":t" , 
r,· 
FIFTEENTH CONGRESS OF THE REPUBLIC 
) 
.f§('"E <. 
: T, 
rr"l >i:' t,lf'{V 
" 
OF THE PHILIPPINES 
) 
First Regular Session 
) 
SEN~TJl 
S. No. 
GG36 
Introduced by Senator Miriam Defensor Santiago 
EXPLANATORY NOTE 
The government has the paramount interest of protecting the integrity and confidentiality 
of sensitive data maintained by its different agencies and instrumentalities. The giant leaps in 
technology in recent years make govermnent databases vulnerable to unauthorized intrusions by 
hackers. 
The purpose of this Act is to increase the security of sensitive data maintained by the 
govermnent. 1 
,. 
I This bill was originally filed in the Thirteenth Congress, Third Regular Session, 
1 


.. 
It 
FIFTEENTH CONGRESS OF THE REPl)BLIC 
) 
~;fiiCiJ.::<. ..;. i" 
;Jt~ \- n t: " ft. ii'" 
" 
OF THE PHILIPPINES 
) 
First Regular Session 
) 
SENATE 
S. No, 
223S 
Introduced by Senator Miriam Defensor Santiago 
1 
AN ACT 
2 
TO INCREASE THE SECURITY OF SENSITIVE DATA MAINTAINED BY THE 
3 
GOVERNMENT 
Be it enacted by the Senate and the House of Representatives of the Philippines in 
Congress assembled: 
4 
SECTION 1. Short Title, - This Act shall be known as the "Government Data Privacy 
5 
Protection Act." 
. ---
.~.-
.----~.~,.,-
~,.--
6 
SECTION 2. Declaration of Policy. - It is the policy of the State to protect the integrity 
7 
and confidentiality of sensitive data maintained by the government. Pursuant to this policy, this 
8 
Act shall increase the security of sensitive data maintained by the government. 
9 
SECTION 3. Definition of Terms. -For purposes of this Act, the term: 
, 
10 
(a) "Sensitive data" - includes the following: 
11 
(1) Social security numbers; 
12 
(2) Financial records; 
13 
(3) Previous or current health records, including hospital or treatment 
14 
records of any kind, including drug and alcohol rehabilitation records; 
15 
(4) Criminal records; 
16 
(5) Licenses; 
17 
(6) License denials, suspensions, or revocations; 
18 
(7) Tax returns; 
19 
(8) Information that has been specifically authorized under criteria 
20 
established by an Executive order or an Act of Congress to he kept classified in 
21 
the interest of national defense or foreign policy; 
1 
,
!


I 
(9) Personally identifiable information. 
2 
(b) "Personally identifiable information" - means any information, in any form or 
3 
medium that relates to the past, present, or future physical or mental health, 
4 
predisposition, or condition of an individual or the provision of health care to an 
5 
individual. 
. 
6 
SECTION 4. Requirement for Use of Encryption for Sensitive Data. -
7 
(a) Requirement for Encryption-
8 
(1) IN GENERAL - All sensitive data maintained by the government shall be 
9 
secured by the use of the most secure encryption standard recognized by the Department 
10 
of Science and Technology. 
11 
(2) UPDATING REQUIRED EVERY SIX (6) MONTHS - Any sequence of 
12 
characters (known as an encryption key) used to secure an encryption stan~ard _llse?,. on. 
13 
government computer systems shall be changed every six (6) months, at a minimum, to 
14 
provide additional security. 
15 
(3) IMPLEMENTATION - The requirements of this subsection shall be 
16 
implemented not later than six (6) months after the date of the enactment of this Act. 
17 
(b) Responsibility of the Head of an Agency - The head of each of the government shall 
18 
be responsible for complying with the requirements of subsection (a) within the agency. 
19 
SECTION 5. Requirements Relating to Access by Agency Personnel to Sensitive Data. -
20 
(a) On-Site Access - - No employee of the government shall have access to 
21 
sensitive data on Government property unless the employee has received' a security 
22 
clearance and has completed a financial disclosure form, in accordance with applicable 
23 
provisions oflaw and regulation. 
24 
(b) Off-Site Access -
25 
(1) PROHmITION - Sensitive data maintained by an agency may not be 
26 
transported or accessed from a location off Government property unless a request 
27 
for such transportation or access is submitted and approved by the head of the 
28 
agency in accordance with paragraph (2). 
2 


1 
(2) PROCEDURE -
2 
(A) DEADLINE FOR APPROVAL OR DISAPPROVAL - In the 
3 
case of' any request submitted under paragraph (1) to the head of an 
4 
agency, the head of the agency shall approve or disapprove the request 
5 
within two (2) business days after the date of submission of the request. 
6 
(B) LIMITATION TO TEN THOUSAND (10,000) RECORDS-
7 
If a request is approved, the head ofthe agency shall limit the access to not 
8 
more than ten thousand (10,000) records at a time. 
9 
(3) ENCRYPTION - Any technology used to store, transport, or access 
10 
sensitive data for purposes of off-site access approved under this subsection shall 
11 
be secured by the use of the most secure encryption standard recognized by the 
12 
Department of Science and Technology. 
13 
(c) Implementation. - The requirements of this subsection shall be impjemerit~'ir'-'- - .. 
14 
not later than six (6) months after the date of the enactment of this Act. 
15 
SECTION 6. Requirements Relating to Government Contractors Involving Sensitive 
16 
Data. -
17 
(a) Applicability to Gove~ent Contractors - In entering into any contract that 
18 
may involve sensitive data in electronic or digital form on ten thousand (10,000) or more 
19 
Filipino citizens, an agency shall require the contractor and employees of the contractor 
20 
(0 comply with the requirements of Sections 4 and 5 of this Act in the performance of the 
21 
contract. In the same manner as agencies and government employees comply with such 
22 
requirements. 
23 
(b) Implementation - The requirements of this subsection shall be implemented 
24 
with respect to contracts entered into on or after thc date occurring six (6) months after 
25 
the date of the enactment of this Act. 
26 
SECTION 7. Appropriations. -
Such sums as may be necessary for the initial 
27 
implementation of this Act shall be taken from the current appropriations of the government 
3 
i 
;' 


• 
1 
agency involved. Thereafter, the fund necessary to carry out the provisions of this Act shall be 
2 
included in the annual General Appropriations Act. 
3 
SECTION 8. Separability Clause: - In my provision, or part hereof, is held invalid or 
4 
unconstitutional, the remainder of the law or the provision not otherwise affected shall remain 
5 
valid and subsisting. 
6 
SECTION 9. Repealing Clause. C Any law, presidential decree or issuance, executive 
7 
order, letter of instruction, administrative order, rule or regulation contrary to or inconsistent 
8 
with the provisions of this Act is hereby repealed, modified, or amended accordingly. 
9 
SECTION 10. Effectivity. - This Act shall take effect fifteen (15) days after its 
10 
publication in at least two (2) newspaper~ of general circulation. 
Approved, 
Iptmt05ju!y201O 
4