Republic of the Philippines
HOUSE OF REPRESENTATIVES,
Quezon City

SEVENTEENTH CONGRESS
Second Regular Session

HOUSE BILL nov? 1

Introduced by REP. Michael L. Romero

EXPLANATORY NOTE

It is the policy of the republic of the Philippines to hereby protect the
fundamental human right of privacy, of communication while ensuring free flow
of information to promote innovation and growth.

The State recognizes the vital role of information and communications
technology in nation-building and its inherent obligation to ensure that personal
information in information and communications systems in the government and
in the private sector are secured and protected.

This House Bill seeks to foster protection for individual personal information in
information and communications systems in the government and the private
sector, providing stiffer provisions, rationalize all existing rules and regulations,
and creating a more effective and sufficient data privacy scheme.



Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

SEVENTEENTH CONGRESS
Second Regular Session

rat

HOUSE BILL Ni

Introduced by REP. Michael L. Romero

AN ACT
AMENDING REPUBLIC ACT NO.10173, OTHERWISE KNOWN AS THE
“DATA PRIVACY ACT OF 2012”, TO ADOPT A MORE SYSTEMATIC,
COMPREHENSIVE AND EFFECTIVE PROTECTION PROGRAM, TO FOSTER
THE IMPOSITION OF ALL EXISTING POLICIES AND GUIDELINES,
INCREASING ITS PENALTIES AND SANCTIONS, AND FOR OTHER
PURPOSES

Be it enacted by the Senate and House of Representative of the
Philippines in congress assembled:

SECTION 1.

Section 25 of chapter Vill of Republic Act No. 10173, is hereby amended to read
as follows:

CHAPTER VIII
PENALTIES


SECTION 25. Unauthorized Processing of Personal Information and Sensitive
Personal Information —

(a) The unauthorized processing of personal information shall be
penalized by imprisonment ranging from two (2) years to four (4)
years and a fine of not less than One million pesos (Php1,000,000.00)
but not more than Two million pesos (Php2,000,000.00) shall be
imposed on persons who process personal information without the
consent of the data subject, or without being authorized under this

Act or any existing law.

(b) The unauthorized processing of personal sensitive information
shall be penalized by imprisonment ranging from three (3) years to
six (6) years and a fine of not less than One million pesos
(Php1,000,000.00) but not more than Four million pesos
(Php4,000,000.00) shall be imposed on persons who process
personal information without the consent of the data subject, or
without being authorized under this Act or any existing law.

SECTION 2.

Section 26 of chapter Vill of Republic Act No. 10173, is hereby amended to read

as follows:

SECTION 26. Accessing Personal Information and Sensitive Personal
Information Due to Negligence -

(a) Accessing personal information due to negligence shall be
penalized by imprisonment ranging from two (2) years to four (4)
years and a fine of not less than One million pesos (Php1,000,000.00)


but not more than Three million pesos (Php3,000,000.00) shall be
imposed on persons who, due to negligence, provided access to
personal information without being authorized under this Act or any

existing law.

(b) Accessing sensitive personal information due to negligence shall
be penalized by imprisonment ranging from three (3) years to six (6)
years and a fine of not less than One million pesos (Php1,000,000.00)
but not more than Four million pesos (Php4,000,000.00) shall be
imposed on persons who, due to negligence, provided access to
personal information without being authorized under this Act or any

existing law.

SECTION 3.

Section 27 of chapter VIII of Republic Act No. 10173, is hereby amended to read

as follows:

SECTION 27.Improper Disposal of Personal Information and Sensitive

Personal Information—

(a) The improper disposal of personal information shall be penalized
by imprisonment ranging from one (1) year to three (3) years and a
fine of not less than Three hundred thousand pesos (Php300,000.00)
but not more than One million pesos (Php1,000,000.00) shall be
imposed on persons who knowingly or negligently dispose, discard
or abandon the personal information of an individual in an area
accessible to the public or has otherwise placed the personal
information of an individual in its container for trash collection.


b) The improper disposal of sensitive personal information shall be
penalized by imprisonment ranging from two (2) years to four (4)
years and a fine of not less than Five hundred thousand pesos
(Php500,000.00) but not more than Two million pesos
(Php2,000,000.00) shall be imposed on persons who knowingly or
negligently dispose, discard or abandon the personal information of
an individual in an area accessible to the public or has otherwise
placed the personal information of an individual in its container for

trash collection.

SECTION 4.

Section 28 of chapter Vill of Republic Act No. 10173, is hereby amended to read

as follows:

SECTION 28. Processing of Personal Information and Sensitive Personal
Information for Unauthorized Purposes —The processing of personal
information for unauthorized purposes shall be penalized by imprisonment
ranging from three (3) years to six (6) years and a fine of not less than One
million pesos (Php1,000,000.00) but not more than Three million pesos
(Php3,000,000.00) shall be imposed on persons processing personal
information for purposes not authorized by the data subject, or otherwise

authorized under this Act or under existing laws.

The processing of sensitive personal information for unauthorized purposes
shall be penalized by imprisonment ranging from three (3) years to seven
(7) years and a fine of not less than One million pesos (Php1,000,000.00)
but not more than Three million pesos (Php3,000,000.00) shall be imposed

‘on persons processing sensitive personal information for purposes not


authorized by the data subject, or otherwise authorized under this Act or

under existing laws.

SECTION 5.

Section 29 of chapter VIII of Republic Act No. 10173, is hereby amended to read

as follows:

SECTION 29. Unauthorized Access or Intentional Breach -The penalty of
imprisonment ranging from two (2) years to four (4) years and a fine of not
less than One (1) milion pesos (Php1,000,000.00) but not more than Three
million pesos (Php3,000,000.00) shall be imposed on persons who
knowingly and unlawfully, or violating data confidentiality and security
data systems, breaks in any way into any system where personal and

sensitive personal information is stored.

SECTION 6.

Section 30 of chapter Vill of Republic Act No. 10173, is hereby amended to read

as follows:

SECTION 30.Concealment of Security Breaches Involving Sensitive
Personal Information — The penalty of imprisonment of three (3) years to six
(6) years and a fine of not less than One million pesos (Php1,000,000.00)
but not more than Three million pesos (Php3,000,000.00) shall be imposed
‘on persons who, after having knowledge of a security breach and of the
obligation to notify the Commission pursuant to Section 20(f) of RA10173,

intentionally or by omission conceals the fact of such security breach.


SECTION 7.

Section 31 of chapter VIII of Republic Act No. 10173, is hereby amended to read

as follows:

SECTION 31. Malicious Disclosure. - Any personal information controller or
personal information processor or any of its officials, employees or agents,
who, with malice or in bad faith, discloses unwarranted or false
information relative to any personal information or personal sensitive
information obtained by him or her, shall be subject to imprisonment
ranging from three (3) years to six (6) years and a fine of not less than One
million pesos (Php1,000,000.00) but not more than Three million pesos
(Php3,000,000.00).

SECTION 8.

Section 32 of chapter Vill of Republic Act No. 10173, is hereby amended to read

as follows:
SECTION 32. Unauthorized Disclosure —

(a) Any personal information controller or personal information
processor or any of its officials, employees or agents, who discloses
to a third party personal information not covered by the
immediately preceding section without the consent of the data
subject, shall he subject to imprisonment ranging from two (2) years
to four (4) years and a fine of not less than One million pesos
(Php1,000,000.00) but not more than Three million pesos
(Php3,000,000.00).


(b) Any personal information controller or personal information
processor or any of its officials, employees or agents, who discloses
to a third party sensitive personal information not covered by the
immediately preceding section without the consent of the data
subject, shall be subject to imprisonment ranging from three (3)
years to six (6) years and a fine of not less than One million pesos
(Php1,000,000.00) but not more than Three million pesos
(Php3,000,000.00).

SECTION 9.

Section 33 of chapter Vill of Republic Act No. 10173, is hereby amended to read

as follows:

SECTION 33. Combination or Series of Acts. - Any combination or series of
acts as defined in Sections 25 to 32 shall make the person subject to
imprisonment ranging from three (3) years to six (6) years and a fine of not
less than Two million pesos (Php2,000,000.00) but not more than Five million
pesos (Php5,000,000.00).

SECTION 10.

Section 34 of chapter VIII of Republic Act No. 10173, is hereby amended to read

as follows:

SECTION 34.Extent of Liability.- If the offender is a corporation,
partnership or any juridical person, the penalty shall be imposed upon the
responsible officers, as the case may be, who participated in, or by their


gross negligence, allowed the commission of the crime. If the offender is a
juridical person, the court may suspend or revoke any of its rights under
this Act.

If the offender is an alien, he or she shall, in addition to the penalties
herein prescribed, be deported without further proceedings after serving
the penalties prescribed. If the offender is a public official or employee
and lie or she is found guilty of acts penalized under Sections 27 and 28 of
this Act, he or she shall, in addition to the penalties prescribed herein,
suffer perpetual absolute disqualification from office, as the case may be.

SECTION 11.

Section 41 of chapter IX of Republic Act No. 10173, is hereby amended to read
as follows:

CHAPTER IX
MISCELLANEOUS PROVISIONS.

SECTION 41. Appropriations Clause. - The Commission shall be provided
with an initial appropriation of Twenty million pesos (Php20,000,000.00) to
be drawn from the national government.

Appropriations for the succeeding years shall be included in the General
Appropriations Act (GAA). It shall likewise receive a continuing
appropriations of Twenty million pesos (Php20,000,000.00) per year, and
every year after upon implementation of this Act drawn from the national

government.


SECTION 12.

Section 42 of chapter IX of Republic Act No. 10173, is hereby amended to read

as follows:

SECTION 42. Transitory Provision. — Existing industries, businesses and offices
affected by the implementation of this Act shall be given six (6) months
transitory period from the effectivity of the IRR or such other period as may
be determined by the Commission, to comply with the requirements of
this Act.

SECTION 13. IMPLEMENTING RULES AND REGULATIONS. — The
departments and agencies charged with carrying out the provisions of
this Act shall, within sixty (60) days after the effectivity of this Act, formulate

the necessary rules and regulations for its effective implementation.

SECTION 14. REPEALING CLAUSE. - All laws, decrees, executive
orders, rules and regulations, or parts thereof inconsistent with the

provisions of this Act are hereby repealed or modified accordingly.

SECTION 15. SEPARABILITY CLAUSE. ~ If, for any reason, any section
or provision of this Act is held unconstitutional or invalid, the other sections
or provisions hereof shall not be affected thereby.

SECTION 16. EFFECTIVITY CLAUSE. - This Act shall take effect after
fifteen (15) days from its publication in the Official Gazette or in at least
two (2) national newspapers of general circulation whichever comes

earlier.

Approved,