FOURTEENTH CONGRESS OF THE 
) 
REPUBLIC OF THE PHILIPPINES 
) 
First Regular Session 
1 
S E N A T E  
S.No. 
- 1180 
INTRODUCED BY THE HONORABLE MAR ROXAS 
EXPLANATORY NOTE 
This bill seeks to establish fair practices in the collection, recording, organization, 
storage, updating or modification, retrieval, consultation, use, consolidation, dissemination 
by any means, merging, linking, blocking, erasure or destruction of personal data of natural 
persons and to penalize the unauthorized processing and disclosure thereof. 
Privacy is a fundamental human right recognized in all major international treaties 
and agreements on human rights. This is recognized in the present millennium of advanced 
information technology, growing trend towards the enactment of comprehensive privacy 
and data protection laws to address past governmental abuses on the privacy of identity, 
communication, and correspondence; promote e-commerce; and ensure compatibility with 
international standards. 
It started in Sweden in 1973 with the enactment of a law which regulates the 
establishment and use, in both public and private sectors, of automated data files on physical 
and natural persons. In 1985, the Convention for the Protection of Individuals with Regard 
to Automatic Processing of Personal Data drawn up within the Council of Europe entered 
into force, which obligates the signatories to enact legislation concerning the automatic 
processing of personal data, which many of the member States of the Council of Europe 
subsequently did. In 1990, the United Nations promulgated the Guidelines Concerning 
Computerized Personal Data Files which provided for the procedures in implementing 
regulations concerning computerized personal data files. In 1995, the European Union (EU) 
passed a Directive on the Protection of Individuals With Regard to the Processing of 
Personal Data and on the Free Movement of Such Data. 
In the Philippines, there is no special law that specifically addresses the protection of 
personal data. But the right to privacy is recognized and enshrined in several provisions of 
the Philippine Constitution, particularly in the different sections of the Bill of Rights. Zones 
of privacy are likewise recognized and protected in Philippine laws, particularly in civil, 
criminal and remedial law. The Civil Code holds a public officer or employee or any private 
individual liable for damages for any violation of the rights and liberties of another person, 
and recognizes the privacy of letters and other private communications. In criminal law, the 
Revised Penal Code makes a crime the violation of secrets by an officer, the revelation of 
trade and industrial secrets, and trespass to dwelling. 


Invasion of privacy is an offense in special laws like the Anti-Wiretapping Law, the 
Secrecy of Bank Deposits Act, and the Intellectual Property Code. The Rules of Court on 
privileged communication likewise recognize the privacy of certain information. Despite the 
existence of constitutional guarantees and the existence of laws upholding the right to 
privacy of our citizens, the increasing sophistication of Despite 'the existence of 
constitutional guarantees and the existence of laws upholding the right to privacy of our 
citizens, the increasing sophistication of information technology with i t s capacity to collect, 
analyze and disseminate information on individuals has introduced a sense of urgency in the 
demand for relevant legislation. Furthermore, new developments in medical research and 
care, telecommunications, advanced transportation systems, and financial transfers have 
dramatically increased the level of information generated by each individual. Computers 
linked together by high-speed networks with advanced processing systems can create 
comprehensive dossiers on any person without the need for a single central computer 
system. 
The expression of the protection of personal data may vary in various declarations and 
laws but all require that personal information must be obtained fairly and lawfully; used only 
for the original purpose specified; adequate, relevant and not excessive to the purpose; 
accurate and up to date; and destroyed after its purpose is completed. This proposed measure 
complies with the aforementioned requirements and addresses the need for legislation to 
protect personal data. 
This bill stipulates that personal data must be set up only for a specified purpose that 
is relevant to the interests of the party and must be obtained legitimately and in accordance 
with the purpose for which the file was set up. The party controlling the data has a duty to 
make appropriate measures to ensure that the data processed is complete and accurate, its use 
is compatible with the purpose of the data file, and is not disclosed to unauthorized persons. 
Under this measure, a person shall have the right to unimpeded access to his or her personal 
records and act accordingly on the same. 
This bill likewise penalizes the following acts: 1) processing of personal data without 
the consent of, and despite the opposition of, the data subject, or without being authorized 
under any existing law or this Act to do so; 2) the processing of personal data for purposes 
not authorized by the data subject, or otherwise prohibited under the existing laws or this 
Act; 3) the malicious reporting of any person ofa personal data obtained by him or her from 
a data controller or transferred to him or her unknowingly; and, 4)the breach of 
confidentiality when the information has been published or reported by media. 
In view of the foregoing, the immediate enactment of this measure is earnestly 
sought. 


1 
FOURTEENTH CONGRESS OF THE 
) 
REPUBLIC OF THE PHILIPPINES 
) 
First Regular Session 
1 
S. No. 
. I180 
INTRODUCED BY THE HONORABLE MAR R O U S  
AN ACT 
TO ESTABLISH FAIR PRACTICES IN THE PROCESSING 
OF INFORMATION RELATING OR PERSONAL TO INDIVIDUALS, 
CREATING FOR THE PURPOSE A PERSONAL DATA PROTECTION COMMISSION, 
AND FOR OTHER PURPOSES 
Be it enacted by the Senate and the House of Representatives in Congress assembled: 
SECTION 
1. Title. - This Act shall be known as- the “Data Protection Act of 2005.” 
SEC. 2. Declaration of Policy - It is hereby declared the policy of the state to protect 
the fundamental human rights and freedoms of natural persons, in particular the inviolability 
of private life with respect to the processing of data and to regulate the processing of personal 
data to ensure that all transactions related thereto are conducted in an efficient and 
responsible manner. 
Any doubt in the interpretation of any provision of this Act shall be interpreted in 
favor of the rights and interests of the individual whose private information is being 
processed. 
10 
11 
SEC. 3. Definition of Terms. - Whenever used in this Act, the following terms shall 
have the respective meanings hereafter set forth, unless the context requires otherwise: 
- 1 -  


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
1. “Data” means information which a) is being processed by means of equipment 
operating automatically in response to instructions given for that purpose; b) is 
recorded with the intention that it should be processed by means of such 
equipment; and c) is recorded as part of a relevant filing system or with the 
intention that is should form part of a relevant filing system; 
2. “Personal data” means any information relating to an identified or identifiable 
data subject which can be linked by a data controller or a third person 
belonging to a specific data subject; 
3. “Data subject” means a natural person who may directly or indirectly be 
referred to in a data processing system, and is identified with particularity in 
the said system for his or her physical, physiological, mental, economic, 
cultural or social identity, among others; 
4. “Data controller” means a natural or juridical person, public authority, agency 
or any other body duly authorized by law who is qualified and competent to 
process the personal data pertaining to a data subject, and duly registered with 
the National Data Protection Commission; 
5. “Data processor” means any natural or juridical person qualified to act as such 
under this Act to whom a data controller may outsource the processing of 
personal data pertaining to a data subject; 
6. “Processing” shall mean any operation or any set of operations concerning 
personal data, including, but not limited to, the collection, recording, 
organization, storage, updating or modification, retrieval, consultation, use, 
consolidation, blocking, erasure, or destruction of data; 
7. “Filing system” means any set of information relating to natural or juridical 
persons to the extent that, although the information is not processed by means 
- 2 -  


1 
2 
3 
4 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
of equipment operating automatically in response to instructions given for that 
‘purpose, the set is structured, either by reference to individuals or by 
reference to criteria relating to individuals, in such a way that specific 
information relating to a particular person is readily accessible; 
8. “Sensitive personal data” means personal data which is likely to give rise to 
unlawful or arbitrary discrimination, which includes, but is not limited to, 
data which indicate the race, ethnic origin, religious, philosophical or political 
affiliations and financial, transactions, or which provide information as to the 
health or sexual life of a person, or any proceeding for any offense committed 
or alleged to have been committed by such person, the disposal of such 
proceedings, or the sentence of any court in such proceedings; 
9. “Consent of the data subject” means any freely given, specific and informed 
expression of will, either in written or electronic form executed personally and 
voluntarily by the data subject, whereby the data subject agrees to the 
processing of personal data about and/or relating to him or her: 
10. “Commission” shall refer to the National Data Protection Commission created 
by virtue of this Act. 
18 
19 
20 
21 
22 
SEC. 4. Scope - This Act applies to the processing of all types of personal data, and to 
any natural and juridical person involved in personal data processing. This Act does not 
apply to the information ‘systems made by natural persons in which personal data are 
processed for personal or household and family purposes and in which the personal data 
collected are not disclosed to other persons. 
- 3 -  


1 
2 
3 
law. 
SEC. 5. Exceptions - Sections 7 , 8  and 13 of this Act shall not apply if personal data are 
processed for journalistic, artistic or Literary purposes, and it is not otherwise prohibited by 
CHAPTER 11. THE NATIONAL DATA PROTECTION COMMISSION 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
SEC. 6. Functions of the National Data Protection Commission - To administer and 
implement the provisions of this Act and monitor the compliance of the country with 
international standards set for data protection, there is hereby created an independent body 
to be known as the National Data Protection Commission, which shall have the following 
functions: 
1. ensure compliance of 'data controllers' and data processors with the provisions 
of this Act; 
2. receive complaints, institute investigations, adjudicate, or award indemnity on 
matters affecting any personal data. For this purpose, the Commission may be 
given access to personal data subject of any complaint and to collect the 
information necessary to adjudicate or award indemnity on matters affecting 
, .  
any personal data; 
3. issue cease and desist orders, impose a temporary or permanent ban on the 
processing of personal data, upon finding that the processing will be 
detrimental to national security and public interest; 
4. examine applications for grants of authority to implement a personal data 
. ,  
processing system and register personal data processing systems; 
- 4 -  


I 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
5. oversee and monitor the processing of personal data to prevent any breach in 
the protection of the same and ensure that the rights of the data subject are 
upheld at all times; 
6. coordinate with other government agencies and the private sector on efforts to 
formulate and implement plans and policies to strengthen the protection of 
personal data in the country. 
SEC. 7. Organizational Structure of the Commission - The Commission shall be 
attached to the Office of the President and shall be headed by an Executive Director and to 
be assisted by two (2) Deputy Directors, one to be responsible for Data Processing Systems 
and one to be responsible for Policies and Planning. The Executive Director and the two (2) 
Deputy Directors shall be appointed by the President of the Philippines for a term of three 
(3) years. 
The Executive Director must be a member of the Philippine Bar, at least thirty-five 
(35) years of age and of good moral character, unquestionable integrity and known probity. 
The Executive Director shall enjoy the benefits, privileges and emoluments equivalent to the 
rank of Undersecretary. 
The Deputy Directors must be recognized experts in the field of data processing and 
intellectual property. They shall enjoy the benefits, privileges and emoluments equivalent to 
the rank of Assistant Secretary. 
20 
SEC. 8. The Secretariat - The Commission is hereby authorized to establish a 
Secretariat. Majority of the members of the Secretariat must have served for at least five (5) 
years in any agency of the government that is involved in the processing of personal data, 
including, but not limited to the following offices: National Statistical Office (NSO), 
21 
22 
23 
- 5 -  


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
Government Service Insurance System (GSIS), Land Transportation Office ( LTO), Bureau of 
Internal Revenue (BIR), Philippine Health Insurance Corporation (PhilHealth), Commission 
on Elections (Comelec), Department of Foreign Affairs (DFA), Department of Justice, and 
Philippine Postal Corporation (PhilPost). 
CHAPTER m .  PROCESSING OF PERSONAL DATA 
SEC. 9. General principles of data processing - Personal data shall not be processed at 
all, except when certain conditions are met. The processing of personal data, if allowed, shall 
adhere to the principles of transparency, legitimate purpose and proportionality. 
1. Personal data must be: 
a. collected for specified and legitimate purposes determined and declared 
before collecting personal data and later processed in a way compatible 
with such declared, specified and legitimate purposes; 
b. processed accurately, precisely, fairly and lawfully; 
c. accurate, relevant, and, where necessary for the processing of personal 
data, kept up to date; inaccurate or incomplete data must be rectified, 
supplemented, destroyed or their further processing must be restricted; 
d. consistent, adequate and not excessive in relation to the purposes for 
which they are collected and processed; 
e. kept within a period not exceeding the time within which the purposes 
for which the data was obtained would be achieved; and 
kept in a form which permits identification of data subjects for no 
longer than is necessary for the purposes for which the data were 
collected and processed; Provided, that personal data collected for other 
purposes may be processed for historical, statistical or scientific 
f. 
- 6 -  
1 
-. 


6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
purposes and in cases laid down in law may be stored for longer 
periods; Provided, further, that adequate safeguards are guaranteed by 
said laws authorizing their processing. 
2. The controller must ensure implementation of personal data processing 
principles set out in paragraphs 1 and 2 of this section. 
SEC. 10. Criteria for lawfulprocessing ofpersonal data - The processing of personal 
data shall be permitted only if not otherwise prohibited by law, and at least one of the 
following conditions exist: 
1. the data subject has given his or her unambiguous consent; 
2. the personal data is necessary and is a legal consequence of a contractual 
obligation of the data subject: 
3. the processing is necessary to protect vitally important interests of the data 
subject, including life and health; or 
4. the processing is necessary in order to respond to national emergency, to 
comply with the requirements of public order and safety, or to fulfill functions 
of public authority which necessarily includes the processing of personal data 
for the fulfillment of its mandate. 
18 
19 
20 
sEC.11. Sensitive data- The processing of sensitive personal data shall be prohibited, 
except in the following cases: 
1. the data subject has given his or her consent prior to the processing; 
2. the processing of the same is 'provided for by existing laws and regulations: 
Provided, that such regulatory enactments guarantee the protection of the 
sensitive personal data: Provided, .furher, that the consent of the data subject 
21 
22 
23 
- I -  


1 
is not required by the law, or regulation permitting the processing of :sensitive 
2 
personal data; 
3 
3. the processing is necessary :to protect the life and health of the data subject or 
4 
another person, and the data subject is not legally or physically able to express 
5 
his or her consent prior to the processing; 
6 
4. processing is necessary to achieve the lawful, non-commercial objectives of 
7 
public organizations and their associations: Provided, such processing is only 
8 
confined and related to the bonafide members of these organizations or their 
9 
10 
associations: Provided, further, that the sensitive personal data are not 
transferred to third parties: Provided, finally, that consent of'the data subject 
11 
12 
was obtained prior to processing; 
5. the processing is necessary for the purposes of medical treatment, is carried out 
by a medical practitioner or a medical treatment institution, and an adequate 
level of protection of personal data is ensured; or 
13 
14 
15 
6. the processing concerns such personal data as is necessary for the protection of 
lawful rights and interests of natural or legal persons in court proceedings: 
16 
17 
Provided, that in all cases, the data controller is duly authorized by the Commission 
18 
to engage in the processing of sensitive personal data. 
19 
SEC. 12. Data controller - Any person, natural or juridical, may be granted the 
authority to act as a data controller by the Commission upon application and examination, 
taking into consideration the impartiality, independence and technical competence ofthe 
20 
21 
22 
applicant. 


SEC. 13. Data processoi- A data controller may subcontract the processing of personal 
data to a personal data processor: Provided, that prior to the commencement of any contract, 
the data processor has been duly qualified to act as such by and is registered with the 
Commission: Provided, further, that the data controller shall retain primary control over the 
personal data processed by the data processor; and Promded, finally, that the data controller 
shall be responsible for ensuring that proper safeguards are in place to ensure the 
confidentiality of the personal data processed, guarantee its non-transferability to 
unauthorized persons, and prevent its use for unauthorized purposes. 
9 
10 
11 
SEC. 14. Storage of data- Personal data shall be stored and used only for as long as it is 
necessary to achieve the purpose for which it was processed, after which the personal data 
shall be deleted or blocked from a personal database, unless otherwise provided by law. 
CHAPTER IV. RIGHTS OF THE DATA SUBJECT 
12 
13 
14 
15 
16 
17 
18 
19 
SEC. 15. Rights of the data subject- The data subject is entitled to: 
1. be informed whether personal data pertaining to him or her shall be, are 
being, or have been processed; 
2. before the entry of his or her personal data into the processing system of the 
data controller, be furnished the following: 
a. description of the personal data to be entered into the system; 
b. purposes for which they are being or are to be processed; 
c. scope and method of the personal data processing: 
- 9 -  


8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
d. recipients or classes of recipients to whom they are or may be disclosed; 
and 
e. methods utilized for automated access, if the same is allowed by the 
data subject, and the extent to which such access is authorized. 
Any information supplied or declarations made to the data subject on 
these matters shall not be amended without prior notification of data subject. 
3. be given access to, upon demand, the following: 
a. contents of hisher personal data that were processed; 
b. source from which personal data were obtained; 
c. names and addresses of recipients of the personal data; 
d. manner by which such data were processed; 
e. reasons for the disclosure of the personal data to recipients; 
f. information on the decision-making involved in selecting the manner 
by which personal data shall or will be disclosed on data that will or is 
likely to be made as the sole basis for any decision significantly 
affecting or will affect a data subject; 
g. date when his or her personal data concerning the data subject were 
last accessed and modified. 
4. dispute the inaccuracy of erroneous personal data and have the data controller 
correct it immediately and accordingly. If the personal data has been 
corrected, the data controller shall ensure the accessibility of both the new and 
the retracted information and the simultaneous receipt of the new and the 
retracted information by recipients thereof; 
5. suspend, withdraw or order the blocking, removal or destruction of his or her 
personal data from the data controller’s filing system upon discovery and 
- 10- 


8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
substantial proof that the personal data are incomplete, outdated, false, 
unlawfully obtained, used for unauthorized purposes, or are no longer 
necessary for the purposes for which they were collected. In this case, the data 
controller shall rectify the inaccuracy without delay and notify third parties 
who have previously received such processed data. Likewise, the data 
controller shall indemnify the data subject for any damages sustained by the 
latter due to such inaccuracy. 
SEC. 16. Non-appIicabiIity. The preceding section is not applicable if the processed 
data are used only for the needs of scientific and statistical research and, on the basis of such, 
no activities are carried out and no decisions are taken regarding the data subject, Provided, 
that the personal data shall be held under strict confidentiality and shall be used the same 
only for the declared purpose. 
CHAPTER V. REGISTRATION OF PERSONAL DATA PROCESSING SYSTEM 
SEC. 17. Application - Prior to the carrying out or commencing of personal data 
processing or the establishment of a system for personal data processing, a data controller 
shall first submit for the Commission's approval the personal data processing system it seeks 
to implement. For this purpose, the data controller shall submit an application to the 
Commission, which shall contain the following: 
1. A request for the grant of authority to implement a particular personal data 
processing system; 
- 11 - 


1 
2 
3 
4 
5 
6 
I 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
2. Name of the data controller or data processor, date of its registration with the 
Commission, the place where its principal office is located, and the term for 
which it has been authorized by the Commission to act as such; 
3. The legal basis for the operation of the personal data processing system; 
4. The type of personal data to! be included in the system, the purposes for which 
it is intended and the :cope of personal data to be processed; 
5. The categories of data subjects; 
6. The categories of recipients of personal data; 
7. The intended method of personal data processing; 
8. The planned method of obtaining personal data and a mechanism for the 
control of their quality; 
9. Other data processing systems which will be connected with the system to be 
registered 
10. Such other data systems which will be able to obtain data from the system to 
be registered, and what data the system to be registered will be able to obtain 
from connected systems; 
11. The method for transferring data from the system to be registered to another 
system; 
12. The identification codes of natural or juridical persons that will be used by the 
system to be registered; 
13. The method for exchanging information with the data subject; 
14. The procedures whereby a data subject is entitled to obtain information 
concerning himself or herself; 
15. The procedures for supplementing and updating of personal data; 
- 12- 


1 
2 
data; and 
3 
4 
5 
6 
16. Technical and organizational measures to ensure the protection of personal 
17. What personal data will be transferred to other countries or jurisdictions. 
The registration procedure prescribed by this Act is not applicable to the personal 
data processing carried out by institutions specially authorized by law in the areas of public 
safety, law enforcement, national security and defense. 
7 
8 
9 
10 
11 
12 
13 
SEC. 18. Publication ofApplication - After the payment of filing fees and prior to the 
formal review of the application, the Commission shall, at the expense of the applicant, cause 
the publication of the items set out in subparagraph 1 and 2 of the preceding section and the 
notice of the formal review of the application once every week in at least (2) newspapers of 
general circulation for a period of and deadline for submission of comments three (3) 
consecutive weeks. If the required fees for the grant are not paid or the printing is not done 
in due time, the application shall be deemed withdrawn. 
14 
15 
SEC. 19. Following the publication of the application, any person"may submit, in 
writing, his or her comments or opposition on the application. The comment or opposition 
shall be submitted to the Commission at least ten (15) days prior to the scheduled formal 
review of the application. The Commission shall notify the applicant of such comment or 
opposition and the latter may submit its comment or answer within ten (10) days from 
16 
17 
18 
19 
receipt of the notice. 
20 
SEC. 20. The Commission shall conduct the formal review of the application within 
thirty (30) days from the publication of the application and shall approve or deny the 
application within thirty (30) days from the completion of the review. 
21 
22 
-13- 


1 
2 
sEC.21. Amendment OfAppIication - An applicant may amend its application on or 
before the date of review; Provjded, that such amendment shall not include new matters 
outside the scope of the disclosures contained in the application as filed. If new matters are, to 
be included in the amended application, the same shall be treated as a new application and 
the corresponding time periods shall apply. 
3 
4 
5 
6 
7 
8 
9 
sEC.22. Grant ofAuthorjty- If the application meets all the requirements of this Act, 
the Commission shall grant the authority to implement the particular personal data 
processing system subject of the application. The grant to implement a personal data 
processing system shall take effect upon the issuance of certificate of registration. 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
CHAPTER VI. SECURITY OF DATA 
SEC. 23. Security ofData - (1) The data controller and data processor shall implement 
appropriate measures to protect personal data against natural dangers, such as accidental loss 
or destruction and human dangers such as unlawful access, fraudulent misuse, unlawful 
destruction, alteration, and contamination. These measures, specified in a written document 
or its equivalent, must be appropriate to the nature of the data to be protected and the risks 
represented by the processing. 
(2) The employees, agents or representative of the data controller, and data processor, 
and their representatives who are involved in the processing personal data shall operate hold 
personal data under strict confidentiality if these personal data are not intended for public 
disclosure. This obligation shall continue even after leaving the public service, transfer to 
another position or upon termination of employment or contractual relations. 
-14- 


CHAPTER VII. TRANSFER OF PERSONAL DATA 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
SEC. 24. Transfer of Personal Data to Data Recipients in Foreign Jurisdiction - (1) 
Prior to the transfer of, personal data to recipients in foreign jurisdictions, the consent of the 
data subject and the approval of the Commission must first be sought, except in the cases 
referred to in paragraph 3 of this section. 
(2) The Commission shall grant an authorization for transfer of personal data to 
foreign jurisdictions upon, finding and proof, that there is an adequate level of personal data 
protection in such jurisdiction, taking into consideration: a) the existence and 
implementation 'of laws on protection of personal information in the jurisdiction; b) the 
nature of the data and the circumstances by which a data transfer operation may be done in 
such jurisdiction; and c) the purpose of the transfer, the duration of the use for the personal 
data, the respectability of the rights of the data subject provided in this Act in the foreign 
jurisdiction. 
(3) Without the authorization of, the Commission, personal data may, be transferred 
to a foreign jurisdiction or an international law enforcement organization only if: 
a. the transfer of personal data is necessary for the conclusion or performance of 
a contract between the data controller and a third party; 
b. the transfer of personal data is necessary for the performance of a contract 
between the data controller and the data subject or the implementation of pre- 
19 
contractual measures; 
20 
21 
c. the transfer of personal data is necessary or required by a lawful order df a 
competent court of local jurisdiction; 
-15- 


9 
IO 
11 
12 
13 
14 
d. the persona1 data is contained in and is being transferred from a public data 
file in accordance with the procedure prescribed by laws and other rules and 
regulations. 
CHAPTER VIII. PENAL PROVISIONS 
SEC. 25. Penalties for the Unauthorized Processing of Personal Data - The penalty of 
imprisonment ranging from six (6) to twelve (12) years and a fine of not less than one million 
pesos (Php 1,000,000.00) but not more than three million pesos (Php 3,000,000.00) shall be 
imposed on persons who process personal data without the consent of the data subject, or 
without being authorized under this Act or any existing law. 
SEC. 26. Penalties for the Processing of Personal Data for Unauthorized Purposes - 
The penalty of imprisonment from six (6) years and one day to eight (8) years and a fine of 
not less than Five hundred thousand Philippine pesos (Php 500,000.00) but not more than 
one million Philippine pesos (Php 1,000,000.00) shall be imposed on persons processing 
personal data for purposes not authorized by the data subject, or otherwise authorized under 
this Act or under existing laws. 
15 
16 
17 
18 
SEC. 27. Malicious Disclosure. Any person who, with malice or in bad faith, discloses 
unwarranted or false information relative to any personal data obtained by him or her from a 
data controller or unknowingly transferred to him or her, shall be subject to a penalty of six 
(6) months and one (1) day to two (2) years and four (4) months of imprisonment and a fine 
of not less than One hundred thousand pesos (Php 100,000.00) but not more than Five 
19 
20 
hundred thousand pesos (Php500,OOO.OO). 
-16- 


1 
2 
3 
4 
5 
6 
7 
SEC.28. Breach ofconfidentiality The penalty of imprisonment ranging from two (2) 
years, four (4) months and one (1) day to four (4) years and two (2) months and a fine of, not 
less than Two hundred thousand pesos (Php 200,000.00) but not more than Five Hundred 
Thousand pesos (Php 500,000.00) shall be imposed in case of a breach of confidentiality 
where such breach has resulted in the information being published or reported by media. In 
this case, the responsible reporter, writer, president, publisher, manager and editor-in-chief 
shall be liable under this Act. 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
sEC.29. Extent ofliability - If the offender is a corporation, association, partnership or 
any juridical person, the penalty shall be imposed upon the responsible officers, as the case 
may be, who participated in, or by their gross negligence allowed the commission of the 
crime. If the offender is a juridical person, the court may suspend or revoke any of its rights 
under this Act. If the offender is an alien, he shall, in addition to the penalties herein 
prescribed, be deported without further proceedings after serving the penalties herein 
prescribed. If the offender is a public official or employee and he is found guilty of acts 
penalized under Sections 25 and 26 of this Act, he or she shall, in addition to the penalties 
prescribed herein, suffer perpetual or temporary absolute disqualification from office, as the 
case may be. 
18 
19 
SEC. 30. Restitution. - Restitution for any aggrieved party shall be governed by the 
provisions of the New Civil Code. 
CHAPTER IX. MISCELLANEOUS PROVISIQNS 
20 
SEC. 31. Implementing Rules and Regulations - Within thirty (60) days from the 
appointment of the Executive Director of the Commission and the constitution of the 
21 
-17- 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
Secretariat, the Commission shall promulgate the rules and regulations to effectively 
implement the provisions of this Act. Said rules and regulations shall be submitted to the 
Congressional Oversight Committee for approval. Aside from those expressly stipulated 
under this Act, the Commission shall issue implementing rules and regulations (IRR), on the 
following: 
1. restrictions on the use and transfer of personal data to foreign jurisdictions; 
2. sanctions to be imposed by the Commission on: 
a. delay in or non-submission of reports it may require the data controller 
or data processor to submit in the performance of its functions; 
I. 
I 
b. entities other than data controller or data processor, for breaches of 
confidentiality of, or misuse of, personal data obtained from the 
Commission. 
3. suspension or cancellation of the authority of data controllers and/or data 
protectors; 
4. measures by which the Commission may be allowed to release and disclose 
personal data without the consent of the data subject, consistent with existing 
I 
~ 
laws and regulations. 
Upon the approval of the IRR by the Congressional Oversight Committee created 
under this Act, the same shall be immediately published in at least two (2) newspapers of 
general circulation. 
21 
Congressional Oversight Committee. - There is hereby created a 
22 
Congressional Oversight Committee composed of seven (7) members from the Senate and 
23 
seven (7) members from the House of Representatives. The members from the respective 
24 
Houses shall be appointed by the Senate President or Speaker of the House of 
SEC. 32. 
-18- 


1 
2 
Representatives based on the proportional representation of ts e parties or coalitions therein 
with at least two (2) members of each House representin; the minority. The Oversight 
Committee shall have the power to promulgate its own rules, to oversee the implementation 
of this Act, and to review or revise the implementing rules issued by the Commission within 
thirty (30) days from the promulgation of the said rules. 
P 
~ 
3 
4 
5 
I 
10 
11 
12 
13 
14 
15 
SEC. 33. Appropriations Clause - The Commission shall be provided with an initial 
appropriation of Twenty-five million Philippine pesos (Php 25,000,000.00) to be drawn from 
the national government. Appropriations for the succeeding years shall be included in the 
I 
General Appropriations Act. 
I 
SEC. 34. Separability Clause - If any part or provision of this Act shall be held 
unconstitutional or invalid, other provisions hereof that dp not affected thereby shall 
continue to be in full force and effect. 
SEC. 35. Repealing Clause - All other laws, decrees, ekecutive orders, proclamations 
and administrative regulations, or parts thereof inconsistent Herewith are hereby repealed or 
modified accordingly. 
~ 
16 
17 
SEC. 36. Effectivity Clause - This Act shall take effect fifteen (15) days after its 
publication in at least two (2) national newspapers of general iirculation. 
Approved, 
-19-