'" 
1'# 
SIXTEENTH CONGRESS OF THE REPUBLIC) 
OF THE PHILIPPINES 
) 
First Regular Session 
) 
SENATE 
Senate Bill No, 7 7 0 
.'s!:'!:mtl' 
{!f}tftff of IIw ,jfT1'~bir\t 
'13 
JUL 15 P6:20 
INTRODUCED BY SEN. JINGGOY EJERCITO ESTRADA 
EXPLANATORY NOTE 
This bill seeks to establish fair practices in the collection, recording, 
organization, storage, updating or modification, retrieval, consultation, use, 
consolidation, dissemination by any means, merging, linking, blocking, erasure or 
destruction of personal data of natural persons and to penalize the unauthorized 
processing and disclosure thereof. 
Privacy is a fundamental human right recognized in all major international 
treaties and agreements on human rights. This is recognized in the present 
millennium of advanced information technology, growing trend towards the 
enactment of comprehensive privacy and data protection laws to address past 
governmental abuses on the privacy of identity, communication, 
and 
correspondence; 
promote 
e-commerce; 
and 
ensure 
compatibility 
with 
international standards. 
It started in Sweden in 1973 with the enactment of a law which regulates 
the establishment and use, in both public and private sectors, of automated data 
files on physical and natural persons. In 1985, the Convention for the Protection 
of Individuals with Regard to Automatic Processing of Personal Data drawn up 
within the Council of Europe entered into force, which obligates the signatories to 
I 
enact legislation concerning the automatic processing of personal data, which 
many of the member States of the Council of Europe subsequently did. In 1990, 
the United Nations promulgated the Guidelines Concerning Computerized 
Personal Data Files which provided for the procedures in implementing 
regulations concerning computerized personal data files. In 1995, the European 
Union (EU) passed a Directive on the Protection of Individuals With Regard to 
the Processing of Personal Data and on the Free Movement of Such Data. 
In the Philippines, there is no special law that specifically addresses the 
protection of personal data. But the right to privacy is recognized and enshrined 
in several provisions of the Philippine Constitution, particularly in the different 
sections of the Bill of Rights. Zones of privacy are likewise recognized and 
protected in Philippine laws, particularly in civil, criminal and remedial law. The 
Civil Code holds a public officer or employee or any private individual liable for 
damages for any violation of the rights and liberties of another person, and 
recognizes the privacy of letters and other private communications. In criminal 
law, the Revised Penal Code makes a crime the violation of secrets by an officer, 
the revelation of trade and industrial secrets, and trespass to dwelling. 
Invasion of privacy is an offense in special laws like the Anti-Wiretapping 
Law, the Secrecy of Bank Deposits Act, and the Intellectual Property Code. The 


" 
, 
. 
' 
Rules of Court on privileged communication likewise recognize the privacy of 
'certain information, Despite the existence of constitutional guarantees and the 
existence of laws upholding the right to privacy of our citizens, the increasing 
sophistication of Despite 'the existence of constitutional guarantees and the 
existence of laws upholding the right to privacy of our citizens, the increasing 
sophistication of information technology with its capacity to collect, analyze and 
disseminate information on individuals has introduced a sense of urgency in the 
demand for relevant legislation. Furthermore, new developments in medical 
research and care, telecommunications, advanced transportation systems, and 
financial transfers have dramatically increased the level of information generated 
by each individual. Computers linked together by high-speed networks with 
advanced processing systems can create comprehensive dossiers on any 
person without the need for a single central computer system. 
The expression of the protection of personal data may vary in various 
declarations and laws but all require that personal information must be obtained 
fairly and lawfully; used only for the original purpose specified; adequate, 
relevant and not excessive to the purpose; accurate and up to date; and 
destroyed after its purpose is completed. This proposed measure complies with 
the aforementioned requirements and addresses the need for legislation to 
protect personal data. 
This bill stipulates that personal data must be set up only for a specified 
purpose that is relevant to the interests of the party and must be obtained 
legitimately and in accordance with the purpose for which the file was set up. The 
party controlling the data has a duty to make appropriate measures to ensure 
that the data processed is complete and accurate, its use is compatible with the 
purpose of the data file, and is not disclosed to unauthorized persons. Under this 
measure, a person shall have the right to unimpeded access to his or her 
personal records and act accordingly on the same. 
This bill likewise penalizes the following acts: 1) proceSSing of personal 
data without the consent of, and despite the opposition of, the data subject, or 
without being authorized under any existing law or this Act to do so; 2) the 
processing of personal data for purposes not authorized by the data subject, or 
otherwise prohibited under the existing laws or this Act; 3) the malicious reporting 
of any person of a personal data obtained by him or her from a data controller or 
transferred to him or her unknowingly; and, 4)the breach of confidentiality when 
the information has been published or reported by media. 
In view of the foregoing, the immediate enactment of this measure is 
eamestly sought. 
Senator 


.' 
SIXTEENTH CONGRESS OF THE REPUBLIC) 
OF THE PHILIPPINES 
) 
First Regular Session 
) 
SENATE 
Senate Bill No, 7 7 0 
'13 
JUl 15 P 6 :20 
INTRODUCED BY SEN. JINGGOY EJERCITO ESTRADA 
AN ACT 
TO ESTABLISH FAIR PRACTICES IN THE PROCESSING OF INFORMATION 
RELATING OR PERSONAL TO INDIVIDUALS, CREATING FOR THE 
PURPOSE A PERSONAL DATA PROTECTION COMMISSION, AND FOR 
OTHER PURPOSES 
Be it enacted by the Senate and the House of Representatives in Congress 
assembled: 
SECTION 1. Title. - This Act shall be known as- the "Data Protection Act 
of 2013". 
SEC. 2. Declaration of Policy - It is hereby declared the policy of the 
state to protect the fundamental human rights and freedoms of natural persons, 
in particular the inviolability of private life with respect to the processing of data 
I 
and to regulate the processing of personal data to ensure that all transactions 
related thereto are conducted in an efficient and responsible manner. 
Any doubt in the interpretation of any provision of this Act shall be 
interpreted in favor of the rights and interests of the individual whose private 
information is being processed. 
SEC. 3. Definition of Terms. - Whenever used in this Act, the following 
terms shall have the respective meanings hereafter set forth, unless the context 
requires otherwise: 
1. 
"Data" means information which a) is being processed by means of 
equipment operating automatically in response to instructions given 
for that purpose; b) is recorded with the intention that it should be 
processed by means of such equipment; and c) is recorded as part of 
a relevant filing system or with the intention that is should form part of 
a relevant filing system; 
2. 
"Personal data" means any information relating to an identified or 
identifiable data subject which can be linked by a data controller or a 
third person belonging to a specific data subject; 
3. 
"Data subject" means a natural person who may directly or 
indirectly be referred to in a data processing system, and is identified 
with particularity in the said system for his or her physical, 


.' 
physiological, mental, economic, cultural or social identity, among 
others; 
4. 
"Data controller" means a natural or juridical person, public 
authority, agency or any other body duly authorized by law who is 
qualified and competent to process the personal data pertaining to a 
data subject, and duly registered with the National Data Protection 
Commission; 
5. 
"Data processor" means any natural or juridical person qualified to 
act as such under this Act to whom a data controller may outsource 
the processing of personal data pertaining to a data subject; 
6. 
"Processing" shall mean any operation or any set of. operations 
concerning personal data, including, but not limited to, the collection, 
recording, organization, storage,· updating or modification, retrieval, 
consultation, use, consolidation, blocking, erasure, or destruction of 
data; 
7. 
"Filing system" means any set of information relating to natural or 
juridical persons to the extent that, although the information is not 
processed by means of equipment operating automatically in 
response to instructions given for that 'purpose, the set is structured, 
either by reference to individuals or by reference to criteria relating to 
individuals, in such a way that specific information relating to a 
particular person is readily accessible; 
8. 
"Sensitive personal data" means personal data which is likely to 
give rise to unlawful or arbitrary discrimination, which includes, but is 
not limited to, data which indicate the race, ethnic origin, religious, 
philosophical or political affiliations and financial, transactions, or 
which provide information as to the health or sexual life of a person, 
or any proceeding for any offense committed or alleged to have been 
committed by such person, the disposal of such proceedings, or the 
sentence of any court in such proceedings; 
9. 
"Consent of the data subject" means any freely given, specific and 
informed expression of will, either in written or electronic form 
executed personally and voluntarily by the data subject, whereby the 
data subject agrees to the processing of personal data about and/or 
relating to him or her; 
10. "Commission" shall 
refer to the National Data Protection 
Commission created by virtue of this Act. 
SEC. 4. Scope - This Act applies to the processing of all types of personal 
I 
data, and to any natural and juridical person involved in personal data 
processing. This Act does not apply to the information 'systems made by natural 
persons in which personal data are processed for personal or household and 
family purposes and in which the personal data collected are not disclosed to 
other persons. 
SEC. 5. Exceptions - Sections 7,8 and 13 of this Act shall not apply if 
personal data are processed for journalistic, artistic or Literary purposes, and it is 
not otherwise prohibited by law. 


CHAPTER II 
THE NATIONAL DATA PROTECTION COMMISSION 
SEC. 6. Functions of the National Data Protection Commission - To 
administer and implement the provisions of this Act and monitor the compliance 
of the country with international standards set for data protection, there is hereby 
created an independent body to be known as the National Data Protection 
Commission, which shall have the following functions: 
1. 
Ensure compliance of 'data controllers' and data processors with the 
provisions of this Act; 
2. 
Receive complaints, institute investigations, adjudicate, or award 
indemnity on matters affecting any personal data. For this purpose, 
the Commission may be given access to personal data subject of any 
complaint and to collect the information necessary to adjudicate or 
award indemnity on matters affecting any personal data; 
3. 
Issue cease and desist orders, impose a temporary or permanent 
ban on the processing of personal data, upon finding that the 
processing will be detrimental to national security and public interest; 
4. 
Examine applications for grants of authority to implement a personal 
data processing system and register personal data processing 
systems; 
5. 
Oversee and monitor the processing of personal data to prevent any 
breach in the protection of the same and ensure that the rights of the 
data subject are upheld at all times; 
6. 
Coordinate with other government agencies and the private sector on 
efforts to formulate and implement plans and policies to strengthen 
the protection of personal data in the country. 
SEC. 7. 
Organizational Structure of the Commission -
The 
Commission shall be attached to the Office of the President and shall be headed 
by an Executive Director and to be assisted by two (2) Deputy Directors, one to 
be responsible for Data Processing Systems and one to be responsible for 
Policies and Planning. The Executive Director and the two (2) Deputy Directors 
shall be appointed by the President of the Philippines for a term of three (3) 
years. 
The Executive Director must be a member of the Philippine Bar, at least 
thirty-five (35) years of age and of good moral character, unquestionable integrity 
and known probity. The Executive Director shall enjoy the benefits, privileges and 
emoluments equivalent to the rank of Undersecretary. 
The Deputy Directors must be recognized experts in the field of data 
processing and intellectual property. They shall enjoy the benefits, privileges and 
emoluments equivalent to the rank of Assistant Secretary. 


SEC. 8. The Secretariat - The Commission is hereby authorized to 
establish a Secretariat. Majority of the members of the Secretariat must have 
served for at least five (5) years in ahy agency of the government that is involved 
I 
in the processing of personal data, including, but not limited to the following 
offices: National Statistical Office (NSO), Government Service Insurance System 
(GSIS), Land Transportation Office (L TO), Bureau of Internal Revenue (BIR), 
Philippine Health Insurance Corporation (PhilHealth), Commission on Elections 
(Comelec), Department of Foreign Affairs (DFA), Department of Justice, and 
Philippine Postal Corporation (PhilPost). 
CHAPTER'" 
PROCESSING OF PERSONAL DATA 
SEC. 9. General Principles of Data Processing - Personal data shall not 
be processed at all, except when certain conditions are met. The processing of 
personal data, if allowed, shall adhere to the principles of transparency, 
legitimate purpose and proportionality. 
1. Personal data must be: 
a. 
Collected for specified and legitimate purposes determined and 
declared before collecting personal data and later processed in a way 
compatible with such declared, specified and legitimate purposes; 
b. 
Processed accurately, precisely, fairly and lawfully; 
c. 
Accurate, relevant, and, where necessary for the processing of 
personal data, kept up to date; inaccurate or incomplete data must be 
rectified, supplemented, destroyed or their further processing must 
be restricted; 
d. 
Consistent, adequate and not excessive in relation to the purposes 
for which they are collected and processed; 
e. 
Kept within a period not exceeding the time within which the 
purposes for which the data was obtained would be achieved; and, 
f. 
Kept in a form which permits identification of data subjects for no 
longer than is necessary for the purposes for which the data were 
collected and processed; Provided, that personal data collected for 
I 
other purposes may be processed for historical, statistical or scientific 
purposes and in cases laid down in law may be stored for longer 
periods; Provided, further, that adequate safeguards are guaranteed 
by said laws authorizing their processing. 
2. The controller must ensure implementation of personal data processing 
principles set out in paragraphs 1 and 2 of this section. 
SEC. 10. Criteria for Lawful Processing of Personal Data - The 
processing of personal data shall be permitted only if not otherwise prohibited by 
law, and at least one ofthe following conditions exist: 
1. The data subject has given his or her unambiguous consent; 


.,' 
2. The personal data is necessary and is a legal consequence of a 
contractual obligation of the data subject; 
3. The processing is necessary to protect vitally important interests of the 
data subject, including life and health; or 
4. The processing is necessary in order to respond to national emergency, to 
comply with the requirements of public order and safety, or to fulfill 
functions of public authority which necessarily includes the processing of 
personal data for the fulfillment of its mandate. 
SEC. 11. Sensitive Data- The processing of sensitive personal data shall 
be prohibited, except in the following cases: 
1. The data subject has given his or her consent prior to the processing; 
2. The processing of the same is provided for by existing laws and 
regulations: Provided, That such regulatory enactments guarantee the 
protection of the sensitive personal data: Provided, further, that the 
consent of the data subject is not required by the law, or regulation 
permitting the processing of sensitive personal data; 
3. The processing is necessary to protect the life and health of the data 
subject or another person, and the data subject is not legally or 
physically able to express his or her consent prior to the processing; 
4. Processing is necessary to achieve the lawful, non-commercial 
objectives of public organizations and their associations: Provided, 
such processing is only confined and related to the bonafide members 
of these organizations or their associations: Provided, further, that the 
sensitive personal data are not transferred to third parties: Provided, 
finally, that consent of the data subject was obtained prior to 
processing; 
5. The processing is necessary for the purposes of medical treatment, is 
carried out by a medical practitioner or a medical treatment institution, 
and an adequate level of protection of personal data is ensured; or 
6. The processing concerns such personal data as is necessary for the 
protection of lawful rights and interests of natural or legal persons in 
court proceedings: Provided, that in all cases, the data controller is 
duly authorized by the Commission to engage in the processing of 
sensitive personal data. 
SEC. 12. Data Controller - Any person, natural or juridical, may be 
granted the authority to act as a data controller by the Commission upon 
application and 
examination, taking 
into consideration the 
impartiality, 
independence and technical competence of the applicant. 
SEC. 13. Data Processor- A data controller may subcontract the 
proces!Sing of personal data to a personal data processor: Provided, that prior to 
the commencement of any contract. the data processor has been duly qualified 
to act as such by and is registered with the Commission: Provided, further, that 
the data controller shall retain primary control over the personal data processed 


by the data processor; and Provided, finally, that the data controller shall be 
responsible for ensuring that proper safeguards are in place to ensure the 
confidentiality of the personal data processed, guarantee its non-transferability to 
unauthorized persons, and prevent its use for unauthorized purposes. 
SEC. 14. Storage of Data- Personal data shall be stored and used only 
for as long as it is necessary to achieve the purpose for which it was processed, 
after which the personal data shall be deleted or blocked from a personal 
database, unless otherwise provided by law. 
CHAPTER IV 
RIGHTS OF THE DATA SUBJECT 
SEC. 15. Rights offhe Data Subject- The data subject is entitled to: 
1. Be informed whether personal data pertaining to him or her shall be, are 
being, or have been processed; 
2. Before the entry of his or her personal data into the processing system 
of the data controller, be furnished the following: 
a. description of the personal data to be entered into the system; 
b. purposes for which they are being or are to be processed; 
c. scope and method ofthe personal data processing; 
d. recipients or classes of recipients to whom they are or may be 
disclosed; and 
e. methods utilized for automated access, if the same is allowed by the 
data subject, and the extent to which such access is authorized. 
Any information supplied or declarations made to the data subject on 
these matters shall not be amended without prior notification of data subject. 
3. Be given access to, upon demand, the following: 
a. contents of his/her personal data that were processed; 
b. source from which personal data were obtained; 
c. names and addresses of recipients of the personal data; 
d. manner by which such data were processed; 
e. reasons for the disclosure of the personal data to recipients; 
f. information on the decision-making involved in selecting the manner by 
which personal data shall or will be disclosed on data that will or is likely to 
be made as the sole basis for any decision significantly affecting or will 
affect a data subject; 


g. date when his or her personal data concerning the data subject were 
last accessed and modified. 
4. Dispute the inaccuracy of erroneous personal data and have the data 
controller correct it immediately and accordingly. If the personal data has been 
corrected, the data controller shall ensure the accessibility of both the new and 
the retracted information and the simultaneous receipt of the new and the 
retracted information by recipients thereof; 
5. Suspend, withdraw or order the blocking, removal or destruction of his 
or her personal data from the data controller's filing system upon discovery and 
substantial proof that the personal data are incomplete, outdated, false, 
unlawfully obtained, used for unauthorized purposes, or are no longer necessary 
for the purposes for which they were collected. In this case, the data controller 
I 
shall rectify the inaccuracy without delay and· notify third parties who have 
previously received such processed data. Likewise, the data controller shall 
indemnify the data subject for any damages sustained by the latter due to such 
inaccuracy. 
SEC. 16. Non-Applicability. The preceding section is not applicable if the 
processed data are used only for the needs of scientific and statistical research 
and, on the basis of such, no activities are carried out and no deCisions are taken 
regarding the data subject, Provided, that the personal data shall be held under 
strict confidentiality and shall be used the same only for the declared purpose. 
CHAPTER V 
REGISTRATION OF PERSONAL DATA PROCESSING SYSTEM 
SEC. 17. Application - Prior to the carrying out or commencing of 
personal data processing or the establishment of a system for personal data 
processing, a data controller shall first submit for the Commission's approval the 
personal data processing system it seeks to implement. For this purpose, the 
data controller shall submit an application to the Commission, which shall contain 
the following: 
1. A request for the grant of authority to implement a particular personal 
data processing system; 
2. Name of the data controller or data processor, date of its registration 
with the Commission, the place where its principal office is located, and the term 
for which it has been authorized by the Commission to act as such; 
3. The legal basis for the operation of the personal data processing 
system; 
4. The type of personal data tol be included in the system, the purposes 
for which it is intended and the scope of personal data to be processed; 
5. The categories of data subjects; 
6. The categories of recipients of personal data; 
7. The intended method of personal data processing; 


8. The planned method of obtaining personal data and a mechanism for 
the control of their quality; 
9. Other data processing systems which will be connected with the system 
to be registered 
10. Such other data systems which will be able to obtain data from the 
system to be registered, and what data the system to be registered will be able to 
obtain from connected systems; 
11. The method for transferring data from the system to be registered to 
another system; 
12. The identification codes of natural or juridical persons that will be used 
by the system to be registered; 
13. The method for exchanging information with the data subject; 
14. The procedures whereby a data subject is entitled to obtain 
information concerning himself or herself; 
15. The procedures for supplementing and updating of persona! data; 
16. Technical and organizational measures to ensure the protection of 
personal data; and 
17. What personal data will be transferred to other countries or 
jurisdictions. The registration procedure prescribed by this Act is not applicable to 
the personal data processing carried out by institutions specially authorized by 
law in the areas of public safety, law.enforcement, national security and defense. 
SEC. 18. Publication of Application - After the payment of filing fees and 
prior to the formal review of the application, the Commission shall, at the 
expense of the applicant, cause the publication of the items set out in 
subparagraph 1 and 2 of the preceding section and the notice of the formal 
review of the application once every week in at least (2) newspapers of general 
circulation for a period of and deadline for 'submission of comments three (3) 
consecutive weeks. If the required fees for the grant are not paid or the printing is 
not done in due time, the application shall be deemed withdrawn. 
SEC. 19. Following the publication of the application, any person may 
submit, in writing, his or her comments or opposition on the application. The 
comment or opposition shall be submitted to the Commission at least ten (15) 
days prior to the scheduled formal review of the application. The Commission 
shall notify the applicant of such comment or opposition and the latter may 
submit its comment or answer within ten (10) days from receipt of the notice. 
SEC. 20. The Commission shall conduct the formal review of the 
application within thirty (30) days from the publication of the application and shall 
approve or deny the application within thirty (30) days from the completion of the 
review. 


" 
SEC. 21. Amendment of Application - An applicant may amend its 
application on or before the date of review; Provided, that such amendment shall 
not include new matters outside the scope of the disclosures contained in the 
application as filed. If new matters are, to be included in the amended 
application, the same shall be treated as a new application and the 
corresponding time periods shall apply. 
SEC. 22. Grant of Authority- If the application meets all the requirements 
of this Act, the Commission shall grant the authority to implement the particular 
personal data processing system subject of the application. The grant to 
implement a personal data processing system shall take effect upon the issuance 
of certificate of registration. 
CHAPTER VI 
SECURITY OF DATA 
SEC. 23. Security of Data - (1) The data controller and data processor 
shall implement appropriate measures to protect personal data against natural 
dangers, such as accidental loss or destruction and human dangers such as 
unlawful access, fraudulent misuse, unlawful destruction, alteration, and 
contamination. These measures, specified in a written document or its 
equivalent, must be appropriate to the nature of the data to be protected and the 
risks represented by the processing. 
(2) The employees, agents or representative of the data controller, and data 
processor, and their representatives who are involved in the processing personal 
data shall operate hold personal data under strict confidentiality if these personal 
data are not intended for public disclosure. This obligation shall continue even 
after leaving the public service, transfer to another position or upon termination of 
employment or contractual relations. 
CHAPTER VII 
TRANSFER OF PERSONAL DATA 
SEC. 24. Transfer of Personal Data to Data Recipients in Foreign 
Jurisdiction - (1) Prior to the transfer of, personal data to reCipients in foreign 
jurisdictions, the consent of the data subject and the approval of the Commission 
must first be sought, except in the cases referred to in paragraph 3 of this 
section. 
(2) The Commission shall grant an authorization for transfer of personal data to 
foreign jurisdictions upon, finding and proof, that there is an adequate level of 
I 
personal data protection in such jurisdiction, taking into consideration: a) the 
existence and implementation 'of laws on protection of personal information in 
the jurisdiction; b) the nature of the data and the circumstances by which a data 
transfer operation may be done in such jurisdiction; and c) the purpose of the 
transfer, the duration of the use for the personal data, the respectability of the 
rights of the data subject provided in this Act in the foreign jurisdiction. 
(3) Without the authorization of, the Commission, personal data may, be 
transferred to a foreign jurisdiction or an international law enforcement 
organization only if: 


· ,. 
a. The transfer of personal data is necessary for the conclusion or 
performance of a contract between the data controller and a third party; 
b. The transfer of personal data is necessary for the performance of a 
contract between the data controller and the data subject or the implementation 
of pre- contractual measures; 
c. the transfer of personal data is necessary or required by a lawful order 
of a competent court of local jurisdiction; 
d. the persona1 data is contained in and is being transferred from a public 
data file in accordance with the procedure prescribed by laws and other rules and 
regulations. 
CHAPTER VIII 
PENAL PROVISIONS 
SEC. 25. Penalties for the Unauthorized Processing of Personal Data 
- The penalty of imprisonment ranging from six (6) to twelve (12) years and a fine 
of not less than one million pesos (Php 1,000,000.00) but not more than three 
million pesos (Php 3,000,000.00) shall be imposed on persons who process 
personal data without the consent ofthe data subject, or without being authorized 
I 
under this Act or any existing law. 
SEC. 26. Penalties for the Processing of Personal Data for 
Unauthorized Purposes - The penalty of imprisonment from six (6) years and 
one day to eight (8) years and a fine of not less than Five hundred thousand 
Philippine pesos (Php 500,000.00) but not more than one million Philippine 
pesos (Php 1,000,000.00) shall be imposed on persons processing personal data 
for purposes not authorized by the data subject, or otherwise authorized under 
this Act or under existing laws. 
SEC. 27. Malicious Disclosure. Any person who, with malice or in bad 
faith, discloses unwarranted or false information relative to any personal data 
obtained by him or her from a data controller or unknowingly transferred to him or 
her, shall be subject to a penalty of six (6) months and one (1) day to two (2) 
years and four (4) months of imprisonment and a fine of not less than One 
hundred thousand pesos (Php 100,000.00) but not more than Five hundred 
thousand pesos (Php500,000.OO). 
SEC. 28. Breach of Confidentiality The penalty of imprisonment ranging 
from two (2) years, four (4) months and one (1) day to four (4) years and two (2) 
months and a fine of, not less than Two hundred thousand pesos (Php 
200,000.00) but not more than Five Hundred Thousand pesos (Php 500,000.00) 
shall be imposed in case of a breach of confidentiality where such breach has 
resulted in the information being published or reported by media. In this case, the 
responsible reporter, writer, president, publisher, manager and editor-in-chief 
shall be liable under this Act. 


SEC. 29. Extent of Liability - If the offender is a corporation, association, 
partnership or any juridical person, the penalty shall be imposed upon the 
responsible officers, as the case may be, who participated in, or by their gross 
I 
negligence allowed the commission of the crime. If the offender is a juridical 
person, the court may suspend or revoke any of its rights under this Act. If the 
offender is an alien, he shall, in addition to the penalties herein prescribed, be 
deported without further proceedings after serving the penalties herein 
prescribed. If the offender is a public official or employee and he is found guilty of 
acts penalized under Sections 25 and 26 of this Act, he or she shall, in addition 
to the penalties prescribed herein, suffer' perpetual or temporary absolute 
disqualification from office, as the case may be. 
SEC. 30. Restitution. - Restitution for any aggrieved party shall be 
governed by the provisions of the New Civil Code. 
CHAPTER IX 
MISCELLANEOUS PROVISIQNS 
SEC. 31. Implementing Rules and Regulations - Within thirty (60) days 
from the appointment of the Executive Director of the Commission and the 
constitution of the Secretariat, the Commission shall promUlgate the rules and 
regulations to effectively implement the provisions of this Act. Said rules and 
regulations shall be submitted to the Congressional Oversight Committee for 
approval. Aside from those expressly stipulated under this Act, the Commission 
shall issue implementing rules and regulations (lRR), on the following: 
1. restrictions on the use and transfer of personal data to foreign jurisdictions; 
2. sanctions to be imposed by the Commission on: 
a. delay in or non-submission of reports it may require the data controller 
or data processor to submit in the performance of its functions; 
b. entities other than data controller or data processor, for breaches of 
confidentiality of, or misuse of, personal data obtained from the Commission. 
3. suspension or cancellation of the authority of data controllers andlor 
data protectors; 
4. measures by which the Commission may be allowed to release and 
disclose personal data without the consent of the data subject, consistent with 
existing laws and regulations. 
Upon the approval of the IRR by the Congressional Oversight Committee 
created under this Act, the same shall be immediately published in at least two 
(2) newspapers of general circulation. 
SEC. 32. Congressional Oversight Committee. - There is hereby 
created a Congressional Oversight Committee composed of seven (7) members 
from the Senate and seven (7) members from the House of Representatives. The 
members from the respective Houses shall be appointed by the Senate President 
or Speaker of the House of Representatives based on the proportional 
representation of the parties or coalitions therein with at least two (2) members of 


each House representing; the minority. The Oversight Committee shall have the 
power to promulgate its own rules, to oversee the implementation of this Act, and 
to review or revise the implementing rules issued by the Commission within thirty 
(30) days from the promulgation of the said rules. 
SEC. 33. Appropriations Clause - The Commission shall be provided 
with an initial appropriation of Twenty-five million Philippine pesos (Php 
25,000,000.00) to be drawn from the national government. Appropriations for the 
succeeding years shall be included in the General Appropriations Act. I 
SEC. 34. Separability Clause - If any part or provision of this Act shall be 
held unconstitutional or invalid, other provisions hereof that are not affected 
thereby shall continue to be in full force and effect. 
SEC. 35. Repealing Clause - All other laws, decrees, executive orders, 
proclamations and administrative .regulations, or parts thereof inconsistent 
I 
Herewith are hereby repealed or 
modified accordingly. 
SEC. 36. Effectivity Clause - This Act shall take effect fifteen (15) days 
after its publication in at least two (2) national newspapers of general circulation. 
Approved,