Communicable Diseases Act, B.E. 2558 (2015) · Disclosure of information

Notification of the National Communicable Disease Committee Re: Disclosure of Information under the Communicable Disease Act, B.E. 2558 (2015), B.E. 2565 (2022)

Published in the Government Gazette 27 October B.E. 2565 (2022); in force from 28 October B.E. 2565 (2022)

Whereas it is expedient to prescribe criteria, methods, and conditions for the disclosure of information that refers to individuals concerning the treatment, prevention, and control of dangerous communicable diseases or the occurrence of epidemics, which affect public health.

By virtue of Section 10, paragraph two, of the Communicable Disease Act, B.E. 2558 (2015), the National Communicable Disease Committee hereby issues the following Notification:

Clause 1. This Notification is called “Notification of the National Communicable Disease Committee Re: Disclosure of Information under the Communicable Disease Act, B.E. 2558 (2015), B.E. 2565 (2022)”

Clause 2. This Notification shall come into force on the day following the date of its publication in the Government Gazette.

Clause 3. In this Notification:

"Data Subject" means a natural person, a group of persons, or a legal entity.

"Data" means Information that refers to individuals, whether identifiable or unidentifiable, pertaining to the treatment, prevention, or control of dangerous communicable diseases or the occurrence of epidemics affecting public health. This data is obtained from surveillance, disease investigation, or notifications or reports under the Communicable Diseases Act B.E. 2558 (2015), such as name, address, sex, nationality, education, health history, or work history, bearing the name of the data subject or having a number, code, or other distinguishing characteristic that identifies the data subject.

Clause 4. The Communicable Disease Control Officer may disclose data in any of the following cases:

(1) Where consent has been obtained from the data subject.

(2) Where disclosure of data is permissible without consent, as stipulated in Clause 10.

Clause 5. For the disclosure of data under Section 4 (1), The Communicable Disease Control Officer must obtain consent from the data subject beforehand. The request for consent under the first paragraph must be made explicitly in writing or through an electronic system. However, if the nature of the situation prevents obtaining consent through such methods, The Communicable Disease Control Officer may request consent verbally or through other forms of communication. In all cases, the request for consent must clearly state the purpose of the data disclosure, use easily understandable language, and not be deceptive or mislead the data subject regarding the stated purpose. A data subject may withdraw their consent at any time. The withdrawal of consent must be as easy as giving it, unless there are legal or contractual limitations on the right to withdraw consent that benefit the data subject. The withdrawal of consent does not affect data disclosure that was legitimately consented to by the data subject prior to the withdrawal. If the withdrawal of consent impacts the data subject in any way, The Communicable Disease Control Officer must inform the data subject of the consequences of such withdrawal.

Clause 6. If consent is obtained verbally or through other forms of communication as per Clause 5, and the data subject requests confirmation of such consent within fifteen days from the date consent was given, The Communicable Disease Control Officer must provide written confirmation to the data subject.

Clause 7. If The Communicable Disease Control Officer requests consent from the data subject in writing under Clause 5 or confirms a request in writing under Clause 6, such written document must include at least the following:

(1) The date (day, month, and year) the request is made.

(2) The data to be disclosed and the method of data disclosure.

(3) The purpose of the data disclosure.

(4) The legal provisions relied upon.

(5) The name and signature of the Communicable Disease Control Officer making the request.

Clause 8. When the data subject is a minor who has not attained legal majority through marriage or is not deemed to have attained legal majority under the Civil and Commercial Code, consent must be obtained from the person exercising parental power who is authorized to act on behalf of the minor. When the data subject is a person of unsound mind, consent must be obtained from the guardian who is authorized to act on behalf of the person of unsound mind. When the data subject is a quasi-incapacitated person, consent must be obtained from the curator who is authorized to act on behalf of the quasi-incapacitated person.

Clause 9. In cases where a minor has no person exercising parental power authorized to act on their behalf, or a person of unsound mind has no guardian authorized to act on their behalf, or a quasi-incapacitated person has no curator authorized to act on their behalf, or where such person exercising parental power, guardian, or curator is unable to perform their duties for any reason, or where the data subject has passed away and has not otherwise stipulated in a will, any of the following individuals shall have the right to provide consent on their behalf: Adult descendants, Spouse, Parents, Full siblings or half-siblings, Paternal or maternal grandparents, Uncles or aunts, Administrative official.

Clause 10. The Communicable Disease Control Officer may disclose data without obtaining consent from the data subject in any of the following cases:

(1) Disclosure to a government agency or state officer based on the provisions of specific law for the purpose of maintaining state security or maintaining public order or good morals.

(2) Disclosure to a state officer for the purpose of preventing the violation of or non-compliance with communicable diseases law.

(3) Disclosure for public benefit in the surveillance, prevention, and control of communicable diseases or epidemics.

(4) Disclosure to prevent or suppress serious harm to the life, body, or health of the public.

(5) Disclosure due to urgent necessity, where delay would cause or could cause damage to the life or body of the public, or cause or could cause damage to public safety or public interest.

Clause 11. The Director General of the Department of Disease Control shall be responsible for the execution of this Notification. In the event of any implementation issues, the Director General shall have the final decision, and such decision shall be deemed final.

Announced on the 10th Day of October, B.E. 2565 (2022)

Anutin Charnvirakul

Minister of Public Health

The Chairperson of the National Communicable Disease Committee Rule of the National Communicable Disease

Committee

Unofficial English translation by the Division of Legal Affairs, Department of Disease Control (August 2025), book page 229; the Thai text prevails.