACT PRESENTED TO THE PARLIAMENT, 2d 

reading, at 21 [2019] (Thai.). 
82 Mental Health Act, B.E. 2551 § 16 (2008) (Thai.) (No person shall disclose 

health information of a patient in such a way that is likely to cause damage to 

the patient, except: (1) in a case where harm may be caused to the patient or 

to others….). 
83 Privacy Act 1988 (Cth) Schedule 1 (1988) (amended 2020) (Austl.). 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

146 

personal information. 84  The permitted general situations in 

relation to the collection, use, or disclosure of personal 

information are enumerated in Section 16A of the Privacy Act 

1988.85 Item 1 of Section 16A permits disclosure of personal 

information if it is unreasonable or impracticable to obtain the 

individual’s consent to the disclosure and the relevant entity 

reasonably believes that the disclosure is necessary to lessen or 

prevent a serious threat to the life, health or safety of any 

individual, or to public health or safety.86 As a result, doctors in 

Australia can disclose personal information (including health 

information) of patients in cases where psychiatrists encounter 

situations similar to that in Tarasoff due to it being unreasonable 

to obtain the patient’s consent to the psychiatrist’s disclosure to 

law enforcement or potential victim(s), and the doctor 

reasonably believes that such disclosure is necessary to lessen or 

prevent a serious threat to the life, health or safety of potential 

victim(s). 

Section 16B of the Privacy Act 1988 further sets out 

permitted situations in relation to the collection, use or 

disclosure of health information.87 Paragraph 4 of Section 16B 

specifies the use or disclosure of genetic information to a genetic 

relative.88 If genetic information was obtained in the course of 

providing health services to patients and doctors believe that 

disclosure is necessary to lessen or prevent a serious threat to the 

life, health or safety of another individual who is a genetic 

relative of the patient, such disclosure to the genetic relative is 

permitted provided it is conducted in accordance with guidelines 

approved under Section 95AA.89 The Australian National Health 

and Medical Research Council issued the guidelines in 2009.90 

 

 

 
84 Id. at § 6 (definition of personal information and sensitive information.). 
85 Id. at § 16A. 
86 Id. 
87 Id. at § 16B. 
88 Id. 
89 Id. at § 95AA ((1) This section allows the Commissioner to approve for the 

purposes of the Australian Privacy Principles guidelines that are issued by the 

National Health and Medical Research Council. (2) For the purposes of 

paragraph 16B(4)(c), the Commissioner may, by legislative instrument, 

approve guidelines that relate to the use and disclosure of genetic information 

for the purposes of lessening or preventing a serious threat to the life, health 

or safety of an individual who is a genetic relative of the individual to whom 

the genetic information relates). 
90 NATIONAL HEALTH AND MEDICAL RESEARCH COUNCIL, supra note 71, at 

5. 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

147 

B. The GDPR 

  

The European Union (EU) regulation 2016/679 on the 

protection of natural persons with regard to the processing of 

personal data, also known as the General Data Protection 

Regulation (GDPR), has been in force since 25 May 2018.91 The 

GPDR repealed the previous EU directive on data protection 

(Directive 95/46/ EC). 92  “It was first proposed in 2012 to 

establish a uniform set of rules that would provide enhanced 

protection for EU citizens, foster innovation in the European 

Single Market and make the EU, according to Commissioner 

Jourova, ‘fit for the digital age’ (European Commission, 

2015).”93 

As Bennett argues, the GDPR has played three roles: 

“instruments of harmonization, exemplars, and a coercive 

force.” 94  Thailand has used the GDPR as a starting point in 

drafting a new law, evidenced by the many commonalities 

shared by the two data protection regimes. Thailand has also 

been affected by “the global awareness that has been sparked by 

the apparent extra-territorial applicability of the GDPR—the law 

attempts to regulate organizations based outside the EU which 

supply products or services to EU citizens, even where such 

[Thai] organizations have no EU presence or establishment.”95 

However, this should not surprise or unnecessarily worry the 

Thai government and people as the GDPR is applicable in all 

countries. Even in the United States, US organizations that wish 

to transfer personal data involving EU citizens must be certified 

as having met “the ‘Privacy Shield’ framework established by 

the EU and the US Department of Commerce. Certification 

signals that the US entity complies with the GDPR’s privacy 

principles, breaches of which are enforceable in the US via the 

 
91 Regulation 2016/679, of the European Parliament and of the Council of 27 

April 2016 on the protection of natural persons with regard to the processing 

of personal data and on the free movement of such data, and repealing 

Directive 95/46/EC, 2016 O.J. (L 119).  
92  Luca Marelli and Giuseppe Testa, Scrutinizing the EU General Data 

Protection 360 SCIENCE 496, 496 (2018).  
93 Colin J Bennett, The European General Data Protection Regulation: An 

Instrument for the Globalization of Privacy Standards? 23 INFORMATION 

POLITY 239, 240 (2018). 
94 Id. at 243–4. 
95 PETER CAREY, DATA PROTECTION: A PRACTICAL GUIDE TO UK AND EU 

LAW at xxxiv (5th ed. 2018). 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

148 

Federal Trade Commission (FTC) and the US Department of 

Transportation.”96 

 

V. THE PERSONAL DATA PROTECTION ACT: GDPR-STYLE LAW, 

A HOPE FOR THAI PHYSICIANS? 

 

Physicians in Thailand may warmly welcome the advent 

of the Personal Data Protection Act, B.E. 2562 (2019) as a 

clarification on the confusing field. This Act has passed in the 

Thai Parliament after over twenty years of Thai Governmental 

efforts to propose a personal data protection law.97 The Act is a 

piece of GDPR-style data protection legislation. 98  It is also 

Thailand’s first general data protection law which governs both 

the public and private sectors with some organizations and 

activities exempted from the Act’s provisions. 99  The Act 

provides for personal data protection 100 , rights of data 

subjects 101 , the process for lodging complaints 102 , including 

stipulating civil103, criminal104, or administrative liability105 of a 

data controller and data processor. A court may impose punitive 

damages on violators. 106  Importantly, the Act establishes the 

permanent Personal Data Protection Committee. 107  Under the 

Act, the Committee shall then appoint one or more Expert 

Committees based upon their fields of expertise.108 The Expert 

Committees are charged with considering complaints under the 

Act and investigating any act of data controllers or data 

processors, including employees or contractors of data 

controllers or data processors in connection with the personal 

data that caused damage to a data subject.109  

 
96  Nathan Cortez et al, READINGS IN COMPARATIVE HEALTH LAW AND 

BIOETHICS at 210 (3rd ed. 2019).  
97 Piyabuth Boonaramrung et al, Thailand data protection guidelines 2.0: แนว
ปฏิบัติเกี่ยวกับการคุ้มครองข้อมูลส่วนบุคคล 16 (2019). 
98 Id. 
99 Personal Data Protection Act, B.E. 2562 § 4 (2019) (Thai.). 
100 Personal Data Protection Act, B.E. 2562 Chapter II (2019) (Thai.). 
101 Personal Data Protection Act, B.E. 2562 Chapter III (2019) (Thai.). 
102 Personal Data Protection Act, B.E. 2562 Chapter V (2019) (Thai.). 
103 Personal Data Protection Act, B.E. 2562 Chapter VI (2019) (Thai.). 
104 Personal Data Protection Act, B.E. 2562 Chapter VII Part I (2019) (Thai.). 
105 Personal Data Protection Act, B.E. 2562 Chapter VII Part II (2019) (Thai.). 
106 Personal Data Protection Act, B.E. 2562 § 78 (2019) (Thai.). 
107 Id. at § 8. 
108 Id. at § 71. 
109 Id. at § 72. 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

149 

This Act should have come into force on 27th May 

2020.110 However, the rules, procedures and conditions required 

by the Act are detailed and complex. Due to the advanced 

technology needed to protect personal information as effectively 

as the Act’s objectives demand, a large number of data 

controllers, governmental and private agencies, and businesses 

nationwide, were not ready to comply with the Act at the time. 

Therefore, the Thai Government enacted a royal decree, 

exempting data controllers of specified agencies and business 

from the Personal Data Protection Act during the one-year 

period. 111 Public and private sector entities responsible for 

medical and public health affairs are among those exempted 

from enforcement of the Act by virtue of said royal decree until 

1st June 2021.112 Thus, the health data governance in Thailand 

set forth by the Act will come into force on 1st June 2021 barring 

further postponement of the effective data by the Thai 

Government. 

Even though the Personal Data Protection Act, B.E. 

2562 (2019) has yet to become effective with regard to personal 

health data in Thailand, it is worth considering its implications 

for health data governance in Thailand. Once it comes into force, 

it will arguably become the most comprehensive and significant 

piece of legislation on personal data protection which governs 

data held by both the public and private sectors.113 This article 

 
110 Personal Data Protection Act, B.E. 2562 § 2 (2019) (Thai.) (The act reads 

as follows, “This Act shall come into force on the day following the date of 

its publication in the Government Gazette, except for the provisions of 

Chapter II, Chapter III, Chapter V, Chapter VI, Chapter VII, and section 95, 

and section 96, which shall come into effect after the lapse of a period of one 

year from the date of its publication in the Government Gazette.” The Act 

was published in the Government Gazette on May 27th, 2019.). 
111 Id. at § 4 (The exceptions to apply all or parts of the provisions of this Act 

to any Data Controller in any manner, business or entity, in a similar manner 

to the Data Controller in paragraph one, or for any other public interest 

purpose, shall be promulgated in the form of the Royal Decree.). 
112  See Royal Decree Specifying the Businesses or Entities Whose Data 

Controllers Are Exempt from the Provisions of the Personal Data Protection 

Act, B.E. 2563 §§ 2, 3 (2020) (Thai.); the Schedule Annexed to the Royal 

Decree Specifying the Businesses or Entities Whose Data Controllers Are 

Exempt from the Provisions of the Personal Data Protection Act, B.E. 2563 

(2020) (Thai.). 
113 Personal Data Protection Act, B.E. 2562 § 3 (2019) (Thai.) (In the event 

that there is any sector-specific law governing the protection of Personal Data 

in any manner, any business or any entity, the provisions of such law shall 

apply, except: (1) for the provisions with respect to the collection, use, or 

disclosure of Personal Data and the provisions with respect to the rights of 

data subjects including relevant penalties, the provisions of this Act shall 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

150 

will turn to how the Act handles the problem of the duty of Thai 

physicians to third parties as discussed above. 

Sections 26 114  and 27 115  of the Act prohibit any 

collection, use or disclosure of personal health and genetic data 

without the explicit consent from the data subject. However, 

Section 26 sets forth the situations and criteria in which such 

collection, use or disclosure are permitted without any consent 

from the data subject.116 According to Section 26 (1), collection, 

use or disclosure is permitted to prevent or suppress a danger to 

life, body or health of the Person, when the data subject is 

incapable of giving consent for whatever reason. 117  This 

subsection, therefore, permits the doctor to disclose health or 

genetic information only when the data subject is incapable of 

giving consent whether physically or legally, but not when the 

data subject deliberately refused such consent. Hence, doctors in 

Thailand cannot invoke this provision to disclose the patient’s 

genetic information to their genetic relatives when the patient 

does not consent. It should also be noted that, the Select 

Parliamentary Committee of the Bill has suggested that a danger 

to life, body or health of the Person need not be imminent, nor 

the situation be urgent to constitute the permitted situation.118 

The Select Parliamentary Committee also suggested that the 

Personal Data Protection Committee, established by the Act and 

charged with the power to interpret and render rulings with 

respect to the issues arising from the enforcement of the Act,119  

should follow its interpretation because that is the Act’s 

 
apply additionally, regardless of whether they are repetitious with the above 

specific law…). 
114  Personal Data Protection Act, B.E. 2562 § 26 (2019) (Thai.) (“Any 

collection of Personal Data pertaining to…health data…genetic data…is 

prohibited, without the explicit consent from the data subject, except 

where.…”). 
115 Id. at § 27 (“The Data Controller shall not use or disclose Personal Data 

without the consent of the data subject, unless it is the Personal Data which 

is collected without requirement of consent under section 24 or section 26.”).  
116 Id. at § 26 (Any collection of Personal Data pertaining to racial, ethnic 

origin, political opinions, cult, religious or philosophical beliefs, sexual 

behavior, criminal records, health data, disability, trade union information, 

genetic data, biometric data, or of any data which may affect the data subject 

in the same manner, as prescribed by the Committee, is prohibited, without 

the explicit consent from the data subject, except where…). 
117 Id. at § 6 (Defines “Person” as a natural person.). 
118 NAT’L ASSEMBLY OF THAI. SELECT PARLIAMENTARY COMM., REPORT ON 

THE PERSONAL DATA PROTECTION ACT PRESENTED TO THE PARLIAMENT, 2d 

reading, at 21 (2019) (Thai.). 
119 Personal Data Protection Act, B.E. 2562 § 16 (2019) (Thai.).  



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

151 

objective.120 The interpretation that a danger to life, body or 

health of the Person need not be imminent is also congruent with 

the provision of the Official Information Act that allows, even 

without the data subject’s consent, “the disclosure necessary for 

the prevention or elimination of harm to the life or health of 

persons.”121 

Another relevant provision that merits discussion is 

Section 26(5)(b). It is a permitted situation in which disclosure 

of health or genetic data can be made without the consent from 

the data subject if “it is necessary for compliance with a law to 

achieve the purposes with respect to public interest in public 

health, such as protecting against cross-border dangerous 

contagious disease or epidemics which may be contagious or 

pestilent, or ensuring standards or quality of medicines, 

medicinal products or medical devices, on the basis that there is 

a provision of suitable and specific measures to safeguard the 

rights and freedom of the data subject, in particular maintaining 

the confidentiality of personal data in accordance with the duties 

or professional ethics.” 122  Some may argue that disclosing 

patients’ genetic information to genetic relatives can protect 

them by allowing them to seek early diagnosis, prophylactic 

treatment/surgery or at least close surveillance for that particular 

genetically inherited disease. As such, it achieves the purposes 

with respect to public interest in public health, thereby 

constituting a permitted situation under this provision. However, 

such argument is untenable. Providing patients’ health 

information to others so as to protect particular persons is not 

within the ambit of the public interest in public health. The Court 

of Appeals of New York, the highest court in the State of New 

York, handed down a decision that can illuminate the 

interpretation of this aspect of Thai law. 

In the United States, ‘the Health Insurance Portability 

and Accountability Act of 1996 (HIPAA) 123  required the 

Secretary of Health and Human Services to issue rules 

improving privacy protections.’124 The Secretary of Health and 

Human Services then issued federal privacy regulations (the 

‘Privacy Rule’) 125  to maintain the confidentiality of defined 

 
120 NAT’L ASSEMBLY OF THAI. SELECT PARLIAMENTARY COMM., supra note 

118, at 22. 
121 Official Information Act, B.E. 2540 § 24 (1997) (Thai.). 
122 Personal Data Protection Act, B.E. 2562 § 26(5)(b) (2019) (Thai.). 
123 Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 

104–191, 110 Stat. 1936 (1996). 
124 HALL, BOBINSKI & ORENTLICHER, supra note 4, at 172. 
125 45 C.F.R. §§ 160 & 164. 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

152 

types of protected health information, subject to some 

exceptions.126 The Privacy Rule has been an attempt to establish 

a comprehensive set of rules governing the confidentiality of 

medical records and relevant individually identifiable health 

information. 127  Generally speaking, the Privacy Rule forbids 

disclosure of health information without patient authorization. It 

preempts conflicting state laws unless those state laws are more 

stringent.128 In the Matter of Miguel M v. Barron, a case where 

the Privacy Rule was the applicable law, the Court of Appeals of 

New York  held, “apparent purpose of the public health 

exception [to the Privacy Rule] is to facilitate government 

activities that protect large numbers of people from epidemics, 

environmental hazards, and the like, or that advance public 

health by accumulating valuable statistical information. To 

disclose private information about particular people, for the 

purpose of preventing those people from harming themselves or 

others, effects a very substantial invasion of privacy without the 

sort of generalized public benefit that would come from, for 

example, tracing the course of an infectious disease.” 129  The 

author of this article agrees with that decision’s interpretation 

and proposes applying it to the Thai equivalent provision. To 

construe the “public health” exception as including disclosure of 

the health or genetic data to third parties would be a stretch and 

indefensible. 

Another provision closely related to the issue of 

disclosure to third parties without patient consent is Section 

26(5)(a). It provides for another situation in which health and 

genetic data can be collected, used, or disclosed to third parties 

if “it is necessary for compliance with a law to achieve the 

purposes with respect to preventive medicine or occupational 

medicine, the assessment of working capacity of the employee, 

medical diagnosis, the provision of health or social care, 

medical treatment, the management of health or social care 

systems and services.”130 (Emphasis added.) One may argue that 

proper medical diagnosis and treatment as well as the provision 

of health or social care compel doctors to disclose the patients’ 

health or genetic data to third parties even if patients refuse to 

 
126 HALL, BOBINSKI & ORENTLICHER, supra note 4, at 172. 
127 CORTEZ ET AL, supra note 96, at 209; See generally Jeremy Shapiro-Barr, 

The GDPR’s Impact in the U.S.: Considerations for the U.S. Health Lawyer, 

12 J. OF HEALTH AND LIFE SCI. L. 39 (2018) (comparison between HIPAA and 

the GDPR). 
128 In the Matter of Miguel M v. Barron, 950 N.E.2d 107, 110 (N.Y., 2011). 
129 Id. at 111. 
130 Personal Data Protection Act, B.E. 2562 § 26(5)(a) (2019) (Thai.). 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

153 

give consent. The problem with that argument is it cannot be said 

that such disclosure is necessary for complying with a law. 

Except for the duty concerning notifiable diseases or child abuse, 

no other Thai law imposes a duty of such disclosure on 

physicians.131 The Mental Health Act merely permits disclosure 

of health information of patients suffering from mental 

disorder(s) to protect third parties132; it does not obligate the 

doctor to disclose the information. This Section is a direct 

derivation from the GDPR, evidenced by the near word-for-word 

translation of the equivalent GDPR provision into Thai. 

However, upon the passage in Thailand, the provision was 

framed differently from the original GDPR provision. The direct 

result was that doctors were not permitted to disclose health data 

to third parties for the sake of public interest in others’ safety and 

welfare as discussed in this article. 

To illustrate, Article 9 paragraph 1 of the GDPR 

prohibits the processing of genetic data and data concerning 

health.133 However, paragraph 2 (h) sets out a permitted situation 

in which the processing 134  of such data is necessary for the 

purposes of preventive or occupational medicine, for the 

assessment of the working capacity of the employee, medical 

diagnosis, the provision of health or social care or treatment or 

the management of health or social care systems and services on 

the basis of Union or Member State law or pursuant to contract 

with a health professional and subject to the conditions and 

safeguards referred to in paragraph 3.135 This provision, from 

which the Thai equivalent is derived, merely lays down the 

permitted situation in which the physician, as a professional 

subject to the obligation of professional secrecy for the purposes 

 
131 Sathirareuangchai, supra note 1, at 80. 
132 Mental Health Act, B.E. 2551 § 16 (2008) (Thai.) (No person shall disclose 

health information of a patient in such a way that is likely to cause damage to 

the patient, except: (1) in a case where harm may be caused to the patient or 

to others; (2) for the safety of the public…). 
133 Regulation 2016/679, of the European Parliament and of the Council of 27 

April 2016 on the protection of natural persons with regard to the processing 

of personal data and on the free movement of such data, and repealing 

Directive 95/46/EC, 2016 O.J. (L 119) art. 9 para. 1. 
134 Id. at art. 4 para. 2 (processing includes use and disclosure by transmission, 

dissemination or otherwise making available.). 
135 Id. at art. 9 paras. 2, 3. (Personal data referred to in paragraph 1 may be 

processed for the purposes referred to in point (h) of paragraph 2 when those 

data are processed by or under the responsibility of a professional subject to 

the obligation of professional secrecy under Union or Member State law or 

rules established by national competent bodies or by another person also 

subject to an obligation of secrecy under Union or Member State law or rules 

established by national competent bodies.). 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

154 

of paragraph 3’s conditions and safeguards, may disclose the 

genetic data or data concerning health to third parties on the basis 

of Union or Member State law. On the contrary, Section 26(5)(a) 

of the Thai Personal Data Protection Act is framed in a 

problematic way. The permitted situation under that Section is: 

‘it is necessary for compliance with a law to achieve the 

purposes with respect to ….’136 No Thai laws necessitate doctors 

disclosing patients’ health information to third parties except as 

to notifiable diseases or child abuse.137 It is likely that, even 

when the Act comes into force next year, doctors in Thailand 

will not be able to disclose health or genetic data to third parties 

in the public interest without the explicit consent from the data 

subject under Section 26(5)(a) of the Personal Data Protection 

Act. 

In sum, it is doubtful that the Personal Data Protection 

Act will successfully offer Thai physicians safe harbor when 

disclosing patient data to third parties for the reasons the article 

has discussed. The article next proposes the resolution of the 

matters. 

  

VI. PROPOSALS TO AMEND THE LAWS AND DEVELOP 

GUIDELINES 

 

This article proposes amendments to the National Health 

Act and the MOPH’s Regulation. The last sentence of Section 7 

of the National Health Act stating: “In any case whatsoever, no 

person shall have the power or right under the law on official 

information or other laws to request a document related to 

personal health information of any person other than himself or 

herself” should be jettisoned to eliminate the inconsistency with 

other Acts as described above. Likewise, the last sentence of 

Article 13 of the MOPH’s Regulation on the Protection and 

Management of Personal Health Data, B.E. 2561 (2018) stating: 

‘In any event, the disclosure must not cause damage to the data 

subject.’ should be omitted to eliminate confusion about whether 

disclosure of health data to third parties without consent or with 

explicit refusal from the patient is permitted. 

These amendments will eliminate confusion arising from 

the conflicts with other legislation. The duty to warn third 

parties, however, should accord with professional guidance. A 

scarcity of such professional guidance in Thailand troubles and 

demands doctors to exercise discretion and professional 

 
136 Personal Data Protection Act, B.E. 2562 § 26(5)(a) (2019) (Thai.). 
137 Sathirareuangchai, supra note 1, at 80. 



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

155 

judgement at their own risk. Furthermore, contradicting internal 

policies of different institutions created an inconsistent health 

data protection regime in Thailand that is difficult for doctors to 

implement thoughtfully with appropriate good judgement. The 

criteria, conditions, and relevant factors that justifies disclosure 

should be incorporated into the guidelines. In the United 

Kingdom, for instance, the General Medical Council (GMC) has 

issued guidance for doctors entitled ‘Confidentiality: good 

practice in handling patient information.’138 It has been regularly 

updated, the latest of which was on 25 May 2018 to reflect the 

requirements of the GDPR and the UK’s Data Protection Act 

2018. 139  It sets out the “framework for considering when to 

disclose patients’ personal information and then applies that 

framework to: a disclosure to support the direct care of an 

individual patient, b disclosures for the protection of patients and 

others, and c disclosures for all other purposes.”140 The Medical 

Council of Thailand (TMC) should adopt the practice of issuing 

clear guidelines for doctors on this matter to avoid the onerous 

task of developing clear and detailed guidelines whenever a 

novel situation arises.  

Developed by the Australian NHMRC, guidelines on use 

and disclosure of genetic information to a patient’s genetic 

relatives has been criticized for its inclusion of psychological 

harm of the patient’s relatives as a condition justifying disclosure 

without consent.141 Additionally, there is uncertainty about the 

extent to which Australian health care professionals in general 

will adopt such NHMRC guidelines since only those in private 

practice are legally bound by the guidelines.142 “The Australian 

Privacy Principles (APPs) do not apply to State and Territory 

public hospitals, other public agencies and prescribed 

instrumentalities, as they do not fall within the definition of 

‘organisation’ in the Privacy Act 1988 (Cth).”143 The latter issue 

will not occur in Thailand, as the TMC has the authority to issue 

guidelines governing all physicians practicing in Thailand, 

whether public or private. The TMC should issue guidelines 

concerning psychological harm and may consult the Royal 

Colleges of Physicians and Psychiatrists of Thailand when it 

establishes a working group on developing detailed guidelines. 

 
138 GEN. MED. COUNCIL, CONFIDENTIALITY: GOOD PRACTICE IN HANDLING 

PATIENT INFORMATION (2017). 
139 Id. at 1. 
140 Id. at 8.  
141 McWhirter, Johnston & Burke, supra note 72, at 114–8. 
142 Id. at 114. 
143 WHITE, MCDONALD & WILLMOTT, supra note 6, at 413. 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

156 

Thai authorities should also refer to other countries’ experiences 

concerning disclosure to third parties in general. Moreover, 

providing doctors with relevant guidelines on disclosing health 

information to third parties will convey a message to Thai 

doctors that the duty of confidentiality to the patient is not 

absolute. Contrary to that message, certain existing literature on 

medical litigation in Thailand warns against any disclosure of 

patients’ health information to third parties.144 Some claim that 

doctors who disclose patients’ health information put themselves 

at risk of violating Section 323 of the Thai Criminal Code.145 

This misconception underlines the need for clear guidance from 

the TMC. These guidelines should be applied flexibly and 

pragmatically under the relevant circumstances.  

Even though the Personal Data Protection Act has yet to 

come into force for the matter discussed, its relevant provision is 

problematic. Section 26(5)(a), which outlines a situation in 

which health and genetic data can be used or disclosed to third 

parties if “it is necessary for compliance with a law to achieve 

the purposes with respect to preventive medicine or occupational 

medicine…medical diagnosis… medical treatment…”, should 

be amended to add professional guidelines as a source of 

authority the doctor can invoke to disclose data. Currently, no 

law other than those on child abuse or notifiable diseases 

obligate the doctor to disclose genetic or health data to third 

parties. To illustrate, the provision can be rewritten as “if it is 

necessary for compliance with a law or relevant professional 

guidelines established by national professional bodies to 

achieve the purposes of…” Needless to say, even if the provision 

is rewritten, it would still be necessary to amend the other 

discussed provisions. The Personal Data Protection Act is an 

addition to the existing Thai data protection legislation; it sets a 

minimum standard of personal data protection.146 Hence, if other 

 
144  PRATEEP AOWWICHITKUN, ฟอ้งแพทย ์ [SUING THE DOCTOR] 201 (4th ed. 

2019). 
145 Criminal Code, § 323 (amended in 2017) (Thai.) (Whoever, knows or 

acquires a private secret of another person by reason of his functions as a 

competent official  or his profession as a medical practitioner, pharmacist, 

druggist, midwife, nurse, priest, advocate, lawyer or auditor, or by reason of 

being an assistant in such professions, and then discloses such private secret 

in a manner likely to cause injury to any person, shall be punished with 

imprisonment not exceeding six months or fined not exceeding ten thousand 

baht, or both.) 
146 Personal Data Protection Act, B.E. 2562 § 3 (2019) (Thai.) (In the event 

that there is any sector-specific law governing the protection of Personal Data 

in any manner, any business or any entity, the provisions of such law shall 

apply, except:  



2021] COLUMBIA JOURNAL OF ASIAN LAW 

 

157 

legislations are not amended as suggested, inconsistencies 

among various laws would still be a problem since those laws’ 

standards of data protection are higher than that of the Personal 

Data Protection Act and are thus arguably still intact and not 

modified by the Personal Data Protection Act. This may result 

in a strict prohibition on health and genetic data disclosure to 

third parties, regardless of the circumstance.    

 

VII. CONCLUSION 

 

The right to personal data is currently enshrined in the 

Constitution of Thailand.  This fact, on the one hand, reflects the 

importance of personal data protection, to the point of 

recognition in the supreme law of the land. On the other hand, it 

may cause Thai physicians concern and even misconception 

regarding the disclosure of the patients’ personal health data to 

third parties. 

The Australian Government’s Department of Health and 

Ageing once stated: “The co-existence of Commonwealth, state 

and territory health information privacy legislation has created a 

significant burden on [private sector] health care services in 

understanding and meeting respective obligations, as well as 

confusion for health consumers affected by dual legislative 

instruments.”147 Even though Thailand is a unitary state in which 

legislative acts govern throughout, that statement is equally 

suited to the current situation. The inconsistencies either within 

 
(1) for the provisions with respect to the collection, use, or disclosure 

of Personal Data and the provisions with respect to the rights of data subjects 

including relevant penalties, the provisions of this Act shall apply 

additionally, regardless of whether they are repetitious with the above specific 

law;  

(2) for the provisions with respect to complaints, provisions granting 

power to the expert committee to issue an order to protect the data subject, 

and provisions with respect to the power and duties   of the Competent 

Official, including relevant penalties, the provisions of this Act shall apply in 

the following circumstances: 

(a) in the event that such law has no provision with respect to 

complaints; 

(b) in the event that such law has the provisions giving the power to 

the competent official, who has the power to consider the complaints under 

such law, to issue an order to protect the data subject, but such power is not 

equal to the power of the expert committee under this Act; and either the 

competent official who has power under such law makes a request to the 

expert committee, or data subject files a complaint with the expert committee 

under this Act, as the case may be.). 
147  AUSTRALIAN LAW REFORM COMMISSION, VOL. 3 REPORT 108, 

AUSTRALIAN PRIVACY LAW AND PRACTICE 323 para. 60.20 (2008). 



 PROTECT THE PUBLIC [Vol. 34: 128 

 

158 

the same piece of legislation or with other laws governing the 

same matter of health data protection have engendered confusion 

and worry to physicians. Particularly, disclosure of patients’ 

health data to protect others, including genetic relatives is the 

primary focus of this article. 

This article has argued in favor of amendments to 

existing laws to eliminate such contradictions. The new Personal 

Data Protection Act also needs modifications to clarify potential 

civil and criminal liability for physicians. Furthermore, the 

article urges the Medical Council (TMC) to develop guidelines 

on the disclosure of such data to third parties. Those guidelines 

should be incorporated into the conditions for disclosure under 

the Personal Data Protection Act’s regime.