FOURTEENTH CONGRESS OF THE 
) 
REPUBLIC OF THE PHILIPPINES 
) 
First Regular Session 
) 
Introduced by Senator Loren Legarda 
EXPLANATORY NOTE 
This bill seeks to penalize identity theft and misappropriation of sensitive 
personal information maintained in databases to uphold the right of privacy guaranteed 
under our Constitution. 
Article I1 of the Philippine Constitution, our Bill of Rights, provides at least two 
guarantees that clearly identify zones of privacy or a person’s ”right to be let alone” or 
the ”right to determine what, how much, to whom and when idormation about himself 
shall be disclosed”. Section 2 guarantees “the right of the people to be secure in their 
persons, houses, papers and effects qgainst unreasonable searches and seizures of 
whatever nature and for any purpose.” Section 3 renders inviolable the “privacy of 
communication and correspondence” and further cautions that ”any evidence 
obtained in violation of this or the preceding section shall be inadmissible for any 
purpose in any proceeding.” These are zones of privacy created by the Constitution that 
must not be subject to unreasonable government intrusion. 
But while the State provides for such protection, legislation is needed to address 
the lack of safeguard to the right of privacy which has become more vulnerable to 
unnecessary intrusion and manipulation of unscrupulous individuals and entities that 
take advantage of the advances of modern technology. 
This bill aims to address such loophole by penalizing identity theft and making it 
compulsory for all persons, corporations, partnerships, associations or any other legal 
entities organized under Philippine laws to put in place reasonable security and 
notification procedures and practices to prevent any breach of security and violation of 
the right of privacy of persons. 
Under this bill, identity theft is defined as fraud committed using the sensitive 
personal information of another individual with the intent to commit, or to aid or abet 
any unlawful activity that constitutes a violation of any existing laws and result in 
economic loss to that individual. Identity theft is penalized with imprisonment of not 
exceeding ten years or a fine ranging from one hundred thousand pesos (PlO0,OOO.OO) to 
five hundred thousand pesos (P500,0O0.00), or both,,at the discretion of the court. 
In view of the foregoing, immediate passage of this bill is earnestly requested. 
Senator 


FOURTEENTH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session 
S.B. SENY&l. 
No. - 
Infroduced by Senator Loren Legarda 
AN ACT 
PROHIBITING THE MISAPPROPRIATION OF PERSONAL INFORMATION IN 
DATABASE AND COLLECTIONS OF INFORMATION, PROVIDING 
A 
MECHANISM FOR PROTECTION AGAINST IDENTITY THEFT, AND FOR 
OTHER PURPOSES 
Be it enacted by the Senate and the House of Representatives of the Philippines in 
Congms assem.bled: 
Section 1. Title - This Act shall be known as the "Personal Data Protection Act of 
2007". 
Section 2. Declaration of Policy.- It shall be the policy of the State to protect the 
zones of privacy by an individual from any form of intrusion unless excused by law and 
in accordance with customary legal process, pursuant to the constitutional guarantee of 
the right to privacy which must be upheld at all times and to the Philippines' adherence 
to. the Universal Declaration of Human Rights which mandates that, "no one shall be 
subjected to arbitrary interference with his privacy" and "everyone has the right to the 
protection of the law against such interference or attacks." 
Section 3. Definition of Terms. - As used in this Act, the following terms are 
defined as follows: 
a. Database - a collection of a large number of discrete items of information 
produced for the purpose of bringing such discrete items of information together 
in one place or through one source so that persons may access them; 
b. Identity Theft - a fraud committed using the sensitive personal information of 
another individual with the intent to commit, or to aid or abet any unlawful 
activity that constitutes a violation of any existing laws and results in economic 
loss to that individual; 
c. Information - facts, data, works of authorship, or any other jntangible material 
capable of being generated or gathered; 
d. Maintain a database - update, validate, or supplement the information contained 
in the database; 
' 
e. Making available in commerce to others - making available in commerce to a 
substantial number of members of the public or a number of persons that 
extends beyond a family and its social acquaintances or those who could 
reasonably anticipate to have access to such database without need of prior 
customary commercial relationship; 


f. Personal Information - personally identifiable information about a specific 
individual; 
g. Sensitive personal information - an individual's first name and surname in 
combination with any one or more of the following data elements, such as those 
that relate, but not limited to, an individual's financial account, credit standing, 
health conditions, and lineage and pedigree. 
Section 4. Prohibition Against Misappropriation of Datab'ases. - It shall be 
unlawful for any person to knowingly make available in commerce to others sensitive 
personal information in a database generated, gathered or maintained about a person if 
such act resulted to - 
a. the damage, disruption and ineffectiveness of the information generated, 
gathered or maintained in the database, or 
b. the prejudice of the person with whom the personal information pertains, in the 
absence of a prior written permission. 
Section 5. Database Security. - Any person, corporation, partnership, association 
or any entity organized under Philippine laws that owns or licenses database containing 
sensitive personal information shall develop, implement, and maintain reasonable 
security and notification procedures and practices appropriate to the scope and nature 
of the information maintained to ensure the security and confidentiality of the personal 
information and protect it against any unauthorized access, destruction, use, 
modification or disclosure. 
Section 6. Notification Requirements. - If such person, corporation, partnership, 
association or entity that owns or licenses databases containing "sensitive personal 
information determines, after discovery and a reasonable investigation, or notification 
pursuant to the succeeding.paragraph, that a significant risk of identity theft exists as a 
result of a breach of security of the database maintained by it, it shall be its duty to 
inform and notify, in the most expeditious manner without unnecessary delay, any 
individual whose personal information was compromised. 
Any person, corporation, partnership, association or any entity organized under 
Philippine laws in possession of computerized data containing sensitive personal 
information that the agency or person does not own or license shall notify and 
cooperate with the owner or licensor of the information upon the discovery of a breach 
of security of the database in the most expeditious manner without unnecessary delay. 
Section 7. Penalties. - Any person found guilty of violating Section 4,5 and 6 of 
this Act shall be punished with imprisonment of not exceeding ten years or a fine 
ranging from one hundred thousand pesos (PlOO,OOO.00) to five hundred thousand 
pesos (P500,000.00), or both, at the discretion of the court. 
If the offense is committed by, or in conspiracy with, a corporation, the officers 
and directors of the said corporation shall be jointly and solidarily liable with the 
corporation. 
Section 8. Separability Clause. - The provisions of this Act are hereby declared 
to be separable. If any provision of this Act shall be held unconstitutional, the reminder 
of the Act not otherwise affected shall remain in full force and effect. 
Section 9. Repealing Clause. - All laws, executive orders, rules and regulations. 
Or parts thereof, inconsistent herewith are hereby repealed or modified accordingly. 


Section 10. Effectivity Clause. - This Act shall take effect within fifteen (15) days 
from its publication in at least two (2) national newspapers of general circulation. 
Approved,