FIFTEENTH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session 
) 
) 
) 
SENATE 
S.B.No. 
1425 
,~ 
()-j;.~,. I~',": 
; J" ":l~~' 
':r:~"" 
fo 
, .. ,',~,(.,,"",'> (.'\,'. 
---/ 
, 
• 
c, 
• 
, 
__ ' ............ 
'" 
.,# 
Introduced by Senator Loren Legarda 
EXPLANATORY NOTE 
This bill seeks to penalize identity theft and misappropriation of sensitive 
personal information maintained in databases to uphold the right of privacy guaranteed 
under our Constitution. 
Article II of the Philippine Constitution; our Bill of Rights, ptovides at least two 
guarantees that clearly identify zones of privacy or a person s "right to be let alone" or 
the "right to determine what, how much, to whom and when information about himself 
shall be disclosed". Section 2 guarantees "the right of the people to be secure in their 
persons, houses, papers and effects against umeasonable searches and seizures of 
whatever nature and for any purpose." Section 3 renders inviolable the "privacy of 
communication and correspondence" and further cautions that" any evidence obtained 
in violation of this or the preceding section shall be inadmissible for any purpose in any 
proceeding." These are zones of privacy created by the Constitution that must not be 
subject to unreasonable government intrusion. 
While the State provides for such protection, legislation is needed to address the 
lack of safeguard to the right of privacy, which has become more vulnerable to 
unnecessary intrusion and manipulation of unscrupulous individuals and entities that 
take advantage of the advances of modern technology such as the internet. 
This bill aims to address such a loophole by penalizing identity theft and making 
it compulsory for all persons, corporations, partnerships, associations or any other legal 
entities organized under Philippine laws to put in place reasonable security and 
notification procedures and practices to prevent any breach of security and violation of 
the right of privacy of persons. 
Under this bill, identity theft is defined as fraud committed using the sensitive 
personal information of another individual with the intent to commit, or to aid or abet 
any unlawful activity that constitutes a violation of any existing laws and result in 
economic loss to that individual. Identity theft is penalized with imprisonment of not 
exceeding ten (10) years or a fine ranging from one hundred thousand pesos 
(P100,000.00) to five hundred thousand pesos (P500,000.00), or both, at the discretion of 
the court. 
In view of the foregoing, the immediate passage of this bill is earnestly sought. 
~DA 
Senator 


FIFTEENTH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session 
) 
) 
) 
SENATE 
~.B. No. 1425 
Introduced by Senator Loren Legarda 
AN ACT 
PROHIBITING THE MISAPPROPRIATION OF PERSONAL INFORMATION 
IN DATABASE AND COLLECTIONS OF INFORMATION, PROVIDING A 
MECHANISM FOR PROTECTION AGAINST IDENTITY THEFT, AND FOR 
OTHER PURPOSES 
Be it enacted by the Senate and the House of Representatives of the Philippines in 
Congress assembled: 
1 
SECTION 1. Title. - This Act shall be known as the "Personal Data 
2 
Protectio,n Act of 2010." 
3 
4 
·SEC. 2. Declaration of Policy. - As a fundamental right guaranteed by the 
5 
Constitution, it is the policy of the State to protect the privacy of an individual from 
6 
any form of intrusion, except when justified in accordance with law. This is 
7 
consistent with the Universal Declaration of Human Rights, which mandates that 
8 
"no one shall be subjected to arbitrary int.erference with his 'privacy" and that 
9 
"everyone has the right to the protection of the law against such interference or 
10 
attacks." 
11 
12 
SEC. 3. Definition of Terms. - As used in this Act, the following terms are 
13 
defined as follows: 
14 
a. Database - a collection of a large number of discrete items of information 
15 
produced for the purpose of bringing such discrete items of information 
16 
together in one place or through one source so that persons may access them; 
17 
b. Identity Theft - a fraud committed using the sensitive personal information of 
18 
another individual with the intent to commit, or to aid or abet any unlawful 
19 
activity that constitutes a violation of any existing laws and results in 
20 
economic loss to that individual; 
21 
c. Information -
refers to facts, data, works of authorship, or any other 
22 
intangible material capable of being generated or gathered; 
1 
! 


1 
d. Maintain a database -means to update, validate, or supplement information 
2 
contained in a database; 
3 
e. Making available in commerce to others -
means making available in 
4 
commerce to a substantial number of members of the public or a number of 
5 
persons that extends beyond a family and its social acquaintances or those 
6 
who could reasonably anticipate to have access to such database without 
7 
need of prior customary commercial relationship; 
8 
f. 
Personal Information - means personally identifiable information about a 
9 
specific individual; 
10 
g. Sensitive personal information - refers to an individual's first name and 
11 
surname in combination with anyone or more of the following data elements, 
12 
such as those that relate, but is not limited to, an individual's financial 
13 
account, credit standing, health conditions, and lineage and pedigree. 
14 
15 
SEC. 4. Prohibition Against Misappropriation of Databases. - It shall be 
16 
unlawful for any person to knowingly make available in commerce to others 
17 
sensitive personal information in a database generated, gathered or maintained 
18 
about a person if such act resulted to -
19 
a. The damage, disruption and ineffectiveness of the information generated, 
20 
gathered or maintained in the database, or 
21 . 
b. The prejudice of the person with whom the personal information pertains, in 
22 
the absence of a prior written permission. 
23 
24 
SEC. 5. Database Security. -
Any person, corporation, partnership, 
25 
association or any entity organized under Philippine laws that owns or licenses 
26 
database containing sensitive personal information shall develop, implement, and 
27 
maintain reasonable security and notification procedures and practices appropriate 
, 
28 
to the s~ope and nature of the information maintained to ensure the security and 
29 
confidentiality of the personal information and protect it against any unauthorized 
30 
access, destruction, use, modification or disclosure. 
31 
32 
SEC. 6. Notification Requirements. - If such person, corporation, partnership, 
33 
association or entity that owns or licenses databases containing "sensitive personal 
34 
information" determines, after discovery and a reasonable investigation, or 
35 
notification pursuant to the succeeding paragraph, that a significant risk of identity 
36 
theft exists as a result of a breach of security of the database maintained by it, it shall 
2 


1 
be its duty to inform and notify, in the most expeditious manner without 
2 
unnecessary delay, any individual whose personal information was compromised. 
3 
4 
Any person, corporation, partnership, association or any entity organized 
5 
under Philippine laws in possession of computerized data containing sensitive 
6 
personal information that the agency or person does not own or license shall notify 
7 
and cooperate with the owner or licensor of the information upon the discovery of a 
8 
breach of security of the database in the most expeditious manner without 
9 
unnecessary delay. 
10 
11 
SEC. 7. Penalties. - Any person found guilty of violating Section 4,5 and 6 of 
12 
this Act shall be punished with imprisonment of not exceeding ten (10) yeats or a 
13 
fine ranging from One Hundred Thousand Pesos (PlOO,OOO.OO) to Five Hmdred 
14 
Thousand Pesos (P500,OOO.00), or both, at the discretion of the court. 
15 
16 
If the offense is committed by, or in conspiracy with, a corporation, the 
17 
officers and directors of the said corporation shall be jointly and solidarily liable 
18 
with the corporation. 
19 
20 
SEC. 8. Separability Clause. - If any part or provision of this Act is held 
21 
invalid, other parts or provisions hereof not affected thereby shall remain in full 
22 
force and effect. 
23 
24 
SEC. 9. Repealing Clause. - All laws, decrees, orders, rules and regulation, or 
25 
portions thereof inconsistent with this Act are hereby repealed, amended or 
26 
modified accordingly. 
27 
28 
SEC. 10. Effectivity Clause. - This Act shall take effect fifteen (15) days after 
29 
its publication in at least two (2) newspapers of general circulation. 
30 
31 
Approved,