FIFTEENTH CONGRESS )
OF THE REPUBLIC OF THE PHILIPPINES |)
First Regular Session )

HOUSE OF REPRESENTATIVES

House Bill No. 8390

Introduced by Representative Susan A. Yap

EXPLANATORY NOTE

Data protection is a legal aren advanced countries has long dealt with. As early as 1981, the Council
of Europe adopted the “Convention for the Protection of Individuals with regard to Automatic Processing
of Personal Data.” Signatories thereto agreed to enact national legislations in their respective countries
concerning the automatic processing of personal data.

Sadly, the same is not the case in the Philippines. Here, there is no specific law that addresses the
protection of personal data, The closest one we have is Presidential Decree No. 1718 of 1980 titled
“Providing for Incentives in the Pursuit of Economic Development Programs by restricting the use of
Documents and Information Vital to the National Interest in Certain Proceedings and Processes.” This
Aecree generally prohibits the exportation of documents and information from the Philippines to other
countries that may cause adverse effects to Philippine corporations, citizens, or government agencies. Yet, PD
1718 lacks force because rules and regulations were not provided for its enforcement.

This bill aims to establish fair practices in the collection, recording, organization, storage, updating oF
modification, retrieval, consultation, use, consolidation, dissemination by any means, merging, linking,
blocking, erasure or destruction of personal data of natural persons and to penalize the unauthorized
processing and disclosure thereof. It outlines that personal information should only be collected and
recoded (or specified purpose previously agreed on and acknowledged by the concerned party. Also, that the
method by which they will be obtained be legitimate. Great responsibility will be put on the shoulders of the
party controlling the data such that it would be theie primary obligation to protect whatever they have collated
ngainst natural dangers (Le. accidental loss and destruction) and human dangers (Le. unlawful access,
fraudulent misuse, unlawful destruction, alteration, and contamination), and to ensure that no part of these
data will be disclosed to unauthorized persons

“These provisions apply especially to business process outsourcing companies since majority of their
clients ate based overseas.

Players in the outsourcing industry believ © that the passage of this bill would boost country’s
competitiveness. Considered as one of the sunshine industries, the BPO industry has grown by an average of
50 percent for the past three years. In 2007, it generated US$4.9 billion revenues and employed around
300,000 workers. However, due to the US financial crisis, there is a need for the Philippines to tap potential
markets outside the United States like Canada, United Kingdom, Europe and Australia. Passage of this bill is
crucial since countries which have adopted data privacy laws would only outsource to those who have
adopted similar laws,

In view of upholding rights to privacy and developing a better business environment for outsourcing,
immediate enactment of this measure is earnestly sought.



Cor aueene

10
Hl
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Bt
32
33
34
35
36
37
38
39
40
41
2
4B
44
48
46
47
48
49
50
SI
52
33
54
55
56
37

FIFTEENTH CONGRESS )
OF THE REPUBLIC OF THE PHILIPPINES)
First Regular Session )

HOUSE OF REPRESENTATIVES
House Bill No. 890

Introduced by Representative Susan A. Yap

AN ACT
TO ESTABLISH FAIR PRACTICES IN THE PROCESSING OF INFORMATION
RELATING OR PERSONAL TO INDIVIDUALS, CREATING FOR THE PURPOSE A
PERSONAL DATA PROTECTION COMMISSION, AND FOR OTHER PURPOSES

Be it enacted by the Senate and the House of Representatives in Congress assembled;

SECTION 1. Tit. - This Act shall be known as- the “Data Protection Act of 2010.”

SEC. 2. Declaration of Policy - It is hereby declared the policy of the state to protect the
fundamental human tights and freedoms of natural persons, in particular the inviolability of privare
life with respect to the processing of data and to regulate the processing of personal data to ensure
that all transactions related thereto are conducted in an efficient and responsible manner.

Any doubt in the interpretation of any provision of this Act shall be interpreted in favor of
the rights and interests of the individual whose private information is being processed.

SEC. 3. Definition of Terms. - Whenever used in this Act, the following terms shall have the
respective meanings hereafter set forth, unless the context requires otherwise:

1, “Data” means information which a) is being processed by means of equipment operating
automatically in response to instructions given for that purpose; b) is recorded with the
intention that it should be processed by means of such equipment; and c) is recorded as.
part of a relevant filing system or with the intention that is should form part of a relevant
filing system;

“Personal data” means any information relating to an identified or identifiable data subject
which can be linked by a data controller or a third person belonging to a specific data
subject;

3. “Data subject” means a natural person who may directly or indirectly be referred to in a
data processing system, and is identified with particularity in the said system for his or her
physical, physiological, mental, economic, cultural or social identity, among others;

4. “Data controller” means a natural or juridical person, public authority, agency or any other
body duly authorized by law who is qualified and competent to process the personal data
pertaining to a data subject, and duly registered with the National Data Protection
Commission;

5. “Data processor” means any natural or juridical person qualified to act as such under this

Act to whom a data controller may outsource the processing of personal data pertaining
toa data subject;


6. “Processing” shall mean any operation or any set of operations concerning personal data,
including, but not limited to, the collection, recording, organization, storage, updating or
modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction
of data;

7. “Filing system” means any set of information relating to natural or juridical persons to the
extent that, although the information is not processed by means of equipment operating
automatically in response to instructions given for that ‘purpose, the set is structured,
cither by reference to individuals or by reference to criteria relating to individuals, in such
a way that specific information relating to a particular person is readily accessible;

8, “Sensitive personal data” means personal data which is likely to give rise to unlawful or
arbitrary discrimination, which includes, but is not limited to, data which indicate the race,
ethnic origin, religious, philosophical or political affiliations and financial, transactions, of
which provide information as to the health ot sexval life of a person, or any proceeding
for any offense committed or alleged to have been committed by such person, the
disposal of such proceedings, or the sentence of any court in such proceedings;

9. “Consent of the data subject” means any freely given, specific and informed expression of
will, either in written or electronic form executed personally and voluntarily by the data
subject, whereby the data subject agrees to the processing of personal data about and/or
relating to him or her:

10. “Commission” shall refer to the National Data Protection Commission created by virtue
of this Act.

SEC. 4. Scope - This Act applies to the processing of all types of personal data, and to any
‘natural and juridical person involved in personal data processing. This Act does not apply to the
information systems made by natural persons in which personal data are processed for personal or
household and family purposes and in which the personal data collected are not disclosed to other
persons

SEC. 5. Exceptions - Sections 7, 8 and 13 of this Act shall not apply if personal data are
processed for journalistic, artistic or literary purposes, and it is not otherwise prohibited by law

CHAPTER 11. THE NATIONAL DATA PROTECTION COMMISSION

SEC. 6. Functions of the National Data Protection Commission - To administer and implement the
provisions of this Act and monitor the compliance of the country with international standards set
for data protection, there is hereby created an independent body to be known as the National Data
Protection Commission, which shall have the following functios

1. ensure compliance of 'data controllers’ and data processors with the provisions of this Act;

2. receive complaints, institute investigations, adjudicate, or award indemnity on matters
affecting any personal data. For this purpose, the Commission may be given access to
personal data subject of any complaint and to collect the information necessary to
adjudicate or award indemnity on matters affecting any personal data;

3. issue cease and desist orders, impose a temporary or permanent ban on the processing of
personal data, upon finding that the processing will be detrimental to national security and
public interest;

4, examine applications for grants of authority to implement a personal data processing
system and register personal data processing systems;

5. oversee and monitor the processing of personal data to prevent any breach in the
protection of the same and ensure that the rights of the data subject are upheld at all times;


6. coordinate with other government agencies and the private sector on efforts to formulate
and implement plans and policies to strengthen the protection of personal data in the
county.

SEC. 7. Organizational Structure of the Commission - The Commission shall be attached to the
Office of the President and shall be headed by an Executive Director and to be assisted by two (2)
Deputy Directors, one to be responsible for Data Processing Systems and one to be responsible for
Policies and Planning. The Executive Director and the nwo (2) Deputy Directors shall be appointed
by the President of the Philippines for a term of three (3) years.

The Executive Director must be a member of the Philippine Bar, at least thirty-five (35)
eats of age and of good moral character, unquestionable integrity and known probity. The
cutive Director shall enjoy the benefits, privileges and emoluments equivalent to the rank of

The Deputy Directors must be recognized experts in the field of data processing and
intellectual property. They shall enjoy the benefits, privileges and emoluments equivalent to the rank
of Assistant Secretary.

SEC. 8 The Seretariat - The Commission is hereby authorized to establish a Secretariat.
Majority of the members of the Secretariat must have served for at least five years in any agency of
the government that is involved in the processing of personal data, including, but not limited to the
following offices: National Statistical Office (NSO), Government Service Insurance System (GSIS),
Land ‘Transportation Office (LTO), Bureau of Internal Revenue (BIR), Philippine Health Insurance
Corporation (PhilHealth), Commission on Elections (Comelec), Department of Foreign Affairs
(DFA), Department of Justice, and Philippine Postal Corporation (PhilPost),

CHAPTER III. PROCESSING OF PERSONAL DATA

SEC. 9. General principles of data processing - Personal data shall not be processed at all, except
when certain conditions are met. The processing of personal data, if allowed, shall adhere to the
principles of transparency, legitimate purpose and proportionality.

1. Personal data must be:

a, collected for specified and legitimate purposes determined and declared before
collecting personal data and later processed in a way compatible with such
declared, specified and legitimate purposes;

b. processed accurately, precisely, fairly and lawfully;

c. accurate, relevant, and, where necessary for the processing of personal data, kept
up to date; inaccurate or incomplete data must be rectified, supplemented,
destroyed or their farther processing must be restricted;

d. consistent, adequate and not excessive in relation to the purposes for which they
are collected and processed;

e. kept within a period not exceeding the time within which the purposes for which
the data was obtained would be achieved; and kept in a form which permits
identification of data subjects for no longer than is necessary for the purposes for
which the data were collected and processed; Provided, that personal data collected
for other purposes may be processed for historical, statistical or scientific

£ purposes and in cases laid down in law may be stored for longer periods; Provided,

further, that adequate safeguards are guaranteed by said laws authorizing their
processing.


2. The controller must ensure implementation of personal data processing principles set out
in paragraphs 1 and 2 of this section.

SEC. 10. Criteria for lawful processing of personal data - The processing of personal data shall be
permitted only if not otherwise prohibited by law, and at least one of the following conditions exist

1. the data subject has given his or her unambiguous consent;

2. the personal data is necessary and is a legal consequence of a contractual obligation of the
data subject:

3. the processing is necessary to protect vitally important interests of the data subject,
including life and health; or

4, the processing is necessary in order to respond to national emergency, to comply with the
requirements of public order and safety, or to fulfill functions of public authority which
necessarily includes the processing of personal data for the fulfillment of its mandate.

SEC. 11. Sensitine data- The processing of sensitive personal data shall be prohibited, except
in the following cases:

1. the data subject has given his or her consent prior to the processing;

2. the processing of the same is provided for by existing laws and regulations: Provided, that
such regulatory enactments guarantee the protection of the sensitive personal data
Provided, furtber, that the consent of the data subject is not required by the law, ot regulation
permitting the processing of sensitive personal data;

3. the processing is necessary to protect the life and health of the data subject or another
person, and the data subject is not legally or physically able to express his ot het consent
prior to the processing;

4. processing is necessary to achieve the lawful, non-commercial objectives of public
organizations and their associations: Provided, such processing is only confined and related
to the bona fide members of these organizations ot their associations: Provided, further,
that the sensitive personal data are not transferred to third parties: Provided, finally, that
consent of the data subject was obtained prior to processing;

5. the processing is necessary for the purposes of medical treatment, is cattied out by a
medical practitioner or a medical treatment institution, and an adequate level of protection
of personal data is ensured; or

6. the processing concerns such personal data as is necessary for the protection of lawful
rights and interests of natural or legal persons in court proceedings: Provided, that in all
cases, the data controller is duly authorized by the Commission to engage in the processing
of sensitive personal data.

SEC. 12. Data controller - Any person, natural or juridical, may be granted the authority to act
as a data controller by the Commission upon application and examination, taking into consideration
the impartiality, independence and technical competence of the applicant.

SEC. 13. Data processor. A data controller may subcontract the processing of personal data to
4 personal data processor: Provided, that prior to the commencement of any contract, the data
processor has been duly qualified to act as such by and is registered with the Commission: Provided,
further, that the data controller shall retain primary control over the personal data processed by the
data processor; and Provided, finally, that the data controller shall be responsible for ensuring that


Sowraaunevne

ul
12
13
14
15
16
17
18
19
20
21
23
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
34
55
56
37
58

proper safeguards are in place to ensure the confidentiality of the personal data processed, guarantee
its ncon-transferability to unauthorized persons, and prevent its use for unauthorized purposes.

SEC, 14. Storage of data.- Personal data shall be stored and used only for as long as it is
necessary to achieve the purpose for which it was processed, after which the personal data shall be
deleted or blocked from a personal database, unless otherwise provided by law.
CHAPTER IV. RIGHTS OF THE DATA SUBJECT
SEC. 15. Rights of the data subjec.-"The data subject is entitled to:

I. be informed whether personal data pertaining to him or her shall be, are being, or have
been processed;

2. before the entry of his or her personal data into the processing system of the data
controller, be furnished the following:

a. description of the personal data to be entered into the system;

. purposes for which they are being or are to be processed

c. scope and method of the personal data processing:

d. recipients or classes of recipients to whom they are or may be disclosed; and

¢. methods utilized for automated access, if the same is allowed by the data subject,
and the extent to which such access is authorized.

Any information supplied or declarations made to the data subject on these matters shall not
be amended without prior notification of data subject.

3. be given access to, upon demand, the following:

1. contents of his/her personal data that were processed;

. source from which personal data were obtained;

c. names and addresses of recipients of the personal data;

. manner by which such data were processed;

¢. reasons for the disclosure of the personal data to recipients;

£, information on the decision-making involved in selecting the manner by which
personal data shall or will be disclosed on data that will or is likely to be made as the
sole basis for any decision significantly affecting or will affect a data subject;

g date when his or her personal data concerning the data subject were last accessed
and modified.

4. dispute the inaccuracy of erroneous personal data and have the data contzoller correct it
immediately and accordingly. If the personal data has been corrected, the data controller
shall ensure the accessibility of both the new and the retracted information and the
simultaneous receipt of the new and the retracted information by recipients thereof,

5. suspend, withdraw or order the blocking, removal or destruction of his or her personal
data from the data controller's filing system upon discovery and proof that the personal data
are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or are


Sowraausene

rv
12
13
14
15
16
7
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
4
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
37
58

no longer necessary for the purposes for which they were collected. In this case, the data
controller shall rectify the inaccuracy without delay and notify third parties who have
previously received such processed data. Likewise, the data controller shall indemnify the
data subject for any damages sustained by the latter due to such inaccuracy.

SEC. 16. Non-applicability. The preceding section is not applicable if the processed data
are used only for the needs of scientific and statistical research and, on the basis of such, no
activities are carried out and no decisions are taken regarding the data subject, Provided, that the
personal data shall be held under strict confidentiality and shall be used the same only for the
declared purpose,

CHAPTER VY. REGISTRATION OF PERSONAL DATA PROCESSING SYSTEM

SEC. 17, Application - Prior to the carrying out or commencing of personal data processing
of the establishment of a system for personal data processing, a data controller shall first submit for
the Commission's approval the personal data processing system it secks to implement. For this
purpose, the data controller shall submit an application to the Commission, which shall contain the
following

1. A request for the grant of authority to implement a particular personal data processing
a

2, Name of the data controller or data processor, date of its registration with the
Commission, the place where its principal office is located, and the term for which it has
been authorized by the Commission to act as such;

3. The legal basis for the operation of the personal data processing system;

4. The type of personal data to! be included in the system, the purposes for which it is
intended and the :cope of personal data to be processed;

5. The categories of data subjects;
6, The categories of recipients of personal data;
7. The intended method of personal data processing;

8. The planned method of obtaining personal data and a mechanism for the control of their
quality;

9. Other data processing systems which will be connected with the system to be registered

10. Such other data systems which will be able to obtain data from the system to be
registered, and what data the system to be registered will be able to obtain from connected
systems;

11, The method for transferring data from the system to be registered to another system;

12, ‘The identification codes of natural or juridical persons that will be used by the system to
be registered;

13, The method for exchanging information with the data subject;

14. The procedures whereby a data subject is entitled to obtain information concerning
himself or herself;

15. The procedures for supplementing and updating of personal data;


Scwrudanaona

i
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
33
54
35
56
37
58

16. Technical and organizational measures to ensure the protection of personal

17. What personal data will be transferred to other countries or jurisdictions. The registration
procedure prescribed by this Act is not applicable to the personal data processing carried
out by institutions specially authorized by law in the areas of public safety, law
enforcement, national security and defense.

SEC. 18. Publication of Application - After the payment of filing fees and prior to the formal
review of the application, the Commission shall, at the expense of the applicant, cause the
publication of the items set out in subparagraph 1 and 2 of the preceding section and the notice of
the formal review of the application once every week in at least (2) newspapers of general circulation
for a petiod of and deadline for submission of comments three (3) consecutive weeks. If the
required fees for the grant are not paid or the printing is not done in due time, the application shall
be deemed withdrawn.

SEC. 19, Following the publication of the application, any person may submit, in writing, his
ot het comments or opposition on the application. The comment or opposition shall be submitted
to the Commission at least ten (15) days prior to the scheduled formal review of the application. The
Commission shall notify the applicant of such comment or opposition and the latter may submit its
comment or answer within ten (10) days from receipt of the notice.

SEC. 20. The Commission shall conduct the formal review of the application within thirty
(80) days from the publication of the application and shall approve ot deny the application within
thirty (50) days from the completion of the review.

SEC. 21. Amendment of Applicaton. - An applicant may amend its application on or before the
date of review; Provided, that such amendment shall not include new matters outside the scope of
the disclosures contained in the application as filed. If new matters are, to be included in the
amended application, the same shall be treated as a new application and the corresponding time
periods shall apply.

SEC. 22. Grant of Authority. - If the application meets all the requirements of this Act, the
Commission shall grant the authority to implement the particular personal data processing system
subject of the application. The grant to implement a personal data processing system shall take effect
upon the issuance of certificate of registration.

CHAPTER VI. SECURITY OF DATA

SEC. 23, Security of Data. - (1) The data controller and data processor shall implement
appropriate measures to protect personal data against natural dangers, such as accidental loss ot
destruction and human dangers such as unlawful access, fraudulent misuse, unlawful destruction,
alteration, and contamination. These measures, specified in a written document or its equivalent,
must be appropriate to the nature of the data to be protected and the risks represented by the
processing,

@ The employees, agents or representative of the data controller, and data processor, and
their representatives who are involved in the processing personal data shall operate hold personal
data under strict confidentiality if these personal data are not intended for public disclosure. This
obligation shall continue even after leaving the public service, transfer to another position or upon
tetmination of employment or contractual relations.

CHAPTER VII. TRANSFER OF PERSONAL DATA

SEC. 24. Transfer of Personal Data to Data Recipients in Foreign Jurisdiction - (1) Priot to the
transfer of, personal data to recipients in foreign jurisdictions, the consent of the data subject and
the approval of the Commission must first be sought, except in the cases referred to in paragraph 3
of this section.


(2) The Commission shall grant an authorization for transfer of personal data to foreign
jurisdictions upon, finding and proof, that there is an adequate level of personal data protection in
such jurisdiction, taking into consideration: a) the existence and implementation of laws on
protection of personal information in the jurisdiction; b) the nature of the data and the
circumstances by which a data transfer operation may be done in such jutisdiction; and c) the
purpose of the transfer, the duration of the use for the personal data, the respectability of the rights
of the data subject provided in this Act in the foreign jurisdiction

@) Without the authorization of, the Commission, personal data may, be transferred to a
foreign jurisdiction or an international law enforcement organization only if

a. the transfer of personal data is necessary for the conclusion or performance of a contract
between the data controller and a third party;

b, the transfer of personal data is necessary for the performance of a contract between the data
controller and the data subject or the implementation of pre-contractual measures;

«. the transfer of personal data is necessary ot required by a lawful order of a competent court
of local jurisdiction;

d. the personal data is contained in and is being transferred from a public data file in
accordance with the procedure prescribed by laws and other rules and regulations.

CHAPTER VIII. PENAL PROVISIONS

SEC. 25. Penalties for the Unauthorized Processing of Personal Data - The penalty of imprisonment
ranging from six (6) to twelve (12) years and a fine of not less than one million pesos (Php
1,000,000.00) but not more than three million pesos (Php 3,000,000.00) shall be imposed on persons
who process personal data without the consent of the data subject, or without being authorized
under this Act or any existing law.

SEC. 26, Penalties for the Processing of Personal Data for Unauthorized Parposes ~The penalty of
imprisonment from six (6) years and one day to eight (8) years and a fine of not less than Five
hundred thousand Philippine pesos (Php 500,000.00) but not more than one million Philippine
pesos (Php 1,000,000.00) shall be imposed on persons processing personal data for purposes not
authorized by the data subject, ot otherwise authorized under this Act or under existing laws.

SEC. 27. Malicious Disclosure. Any person who, with malice or in bad faith, discloses
unwarranted or false information relative to any personal data obtained by him or her from a data
controller or unknowingly transferred to him or her, shall be subject to a penalty of six (6) months
and one (1) day to two (2) years and four (4) months of imprisonment and a fine of not less than
One hundred thousand pesos (Php 100,000.00) but not more than Five hundred thousand pesos
(Php500,000.00).

SEC.28. Breach of confidentiality. The penalty of imprisonment ranging from two (2) years, four
(4) months and one (1) day to four (4) years and two (2) months and a fine of, not less than Two
hundred thousand pesos (Php 200,000.00) but not more than Five Hundred Thousand pesos (Php
500,000.00) shall be imposed in case of a breach of confidentiality where such breach has resulted in
the information being published or reported by media. In this case, the responsible reporter, writer,
president, publisher, manager and editor-in-chief shall be liable under this Act.

SEC.29. Exctent of lability - If the offender is a corporation, association, partnership or any
juridical person, the penalty shall be imposed upon the responsible officers, as the case may be, who
participated in, ot by their gross negligence allowed the commission of the crime. If the offender is a
juridical person, the court may suspend or revoke any of its rights under this Act. If the offender is
an alien, he shall, in addition to the penalties herein prescribed, be deported without further
proceedings after serving the penalties herein prescribed. If the offender is a public official or
employee and he is found guilty of acts penalized under Sections 25 and 26 of this Act, he or she
shall, in addition to the penalties prescribed herein, suffer perpetual or temporary absolute
disqualification from office, as the case may be.


SEC. 30. Restitution. - Restitution for any aggrieved party shall be governed by the provisions
of the New Civil Code.

CHAPTER IX. MISCELLANEOUS PROVISIONS

SEC. 31. Implementing Rules and Regulations - Within thirty (30) days from the appointment of
the Executive Director of the Commission and the constitution of the Secretariat, the Commission
shall promulgate the rules and regulations to effectively implement the provisions of this Act. Said
rules and regulations shall be submitted to the Congressional Oversight Committee for approval.
Aside from those expressly stipulated under this Act, the Commission shall issue implementing rules
and regulations (IRR), on the following:

1. restrictions on the use and transfer of personal data to foreign jurisdictions;
2. sanetions to be imposed by the Commission on:

a. delay in or non-submission of reports it may require the data controller ot data
processor to submit in the performance of its functions;

b. entities other than data controller or data processor, for breaches of confidentiality
of, of misuse of, personal data obtained from the Commission.

3. suspension or cancellation of the authority of data controllers and/or data protectors;

4. measures by which the Commission may be allowed to release and disclose personal data
without the consent of the data subject, consistent with existing laws and regulations.

Upon the approval of the IRR by the Congressional Oversight Committee created under this
‘Act, the same shall be immediately published in at least two (2) newspapers of general circulation.

SEC. 32. Congressional Oversight Committe. - There is hereby created a Congressional Oversight
Committee composed of seven (7) members from the Senate and seven (7) members from the
House of Representatives. The members from the respective Houses shall be appointed by the
Senate President or Speaker of the House of Representatives based on the proportional
representation of the parties or coalitions therein with at least two (2) members of each House
representing the minority. The Oversight Committee shall have the power to promulgate its own
rules, to oversee the implementation of this Act, and to review or revise the implementing rules
issued by the Commission within thirty (30) days from the promulgation of the said rules.

SEC. 33. Appropriations Clause. - The Commission shall be provided with an initial
appropriation of Twenty-five million Philippine pesos (Php 25,000,000.00) to be drawn from the
national government. Appropriations for the succeeding years shall be included in the General
Appropriations Act. I

SEC. 34. Separability Clause. - If any part or provision of this Act shall be held
unconstitutional or invalid, other provisions hercof that do not affected thereby shall continue to be
in full force and effect.

SEC. 35. Repealing Clause. - All other laws, decrees, executive orders, proclamations and
administrative regulations, or parts thereof inconsistent Herewith are hereby repealed or modified
accordingly.

SEC. 36, Effctivity Clause. - This Act shall take effect fifteen (15) days after its publication in
at least two (2) national newspapers of general circulation.

Approved,