TWENTIETH CONGRESS OF THE 
)
REPUBLIC OF THE PHILIPPINES 
)
First Regular Session 
)
'■ ''affuTair.,'
25 AUG-6 P]:40
S. No.
SENATE
1032
Rl'CCiVcO BV
Introduced by Senator Jinggoy Ejercito Estrada
AN ACT
PROTECTING THE USERS OF RADIO FREQUENCY IDENTIFICATION 
DEVICES
EXPLANATORY NOTE
The use of Radio Frequency Identification (RFID) tags and trackers are 
proven useful, convenient and economical in various industries. They are widely 
used in the transportation sector for toll, train and bus cards. It is also embedded in 
identification documents such as passports, company IDs, school IDs, and 
membership IDs. RFIDs are reliable devices for tracking both objects and persons 
such as merchandise, packages, pets, or patients in hospital settings.
The National Telecommunications Commission (NTC) issued in 2006 
Memorandum Circular No. 03-08-2006 regarding the Use and Operation of Radio 
Frequency Identification (RFID) within the 13.553-13.567 MHz, 918-920 MHz, and 
2446-2454 MHz Bands. It regulates the approval, acceptance, registration and 
licensing of RFID proximity readers and provides for penalties for violations of its 
provisions.
The "RFID Users Protection Act' seeks to provide complete and appropriate 
information to the consumers about the use of RFID tags and protect them from 
unauthorized access to their personal information stored in the said tags. It also


mandates the seller or user of RFID tags to employ security measures to ensure that 
are consistent with industry standards and are commensurate with the amount and 
sensitivity of the information being stored in the system.
In this light, the immediate passage of this bill is highly recommended.
NGQOY EJERCITO ESTRADA


TWENTIETH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session
Ol'I11 ri’ oE li''
)
SENATE
S. No. 1032
25 AUG-6 PI *40
lUXLlv :D 2'
Introduced by Senator Jinggoy Ejercito Estrada
AN ACT
PROTECTING THE USERS OF RADIO FREQUENCY IDENTIFICATION 
DEVICES
Be it enacted by the Senate and House of Representatives of the Philippines in 
Congress assembled:
1 
Section 1, Short Title. - This Act shall be known as the "RFID Users
2 
Protection Act.
3 
Sec. 2. Definition of Terms. - As used in this Act, the term:
4 
(a) Data means personal information, numerical values associated with a
5 
person's facial features, or unique personal identifier numbers stored in
6 
an identification device;
7 
ib) Identification device means an item that uses radio frequency
8 
identification technology;
9 
(c) Personal Information includes any of the following information
10
associated with an individual:
11
(1)
Social security number;
12
(2)
Driver's license number;
13
(3)
Bank account number;
14
(4)
Credit or debit card number;
15
(5)
Personal identification number;
16
(6)
Automated or electronic signature;
17
(7)
Unique biometric data;


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
32
(8) 
Account passwords;
(9) 
Telephone number;
(10) Address;
(11) Date of birth; or,
(12) Any other piece of information that can be used to access an 
individual's financial accounts or to obtain goods or services, 
or offer goods or services based on that information without 
an individual's consent;
(d) Radio frequency identification or RFID means a technology that uses 
radio waves to transmit data remotely to readers and are intended to 
carry data in suitable transponders, generally known as tags, and to 
retrieve data, by hand- or machine-readable means, at a suitable time 
and place to satisfy particular application needs. Data within a tag 
may provide identification of an item, goods in transit, a location, the 
identity of persons and/or their belongings, a vehicle or assets, an 
animal or other types of information;
RFID systems employ tiny chips and wireless antennas that can be 
embedded into products and used for unique identification purposes. 
It is a contact-less solution that works with proximity readers and RFID 
tags.
(e) Proximity reader is a device that transmits an interrogating / querying 
signal to an RFID tag and receives unique information from the tag. 
Readers have two high level versions - those that store data and those 
that simply store a reference key for look-up on host system;
(f) Remotely means that no physical contact between the identification 
device and the reader is necessary in order to transmit data; and,
(g) RFID tag is a microchip attached to an antenna that picks up signals 
from and sends signals to a reader. A tag contains a unique number, 
but may have other information. RFID tags may be classified as:
1) Active tag which is used for long distance purposes such as in toll 
highways, parking areas, and gas stations. This tag uses small 
batteries which enable it to send signals at a longer distance; and.


1 
2) Passive tag which is used very near or in close proximity to a
2 
reader and does not use any internal battery.
3 
(h) Unique persona! identifier number means a randomly assigned string of
4 
numbers or symbols that is encoded on the identification device and is
5 
intended to identify the identification device.
6 
Sec. 3. Notice Requirement - Any person who sells, issues, or distributes
7 
items containing an RFID tag must post a notice informing the consumer of the use
8 
of such technology. The notice must disclose the following information:
9 
a) The item contains or may contain an electronic communication device;
10 
b) The consumer has the legal right to request that an item containing an
11 
RFID tag be removed or deactivated before the item leaves the store
12 
premises; and,
13 
c) The consumer has the right to request a copy of all personal
14 
information collected about himself or herself through an RFID tag,
15 
including the identity of any person 
who has had access to the
16 
consumer's personal information.
17 
Sec. 4. Labeiiing Requirement - Any person who sells, uses or distributes an
18 
item that contains an RFID tag must label the item with a notice stating that:
19 
a) The item contains an RFID tag capable of engaging in electronic
20 
communication; and,
21 
b) The RFID tag can transmit personal information to an independent
22 
reader or scanner both before and after purchase or issuance.
23 
Sec. 5. Requesting Review of Persona! Information. — A consumer may
24 
request all stored personal information pertaining to himself or herself, including the
25 
identity of any individual or entity who has had access to the consumer's personal
26 
information. After reviewing one's personal information, the consumer must be
27 
given the opportunity to contest the accuracy of his or her personal data, correct or
28 
amend the data, and request that the information be removed or destroyed from the
29 
database, unless such removal or destruction is prohibited by law.
30 
Sec. 6. Removal or Deactivation. - Upon request by a consumer, a person
31 
who sells, issues or distributed an item containing an RFID tag must remove or
32 
deactivate the device before the consumer leaves the store premises. Any costs


1 
associated with removal or deactivation cannot be passed on to the consumer. Once
2 
deactivated, it must not be reactivated without the express written consent of the
3 
consumer associated with the item.
4 
Sec. 7. Security Measures. - Any person who sells or utilizes an RFID tag
5 
must implement adequate security measures to ensure that information is secure
6 
from unauthorized access, loss or tampering. These security measures should be
7 
consistent with industry standards that are commensurate with the amount and
8 
sensitivity of the information being stored on the system.
9 
Sec. 8. Unauthorized Scanning and Other Prohibited Uses. - A person may
10 
not use an electronic communication devise to remotely scan, or attempt to scan, an
11 
item associated with a consumer without the consumer's knowledge. A person may
12 
not disclose, either directly or through an affiliate, a consumer's personal information
13 
associated with information gathered by, or contained within, an RFID tag. A person
14 
may not use, either directly or through an affiliate or non-affiliated third party,
15 
information gathered by, or contained within, an 
RFID tag in order to identify a
16 
consumer.
17 
Sec. 9. Penaity for Uniawfui Scanning. - A person who intentionally scans
18 
another person's identification device remotely, without that person's prior
19 
knowledge and prior consent, for the purpose of fraud, identity theft, or for any
20 
other purpose, shall be subject to a fine of not less than Fifty thousand pesos
21 
(P50,000.00) but not more than Five hundred thousand pesos (P500,000.00).
22 
Sec. 10. Separabiiity Cause. - If any part, section or provision of this Act is
23 
held invalid or unconstitutional, other provisions not affected thereby shall remain in
24 
full force and effect.
25 
Sec. 11. Repealing Cause. — All laws, decrees, orders, rules and regulations
26 
or parts thereof inconsistent with this Act are hereby repealed or amended
27 
accordingly.
28 
Sec. 12. Effectivity. - This Act shall take effect fifteen (15) days after its
29 
publication in the Official Gazette or in two (2) newspapers of general circulation.
Approved,