TIHII<TEL~N?" CONGIIESS OF THE REPlJBLIC ) 
01: THE PHILIPPINES 
1 
Third Regular Session 
1 
Introduced by Senator Miriam Defcnsor Santiago 
EXPLANATORY NOTE 
The government has the paramount interest of protecting the integrity and confidentiality 
of sensitive data maintained by its different agencies and instrumentalities. The giant leaps in 
technology in recent years make government databases vulnerable to unauthorized intrusions by 
hackers. 
The purpose of this Act is to increase the security of sensitive data maintained by the 
government. 
1 


‘lIII1CrEENTtI CONGRESS OF THE REI’IJBLIC ) 
OF THE PHILIPPINES 
) 
Third Regular Session 
) 
Introduced by Senator Miriam Defensor Santiago 
AN ACT 
INCREASING THE SECURITY OF SENSITIVE DATA 
MAINTAINED BY THE GOVERNMENT 
Be it enacted by the Senate and the House of Representatives of the Philippines in 
Congress assembled: 
SECTION 1. Short Title. - This Act shall be known as the “Government Data Privacy 
Protection Act of 2007.” 
SECTION 2. Declaration of Policy. - It is the policy of the State to protect the integrity 
and confidentiality of sensitive data maintained by the government. Pursuant to this policy, this 
Act shall increase the security of sensitive data maintained by the government. 
SECTION 3. Dejnition of Terms. - For purposes of this Act, the term: 
(a) “Sensitive data” - includes the following: 
(1) Social security numbcrs; 
(2) Financial records; 
(3) 1)revious or current health records, including hospital or treatmcnt 
records of iuiy kind, including drug and alcohol rehabililaiion rccords; 
(4) Criminal records: 
(5) Licenses; 
(6) License denials, suspcnsions, or revocations: 
(7) Tax returns; 
2 


(8) Inrorniation that has been specifically authorid under criteria 
established by an Executive order or an Act of Congress to bc ltcpt classificd in 
the interest or national defense or foreign policy; 
(9) l’ersonally identifiable information. 
(b) “Personally identifiable information” - means any information, in any fbrm or 
medium that relates to the past, present, or future physical or inental hcalth, 
predisposition, or condition of an individual or the provision of hcalth care to an 
individual. 
(a) Requirement for Encryption - 
(1) IN GENERAL - All sensitive data maintained by the governmcnt shall 
be sccurcd by the use of the most sccurc cncryption standard rccognizcd by thc 
Department of Science and Technology. 
(2) UPDATING REQUIRED E3ERY SIX (5) MON rlIS 
Any sequence 
of characters (known as an encryption key) used to securc an encryption standard 
used on government computer systems shall be changed every six (6) months, at a 
niininiuni, to provide additional security. 
(3) IMPLEMENTATION - The requirements of this subsection shall be 
implcmentd not later than six (6) inoiiths aftcr the date of the cnactnicnt of this 
Act. 
(b) Responsibility of the Head of an Agency -- The head of each of the 
govcmment shall be responsible for complying with the rcquiremcnts of subscction (a) 
within the agency. 
3 


(a) On-Site Access - No einployce of thc government shall haw access to 
sensitive data on Government properly unless the employee has received a security 
clearance and has completed a financial disclosure form, in accordancc with applicable 
provisions of law and regulation. 
(b) Off-Site Access -. 
(1) L~IUII~IBL'I'ION -- Sensitive data maintained by an agcncy may not be 
transported or accessed from a location off Government propcrty unless a request 
for such transportatioli or access is subinittcd and approved by tlic head of thc 
agency in accordance with paragraph (2). 
(2) PROCEDURES - 
(A) I)EAl>LINt: FOR APPROVAL OK DISAPL'ROVAL- In the 
case of any request submitted under paragraph (I) to the head of an 
agcncy, thc hcad of the agcncy shall approve or disapprobc the request 
within two (3) business clays after the date of submission of the rcqucst. 
(B) LIMITATION TO TEN THOUSAND (10,000) RECORDS --- 
Tf a request is approvcd, the hrad ofthc agcncy shall limit the access to not 
inore than ten thousand (1 0.000) records at a time. 
(3) IiNCI<YPI'ION - Any tcchnology used to store, transport. or acccss 
sensitive data for purposes of off-site access approved under this subsection shall 
be secured by the use of the most secure encryption standard recognized by the 
Department of Science and Technology. 
(cj Implementation - The requirements of this subsection shall be implemented 
not later than six (6) months after the date ofthe cnactment ofthis Act. 
4 


SECTION 6. Requirerneiils Relating 10 Governnzeni C,’(inrr.uciitrs Involving 2Sensitive 
I M U .  - 
(a) Applicability to Government Contractors -- In entering into any contract that 
may involve sensitive data in electronic or digital forni on ten thousand ( I  0;OOO) or niorc 
Filipino citizens, an agency sl~all require the contractor and employees of the contractor 
to comply with thc requirements of sections 4 and 5 of this Act in the perforniance of the 
contract, in the same manner as agencies and government employees comply with such 
rcqui rcments . 
(b) Implementation - The requirements of this subsection shall bc implemented 
with respect to contracts entered into on or after the date occurring six (6) months after 
the date ofthe enactment of this Act. 
SECTION 7. 
Approp~io/jon.~. 
.. Such sums as may be necessary fir thc initial 
iniplenientation of this Act shall be taken from the current appropriations of the govcrnmcnt 
agency involved. Thereafler, the fund necessary to carry out the provisions of this Act shall bc 
itlcludcd in the annual General Appropriations Act. 
SECTION 8. Separability Clause. - In any provision, or part hereof, is held invalid or 
unconstitutional, the remainder of the law or the provision not otherwise affected shall remain 
valid and subsisting. 
SECTION 9. Repealing Clause. - Any law, presidential decree or issuance, executive 
order, letter of instruction, administrative order, rule or regulation contrary to or inconsistent 
with the provisions of this Act is hereby repealed, modified, or amended accordingly. 
SECTION 10. E’ectivity. 
- This Act shall take effect fifteen (15) days after its 
publication in at least two (2) newspapers of general circulation. 
Approved, 
/jab 
5