FOURTEENTH CONGRESS OF THE 
) 
REPUBLIC OF THE PHILIPPINES ) 
Second Regular Session 
1 
SENATE 
S.NO. 3129 
Introduced by Senator Antonio “Sonny” F. Trillanes IV 
EXPLANATORY NOTE 
We are currently living in an information-driven economy. The advancement in Information and 
Communications Technology (ICT) paved the way for this type of economy to flourish. 
However, our capability to participate in such economy depends on &e ievei of infrastructure 
and economic policies currently present in our country. But it cannot be argued that ow 
participation in the information economy will be most beneficial to our country as we strive for 
economic growth. 
In today’s technology, processes, workflows and functions can be modularized and easily 
distributed. Location is no longer fixed by proximity as entire functions and departments can be 
giobaiiy sourced. in the Pitiiippines, Business Process Outsourcing (@PO) industry has 
contributed much to our economy. According to the National Statistical Coordination Board 
(NSCB), on the average from the First Quarter of 2004 to the Second Quarter of 2007, the BPO 
industry has increased our country’s GDP growth by as much as 0.2 percentage points. The 
industry also generated as much as US$2 billion in 2005,48.2% higher from the US$ 1.3 billion 
the industry generated in 2004. 
In addition, based on the projections made by BOI-CICT-BPNP, the BPO industry is expected 
to contribute more to the economy, as much as US$12 billion in 2010. Total workforce for the 
industry is also expected to increase and may reach 1. i miiiion in tne same year, transiating to 
982,300 new jobs generated, from only 100,500 in 2004. Increased local employment, skills 
development and investment, tax revenues and other collateral spending in the economy are 
some of the resuits brought a-bout by the industry. However, countries &om all over the worid are 
competing to attract outsourcing services. 
The Phiiippines cieariy has an advantage in attracting these services. We have a iot of technicaliy 
skilled graduates, we are very proficient in the English language, and we have prior experience 
dealing with big companies in the US. However, aside from basic infrastructure, skilled labor, 
1 


and cost of setting up business here, investors also consider the level of trust in how transferred 
information will be secured and used in our country. 
This bill seeks to provide the needed framework in relation to the handling and treatment of 
sensitive and personal information in our country. It also establishes a National Data Privacy 
Commission that wouid reguiate the use of this information. it is hoped that thru this iegisiation 
we will be able to earn the trust of investors and utilize them to propel our country's growth 
economically. 
In view of the foregoing, immediate passage of this bilI is earnestly sought. 
W+d" 
A 
0 IO"S0NN 
F.TRILLANESIV 
Senator 
2 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
ROURTEENTE CONGRESS OF TEE ) 
REPUBLIC OF THE PHILIF'PlNES 
) 
Second Regular Session 
) 
SENATE 
S.NO. 3129 
I 
Introduced by Senator Antonio "Sonny" F. Trillanes IV 
AN ACT 
PROTECTING INDIVIDUAL PERSONAL INFORMATION LN INFORMATION AND 
COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE 
SECTOR, CREATING FOR THIS PURPOSE A NATIONAL DATA PROTECTION 
COMMISSION, AND FOR OTHER PURPOSES 
Be it enacted by the Senate and the House of Representatives of the Philippines in Congress 
assembled. 
Chapter L GENERAL PROVISIONS 
SECTEON I. Short ZZgle. - T i s  Act shaii be known as the "Data Privacy Act of2009" 
SEC. 2. Declaration ofPolicy. - It is the policy of the State to protect the fundamental 
human rigknt of privacy of c0mmunic;aiion. The State iiiiewise rwognizes the vitai role of 
information and communications technology building but with its inherent obligation to ensure 
that personal information in information and communications systems in the government and the 
private sector are secure and protected. 
SEC. 3. Znterpretation. - Any doubt in the interpretation of any provision of this Act 
shaii be interpreted in favor of the rights and inkrests of the individual whose private 
information is being processed. 
Sic. 4. &$nition 
of Terms. - -Whenever used in t i s  Act, the foiiowing terms shaii 
have the respective meanings hereafter set forth 
"rersonai infomation" - means any information, or an opinion, whether hue or not and 
whether recorded in a material form or not, about an individual whose identity is apparent 
or can be reasonably ascertained froin information or opinion, or when put together with 
other information wouid identify an idividuai. 
1 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
i2 
13 
14 
15 
16 
17 
ia 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
“Personal information controller” - means a person or organization who controls the 
collection, holding, processing or use of personal information, including a person or 
organization who instructs another person or organization to coiiect, hoid, process, use 
transfer or disclose personal information on his or her behalf. The term excludes: 
(a) a person or organization who pe60ms such functions as instructed by another 
person or organization; and 
(h) an individual who collects, holds, processes or uses personal information in 
connection with the individuai’s personai, famiiy or nousehoid affairs. 
“Processing” - shall mean any operation or any set of operations concerning personal 
idomation, inciuding, but not limited to, ihe wiiection, rwording, organization, storage, 
updating or modification, retrieval, consultation, use, consolidation, blocking, erasure, or 
destruction of data. 
“Filing system” - means any set of information relating to natural or juridical persons to 
the extent that, although the information is not processed by means of equipment 
operating automaticaiiy in response to instructions given for that purpose, the set is 
structured, either by reference to individuals or by reference to criteria relating to 
individuals, in such a way that specific information relating to a particular person is 
readiiy accessibie. 
“Sensitive personal information” - means personal information - 
(a) which is likely to give rise to unlawful or arbitrary discrimination, which 
includes, but is not limited to, data which indicate the race, ethnic origin, marital 
status, age, coior, reiigious, pihiiosopnicai or poiiticai asiiations; 
(b) which provide information as to the health, education, genetic or sexual life of a 
person, or to any proceeding for any offense committed or alleged to have been 
committed by such person, the disposal of such proceedings, or tne sentence of 
any court in such proceedings; 
(c) which are issued by government agencies peculiar to an individual which 
includes, but not iimited to, Sociai Security numbers, previous or current heaitin 
records, licenses or its denials, suspension, or revocation, and Tax returns; 
2 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
(d) which have been specifically authorized under criteria established by an 
Executive Order or an Act of Congress to be kept classified in the interest of 
nationai defense or foreign poiicy. 
“Privileged data” -means any and all forms of data which under Section 24, Rule 120 of 
the Rules or’ Court and other pdineni iaws, constitute privileged tiommunitiation, 
specifically but not limited to those pertaining to communication exchanged in 
confidence between - 
(a) Husband and Wife; 
(b) Lawyer and Client; 
(cj Physician and Patient; 
(d) Publisher, Editor or Reporter and their Informant; 
(e) Parents and their Children. 
“Data subject” - means an individual whose personal information is processed. 
”Consent of the dattt subject“ - means any ikely gven, specific and informed expression 
of will, either in written or electronic form executed personally and voluntarily by the 
data subject, whereby the data subject agrees to the processing of personal information 
about an& or reiating to him or her. 
“Direct marketing” - means communication by whatever means of any advertising or 
marketing maieriai whi& is diretiid to pdtiuiar inciividwk. 
“Information and Communications System” - means a system for generating, sending, 
r-iving, 
storing or otherwise pr-sing 
ehtwniti data messages or eiwtronic: 
documents and includes the computer system or other similar device by or in which data 
is recorded or stored and any procedures related to the recording or storage of electronic 
data message or elecnonic document. 
“Commission” - shall refer to the National Privacy Commission created by virtue or ths 
Atit 
SEC. 5. Scope. - This Act applies to the processing of all types of personal information, 
and io any natural and juridical person involved in persotmi infomation processing imludiug 
3 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
i8 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
those personal information controllers who, although not found or established in the Philippines, 
uses equipment that are located in the Philippines, or those who maintain an office, branch or 
agency in the Phiiippines subject to tne imnediateiy succeeding section. 
This Act does not apply to the information and communications systems in which 
personai infomation are processed for personal or househoid and family purposes and where the 
personal information collected are not disclosed to other persons. Likewise, this Act shall not 
apply if personal information is processed for journalistic, artistic or literary purposes. 
Chapter II. THE NATIONAL PRIVACY COMMISSION 
SEEC. 6. Functions oftire Nutionul PrivatJI Commission - To administer and impiement 
the provisions of this Act, and to monitor and ensure compliance of the country with 
international standards set for data protection, there is hereby created an independent body to be 
known as tne Nationai Privacy Commission, which snali have the foiioaving functions: 
(a) Ensure compliance of personal information controllers with the provisions of ths 
Act; 
(b) Receive complaints, institute investigations, facilitate or enable settlement of 
complaints through the use of alternative dispute resolution processes, adjudicate, 
award indemnity on matters afffcting any personai infomation, prepare reports on 
disposition of complaints and resolution of any investigation it initiates, and, in cases 
it deems appropriate, publicize any such report, provided that in resolving any 
compiaint or investigation (except where amicabie settlement is reacheti by the 
parties), the Commission shall act as a collegial body. For this purpose, the 
Commission may be given access to personal information subject of any complaint 
and to collect the information necessary to perform its fmctions under this Act; 
(c) Issue cease and desist orders, impose a temporary or permanent ban on the processing 
or personal information, upon finding that the processing will be detrimental to 
national security and pubiic interest; 
(d) Monitor the compliance of other government agencies or instrumentalities on their 
security and technical measures and recommend the necessary action in order to meet 
minimum standards for protection of personal infomation pursuant to this Act; 
(e) Coordinate with other government agencies and the private sector on efforts to 
formulate and implement plans and policies to strengthen the protection of personal 
information in the country; 
4 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
(f) Recommend to the Department of Justice (DOJ) the prosecution and imposition of 
penalties specified in Sec. 22 to 27 of this Act; 
(gj Ensure proper and effective coordination ~aith data privacy reguiators in other 
countries and private accountability agents, and participate in international and 
regional initiatives for data privacy protection; and; 
(in) Review, approve, reject or require modification of privacy codes voiuntarily adhered 
to by personal information controllers, provided that the privacy codes shall adhere to 
the underlying data privacy principles embodied in this Act, and provided further that 
such privacy codes may inciude private dispute resoIution mechanisms for coinpiaints 
against any participating personal information controller. 
SEC. 7. iirgunizutionul StructuFe of the Cvmssivn. - The Cornmission shaii be 
attached to the Office of the President and shall be headed by a Privacy Commissioner, who shall 
also act as Chairman of the Commission. The Privacy Commissioner shall be assisted by two (2) 
Deputy Privacy Commissioners, one to be responsi'aie for Data Processing Systems and one to 
be responsible for Policies and Planning. The Privacy Commissioner and the two (2) Deputy 
Privacy Commissioners shall be appointed by the President of the Philippines for a term of three 
(3) years, and may be reappointed for anotiner term of three Q years. Vacancies in tine 
Commission shall be filled in the same manner in which the original appointment was made. 
The Privacy Commissioner must 'be a member of tine Pniiippine Bar, at ieast tinirty-five 
(35) years of age and of good moral character, unquestionable integnty and known probity, 
preferably with experience in Information Technology as recommended by the Commission on 
information and Communications Technoiogy. Y e  Privacy Commissioner shaii enjoy the 
benefits, privileges and emoluments equivalent to the rank of Secretary. 
The Deputy Privacy Commissioners must be recognized experts in the fieid of ICT and 
data privacy. They shall enjoy the benefits, privileges and emoluments equivalent to the rank of 
Undersecretary. 
No criminal or civil proceedings shall lie against the Privacy Commissioner, the Deputy 
Privacy Commissioners, or any person acting on their behalf or under their direction, for 
anything done, reported or said in good faith as a result of the pdormance or exercise or 
purported performance or exercise of any duty or power under this Act. 
5 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
SEC. 8. The Secretariat - The Commission is hereby authorized to establish a 
Secretariat. Majority of the members of the Secretariat must have served for at least five (5) 
years in any agency of the govenunent that is involved in the processing of personai inforination, 
including, but not limited to the following offices: National Statistics Office (NSO), Social 
Security System (SSS), Government Service Insurance System (GSIS), Land Transportation 
Office @TO), Bureau of Internal Revenue (BX), Fkiiippine Health Insurance Corporation 
(PhilHealth), Commission on Elections (Comelec), Department of Foreign Affairs @FA), 
Department of Justice (DOJj, and Philippine Postal Corporation (PhilPost). 
Chapter III. PROCESSING OF PERSONAL INFORMATION 
SEEC. 9. General Data Privacy Principles. - The processing of personal information shaii 
be allowed, subject to compliance with the requirements of this Act and adherence to the 
principles of transparency, legitimate purpose and proportionality. 
Personal information must be: 
(aj collected for specified and iegitimate purposes determined and deciared before 
collecting personal information and later processed in a way compatible with such 
declared, specified and legitimate purposes only; 
(&I processed accurately, preciseiy, fairiy and lawfully; 
(c) accurate, relevant, and, where necessary for the processing of personal information, 
kept up to date; inaccurate or incomplete data must be rectified, supplemented, 
destroyed or their h t k r  processing must be restricteti; 
(d) consistent, adequate and not excessive in relation to the purposes for which they are 
collected and processes; 
(ej kept within a period not exceeding tne time Mitiffin which the purposes for which fie 
data was obtained would be achieved; 
(Q kept in a form which permits identification of data subject for no longer than is 
necessary for the purposes for which the data were coiiected and processed; Provided, 
that personal information collected for other purposes may be processed for historical, 
statistical or scientific purposes and in cases laid down in law may be stored for 
longer periods; Provided, further, that adequate safeguards are guaranteed by said 
34 
laws authorizing their processing. 
6 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
The personal information controller must ensure implementation of personal information 
processing principles set out herein. 
SEC. 10. Criteria for Lawful Processing of Personal Information. - The processing of 
personal information shall be permitted only if not otherwise prohibited by law, and At least one 
of tine foilowing conditions exist: 
(a) the data subject has given his or her unambiguous consent which must be given in 
writing, or through any other simiiar means of express consent, according io the 
circumstances; 
(b) the personal information is necesssuy and is a legal consequence of a contractual 
obiigation ofthe data subject or in order to take steps at the request of&e data subject 
prior to entering into a contract; 
(c) the processing is necessary to protect vitally important interests of the data subject, 
inciuding iife and heaitk or 
(d) the processing is necessary in order to respond to national emergency, to comply with 
the requirements of public order and safety, or to fulfill functions of public authority 
which necessarily includes the processing of personal information for the fuifillment 
of its mandate. 
SEC. i P .  Sensitive Data and Privileged Data. - The processing of sensitive personal 
information and privileged data shall be prohibited, except in the following cases: 
(aj the data subject nas given his or her consent prior to the processing, or in <ne case of 
privileged data, all parties to the exchange have given their consent prior to the 
processing; 
(bj the processing of tine same is provided for by existing iaws and regulations; Provided, 
that such regulatory enactments guarantee the protection of the sensitive personal 
information and the privileged data; and Provided further, that the consent of the data 
subjects are not required by tihe law, or regulation permitting the processing of 
sensitive personal information or the privileged data; 
(c) the processing is necessary to protect the life and health of the data subject or another 
person, and the data subject is not iegaiiy or pnysicaiiy dole to express his or her 
consent prior to the processing; 
(8) processing is necessary to achieve the lawful, non-commercial objectives of public 
organizations and their associations; Provided, such processing is oniy confined and 
7 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
i2 
13 
14 
15 
16 
17 
iS 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
related to the bona fide members of these organizations or their associations; 
Provided further, that the sensitive personal information are not transferred to third 
parties; and Provided finaiiy, that consent of the data subject was obtained prior to 
processing; 
(e) the processing is necessary for the purposes of medical treatment, is carried out by a 
medicai practitioner or a medical treatment institution, and an adequate ievei of 
protection of personal information is endured; or 
(f) the processing concerns such personal information as is necessary for the protection 
of lawful rights and interests of naturai or legal persons in court proceedings. 
SEC. 12. Subcontract of Personal Information. - A personal information controller may 
subwniraci ihe processing of personal informaiion provided, t*nai, ihe personai information 
controller shall be responsible for ensuring that proper safeguards itre in place to ensure the 
confidentiality of the personal information processed, prevent its use for unauthorized purposes, 
and generally, cornpiy with the requirements ofthis Act for processing of personai information. 
SEC. 13. Storage ofData. - Personal information shall be stored and used only for as 
long as ii is newsay io achieve the purpose for which it was prowstxi, afier whi& the personai 
information shall be deleted or blocked from a personal information base, unless otherwise 
provided by law. 
SEC. 14. Extension of Privileged Communication. - Personal information controllers 
may invoke the principle of privileged communication over privileged data that they lawfully 
controi or process. %&?jecE to existing iaws and regulations, any evidence gathered on privileged 
data is inadmissible. 
SEC. 15. Rights of the Data SubjecL - The data subject is entitled to: 
(a) be informed whether personal information pertaining to him or her shall be, are being, 
or have been processed; 
fbj before the entry of his or her personai infomation into the processing system of tine 
data controller, be furnished the following: 
i. description of the personal information to be entered into the system; 
ii. purposes for which they are being or are to be processed; 
8 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
i2 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
iii. scope and method of the personal information processing; 
iv. recipients or classes of recipients to whom they are or may be disclosed; and 
v. methods utiiized for automated access, if the same is aiiowed by ine data 
subject, and the extent to which such access is authorized. 
Any information supplied or deciamtions made to tne data subject on these 
matters shall not be amended without prior notification of data subject; 
(cj be given reasonable access to, upon demand, the foioiioaving: 
i. 
11. 
iii. 
iv. 
v. 
vi. 
contents of his/ her personal information that were processed; 
source from which personal infomation were obiaim& 
names and addresses of recipients of the personal information; 
manner by which such data were processed; 
reasons for the disciosure offhe personai information to recipients; 
information on automated processes where data will or is likely to be made 
as the sole basis for any decision significantly affecting or will affect the 
data subject; 
vii. date when his or her personal information concerning the data subject were 
last accessed and modified; 
.. 
aiii. the designation, or name, or identity and address of the data controiier. 
(d) dispute the inaccuracy or error in the personal information and have the data 
conkoiler correct it immediiateiy and awordingiy. II mne personal infomation has 
been corrected, the personal information controller shall ensure the accessibility of 
both the new and the retracted information and the simultaneous receipt of the new 
and the retracted information by recipients thereor?, 
T P  ,I 
(e) suspend, withdraw or order the blocking, removal or destruction of his or her personal 
information from the data controller’s Eiiing syskm upon dixovery anci substantial 
proof that the personal information are incomplete, outdated, false, unlawfully 
obtained, used for unauthorized purposes, used for direct marketing purposes, unless 
expressiy authorized, or are 110 ionger necessary for t l  purposes for wni& they are 
collected. In this case, the personal information controller shall rectifl the inaccuracy 
without delay and notify third parties who have previously received such processed 
9 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
i5 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
data. Likewise, the personal information controller shall indemnify the data subject 
for any damages sustained by the latter due to such inaccuracy. 
SEC. 16. Non-applicability. - The preceding section is not applicable if the processed 
data are used only for the needs of scientific and statistical research and, on the basis of such, no 
activities are carried out and no decisions are taken regarding the data subject. Provided, that the 
personal information shall be held under strict confidentiality and shall be used the same only for 
the declared purpose. 
Chapter V. SECURITY OF DATA 
(a) 
The personal information controller must implement appropriate organizational and 
kdmical meawes inkded for the probtion of persomi idomtion against any acxidentd or 
unlawful destruction, alteration, and disclosure as well as against any other unlawful processing. 
These measures must ensure a level of security appropriate to the nature of the data to be 
protected and tihe risks represented by &e processing. 
(b) The personal information controller shall implement appropriate measures to 
protect personal information against natural dangers, such as accidental loss or destruction and 
human dangers such as uniawfui access, eaduient misuse, uniadui destruction, aiteration, and 
contamination. These measures, specified in a written document or its equivalent, must be 
appropriate to the nature of the data to be protected and the risks represented by the processing. 
(cj Tine empioyees, agents or representative of the personai information controiier and 
their representatives who are involved in the processing of personal information shall operate 
and hold personal information under strict confidentiality if these personal information are not 
intended for pubiic disciosure. This obligation shaii continue even after ieaving the pubiic 
service, transfer to another position or upon termination of employment or contractual relations. 
(d) The personal information controller shall notify the Commission and affected data 
subjects w&en sensitive personal information or other information such as the name, address and 
unique identifiers of data subjects, are reasonably believed to have been acquired by an 
unauthorized person, and the personal information controller or the Commission believes that 
such unauthorized acquisition may give rise to a reai risk of serious harm to any affected data 
subject. 
10 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
i. In evaluating the risk of harm is sufficient to warrant notification, the adequacy of 
encryption of personal information and existence of good faith in the acquisition of 
personai infomation shall be considered. 
ii. Commission may exempt a personal information controller from notification where, 
in its reasonable judgment, such notification would not be in the public interest or in 
tne interests of the affected data subjects. 
Chapter VI. ACCOUNTABILITY FOR TRANSFER OF PERSONAL INFORMATION 
SEC. 18. Principle of Accountability. - Each personal information controller is 
responsible for personal information under its control or custody, including information that has 
been transferred to a third party for processing, whether dumestically or internationally subject to 
cross-border arrangement and cooperation 
_. 
(a) 
me personal idmation controller is accomtabie for compijing with the 
requirements of this Act and shall use contractual or other reasonable means to provide a 
comparable level of protection while the information is being processed by a third party, 
(kj 
Ine personai infomation controller shdi designate an individuai or ihdividuals 
who are accountable for the organization’s compliance with this Act. The identity or the 
individual@) so designated shall be made known to any data subject upon request. 
_. 
Chapter VIL SECURITY OF SENSITIVE DATA M GOVERNMENT 
SEC. i9. Sectring of Sensitive Data &-aintained by the Government. - Mi sensitive 
data maintained by the government, its agencies and instrumentalities shall be secured, as far as 
practicable, with the use of the most appropriate standard recognized by the information and 
communications industry, and as recommended by tihe Commission on information and 
Communications Technology. The head of each government agency or instrumentality shall be 
responsible for complying with the security requirements mentioned herein while the 
Commission shall monitor the compiiance and may recommend tam necessary action in order to 
satisfy the minimum standards. 
SZC. 20. Xequirements Xelattng to Access by Agency Personnel to Sensitive Daia. - 
(a) 
On-Site and On-Line Access -No employee of the government shall have access 
to sensitive data on Government property or through on-line facilities unless the employee has 
36 
received a security clearance f?om the head ofthe source agency. 
11 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
3 3  
31 
32 
33 
34 
35 
36 
(b) 
Off-Site Access - Sensitive data maintained by an agency may not be transported 
or accessed from a location off Government property unless a request for such transportation or 
access is submitted a d  app~oved by the head of the agency p ~ ~ i d e d  
that the foiioaving are 
followed: 
PIiijcEDURES - 
i. Deadline for Approval or Disapproval - In the case of any request submitted to the 
head of an agemy, such h
d
 
of an agency shall approve. or disapprove. the request 
within two (2) business days after the date of submission of the request. 
ii. Limitation to 1,000 Records - If a request is approved, the head of the agency shall 
iimit the access to not more than 1,WO records at a time. 
iii. Encryption - Any technology used to store, transport, or access sensitive data, for 
purposes of off-site access approved under this subsection, shall be secured by the use 
~ f t k  
most secure encqpion standard recognized by the Commission on Information 
and Communications Technology. 
iv. Implementation - The requirements of this subsection shall be implemented not later 
than six (6) months seer the date ofthe enactment of this Act. 
SEC. 21. Applicability to Government Contractors. - In entering into any contract that 
may invoive awessing or requiring sensiiive pawmi infomaiion &om one thousand (i,GGG) or 
more individuals, an agency shall require the contractor and employees of the contractor to 
register their data processing system to the Commission in accordance with this Act and to 
comply with tihe other provisions of this Act inciuding the immediately preceding section, in fne 
same manner as agencies and government employees comply with such requirements. 
SEC. 22. Unauthorized Processing of Personal Information. - The penalty of 
irnprisunmeni ranging kom vnr (i) year io 6kee (3) yean and a 6 - i ~  
u i  nui ksss lhan Five 
Hundred Thousand Pesos (Php 500,000.00) but not more than Two Million Pesos (Php 
2,000,000.00) shall be imposed on persons who process personal information without the 
consent of the data subject, or ~irlth~~t 
being authorized under this Act or any existing law. 
SEC. 23. Accessing Personal Information Due to Negligence. - The penalty of 
impriwnrneni ranging from vne (i j year io itme (3 j years a& a kine of nui Less t’mn Five 
12 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
IS 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
Hundred Thousand Pesos (Php 500,000.00) but not more than Two Million Pesos (Php 
2,000,000.00) shall be imposed on persons who, due to negligence, provided access to personal 
infomation witmt being authorized &r 
this Act OF my existing law. 
SEC. 24. Improper Disposal of Personal Information. - The penalty of imprisonment 
ranging &om six (6) months to two (2) years and a fine noi i e s  than One Hun&ed Tnousand 
Pesos (Php 100,000.00) but not more than Five Hundred Thousand Pesos (Php 500,000.00) shall 
be imposed on persons who knowingly or negligently, dispose, discard or abandon the personal 
information of an individuai in an area accessible to  he pubiic or has otnemise piaced fne 
personal information of an individual in a container for trash collection. 
S W .  25. WFOHW~E 
Processing ojPersontd fnfomatiort. -The penaity of imprisonment 
ranging from six (6) months to two (2) years and a fine not less than One Hundred Thousand 
Pesos (Php 100,000.00) but not more than Five Hundred Thousand Pesos (Php 500,000.00) shall 
be imposed on persons who knowingiy inserts of has false infomation inserted in a personai 
information file. 
SEEC. 2b. Processing 03" Personai InjomMtbt for Eillautitodzed Purposes. - The 
penalty of imprisonment from one (1) year and six (6) months to five (5) years and a fine of not 
less than Five Hundred Thousand Pesos (Php 500,000.00) but not more than One Million Pesos 
(Tip i,OOO,WO,O@) shail -be imposed on persons processing persona! information for purposes 
not authorized by the data subject, or otherwise authorized under this Act or under existing laws. 
SgC. 27. Gkatltitodzed Access or interrtiorzai Beeit. - The penaity of imprisonment 
ranging from one (1) year to three (3) years and a fine not less than Five Hunded Thousand 
Pesos (Php 500,000.00) but not more than Two Million Pesos (Php 2,000,000.00) shall be 
imposed on persons who hwingiy and mlawMiy, or violating data confidentiality and security 
data systems, breaks in any way into any system where personal information is stored. 
SEC. 28. Conceaimennt of SecuFity Breacires Invvlvlng Sensitive Pemonaiiy 
Identifiable Information. - The penalty of imprisonment of one (1) year and six (6) months to 
five ( 5 )  years and a fine of not less than Five Hundred Thousand Pesos (Php 500,000.00) but not 
more than One ivliiiion Pesos (Fnp i,W,WO.W) ski1 be imp~sed 
OB persons who, after having 
knowledge of a security breach and of the obligation to notify the Commission pursuant to 
Section 17 (d), intentionally or by omission conceals the fact of such security breach. 
13 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
SEC. 29. Malicious Disclosure. - Any person who, with malice or in bad faith, discloses 
unwarranted or false information relative to any personal information obtained by him or her 
from a data controiier OF unknowingly transferred to him or her, Shaii be subject to imprisonment 
ranging from one (1) year and six (6) months to five (5) years imprisonment and a fine of not 
less than Five Hundred Thousand Pesos (Php 500,000.00) but not more than One Million Pesos 
pnp i,Qocl,w?o.Wj 
SEC. 30. Unauthorized Disclosure. - Any person who discloses to a third party personal 
infomdtion mi covexed by the. immediately pece&ng =,tion wikkoui ths consent or' the dab 
subject obtained by him from a data controller or unknowingly transferred to him, shall be 
subject to imprisonment ranging from one (1) year to three (3) years imprisonment and a fine of 
not iess than Five hundred Thousand Pesos (Php 500,OW.W) but: not more than One MilIion 
Pesos (Php 1,000,000.00). 
SW. 31. Breacn ofCo?@&mia&y. -The penaity of imprisonment ranging from two (2j 
years and four (4) months to five (5) years and a fine not less than Five Hundred Thousand Pesos 
(Php 500,000.00) but not more than Two Million Pesos (Php 2,000,000.00) shall be imposed in 
case of a breach of confidentiality where swh &each has resulted in the infomation being 
published or reported by media. In this case, the responsible reporter, writer, president, publisher, 
manager and editor-in-chief shall be liable under this Act. 
SEC. 32. Combination or Series of Acts. - Any combination or series of acts as defined 
in Sections 22 to 30 shall make the person subject to imprisonment ranging from three (3) years 
to six (6) years and a fine of not iess &an One Miiiion Pesos (Fhp 1,000,OW.W) but not more 
than Five Million Pesos (F'hp 5,000,000.00). 
SEC 33. Exteat of LiaMig. -Ifthe offender is a corporation, association, partnership or 
any juridical person, the penalty shall be imposed upon the responsible officers, as the case may 
be, who participated in, or by their gross negligence, allowed the commission of the crime. If the 
offender is a juridical person, the cow may suspend or revoke any of its rights under this Act, i f  
the offender is an alien, he shall, in addition to the penalties herein prescribed, be deported 
without further proceedings after serving the penalties herein prescribed. If the offender is a 
pubiic ofrlciai or employee and he is f o d  guilty of acts penalized under %&on 24 and 25 of 
this Act, he or she shall, in addition to the penalties prescribed herein, suffer perpetual or 
34 
temporary absolute disqualification from office, as the case may be 
14 


1 
2 
3 
4 
5 
6 
7 
a 
9 
10 
11 
i2 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
SEC. 34. Large-Scale. - The maximum penalty in the scale of penalties respectively 
provided for the preceding offenses shall be imposed when the personal information of at least 
one hundred f i Wj perms is harmed, aEected or involved as the resuit of the a-mve mentioned 
actions. 
SW. 35. Ofj2me tltnzmitted by P@blic O&TceF. - w-kn the offender or fie person 
responsible for the offense is a public officer as defined in the Administrative Code of the 
Philippines in the exercise of his duties, an accessory penalty consisting in the disqualification to 
occupy public ogees for ip term double the tern of criminal penalty imposed shaii be appiied. 
SEC. 36. Restitution. - Restitution for any aggrieved party shall be governed by the 
provisions or'ik New Civii C&. 
Chapter E. 
MISCELLANEOUS PROVISIONS 
SEX. 317. iqlemaziag liscies and Repiaths - -NiFh sixty (a) 
days from the 
appointment of the Executive Director of the Commission and the constitution of the Secretariat, 
the Commission shall promulgate the rules and regulations to effectively implement the 
provisions of this Act. Said mies and reguiations shdi -be submitted to the Congressionai 
Oversight Committee for approval. Upon the approval of the IRR by the Congressional 
Oversight Committee created under this Act, the same shall be immediately published in at least 
two (Z) newspapers of general circuiiption. 
SEC. 38. Congressional Oversight Committee. - There is hereby created a 
Cixgpssional Qvmigtnt Committee cohnpo~d or' seven (7) members &om the Senate and seven 
(7) members from the House of Representatives. The members from the respective Houses shall 
be appointed by the Senate President or the Speaker of the House of Representatives based on 
the poportional repeimtation of the parties or coaiitions therein *ith at ieast tavo (Zi 
members 
of each House representing the minority. The Oversight Committee shall have the power to 
promulgate its own rules, to oversee the implementation of this Act, and to review or revise the 
impiementing d e s  issued by &e Commission within thmy (3@) days ~ Q E I  the prom~lgati~n 
of 
the said rules. 
SEC. 39. Appropriatiow Catrse. - Tine Commission shaii -be provided ~4th 
an inirial 
appropriation of Twenty-Five Million Pesos (Php 25,000,000.00) to be drawn from the national 
15 


1 
government. Appropriations for the succeeding years shall be included in the General 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
1.2 
13 
14 
15 
16 
17 
Appropriations Act. 
SEC. 40. Transitory Period - Existing Industries, Businesses, and Offices affected by 
the implementation of this Act shall be given one (1) year transitory period from the, effectivity 
of tiis Act, to cornfly 4 t h  the requirements ofthis Act. 
SEC. 41. Separability Clame. - If any provision of this Act is held invalid, the other 
provisions noi a & d d  &tali remiin in lul'ull rurw a d  erkGi. 
SEC. 42. Repealing Clause. - The provision of Section 7 of Republic Act No. 9372 is 
hereby mended. Aii other iaw, decrees, executive orders, paotilamiaiions and administrative 
regulations, or parts thereof inconsistent herewith are hereby repealed or modified accordingly. 
SEC. 43. Zffeeti.cy Claese. - Titis Aet shdi take effect fifteen (15) days after the 
completion of its publication in the Official Gazette or in at least two (2) newspapers of general 
circulation. 
Approved, 
16