.,... 
FOURTEENTH CONGRESS OF THE REPUBLIC) 
OF THE PHILIPPINES 
1 
( ,J,,p-(; 
< ~ , '  
First Regular Session 
1 
it:r.,r:. 
.;G . .. 
, , ..r .,,$.I.: >.,,, , 
SENATE 
S.B.No. 3-109 
Introduced by Senator Miriam 1)efcnsor Santiago 
EXPLANATORY NOTE 
The government has the paramount interest of protecting the integrity and confidentiality 
of sensitive data maintained by its different agencies and instrumentalities. The giant leaps in 
technology in recent years make government databases vulnerable to unauthorized inti-tisioiis by 
hackers. 
The purpose of this Act is to increase the security of sensitive data maintained by the 
1 
government. 
' This bill was originally filed in the Thirteenth Congress, Third Regular Session 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
1s 
16 
17 
18 
19 
20 
21 
22 
23 
FOURTEENTH CONGRESS OF THE REPUBLIC) 
!\ 
; 
OF THE PHILIPPINES 
1 
.jij.-d 
s ’  
First Regular Session 
) 
Introduced by Senator Miriam Defensor Santiago 
AN ACT 
INCREASING THE SECURITY OF SENSITIVE DATA 
MAINTAINED BY THE GOVERNMENT 
Be it enacted by the Senate and the House of Representatives of the Philippines in 
Congress assembled: 
SECTION 1. Shovt Title. - This Act shall be known as the “Government Data Privacy 
Protection Act of 2007.” 
SECTION 2. Declaration of Policy. - It is the policy of the State to protect the integrity 
and confidentiality of sensitive data maintained by the government. Pursuant to this policy, this 
Act shall increase the security of sensitive data maintained by the government. 
SECTION 3. Definition of Terms. -For purposes of this Act, the term: 
(a) “Sensitive data” - includes the following: 
(1) Social security numbers; 
(2) Financial records; 
(3) Previous or current hcalth rccords, including hospital or trcatmcnt 
records of any kind, including drug and alcohol rehabilitation records; 
(4) Criminal records; 
(5) Licenses; 
(6) 1 ’iccnse denials, suspensions, or revocations; 
(7) Tau returns; 
(8) Information that has becn specifically authorized under criteria 
established by an Executive order or an Act of Congress to he kept classified in 
the intercst of national dcfcnse or foreign policy; 
1 


6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
(9) Personally identifiable inl‘ormation. 
(b) “Personally identifiablc information” - means any information, in any form or 
medium that relates to the past, present, or l’uture physical or niental health, 
predisposition, or condition of an individual or the provision of hcalth care to an 
individual. 
SECI’ION 4. Xeqz~iuernc.nt,fi,r (Jse of Encryption,fiir Sensitive I h t a  
~ 
(a) Requirement for Encryption - 
(1) IN GENNEIIAI, - All sensitive data inaintdincd by the government shall 
be secured by the use of the most secure encryption standard recognized by the 
Ilcpartment of Science and Technology. 
(2) UPDATING REQUIRED EVERY SIX (6) MONTHS - Any sequence 
of characters (known as an encryption key) used to securc an encryption standard 
used on goverimcnl computer systems shall be changed every six (6) months, at a 
minimum, to provide additional sccirity. 
(3) IMPLEMENrATION - The requirements ol‘ this subsection shall be 
implemented not later than six (6) months after the date of the eiiactment of this 
Act. 
(b) Responsibility of thc I-Iead of ai Agency - The head of each of the 
government sliall be responsible for complying with the requiremenls oT subsection (a) 
within the agency. 
SIJC:’I‘ION 5. Requirements Relaling to Access by Agency Personnel to Sensitive Ilcila. - 
(a) On-Site Access - -  No employee of the government shall have access to 
scnsitivc data on Government property unless thc einployce has receivcd a security 
clearance and has completed a financial disclosure kmi, in accordance witli applicable 
provisions of law and regulation. 
(b) Off-Site Access - 
(1) PROJII1~1?’10N - Sensitive data maintained by an agency may not be 
transported or accessed from a location off Government property unless a request 
2 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
for such transportation or access is submitted and approved by the head of' the 
agcncy iii accordance with paragraph (2). 
(2) PROCEDlJRES . . 
(A) IXADIJNI.? FOR APPROVAL OR DISAPPROVA1,- In thc 
case of' any request submitted under paragraph (1) to lhe head of an 
agcucy, the hcad of the agency shall approve or disapprove the request 
within two (2) business days after the date of submission ofthe request. 
(13) 1,IMI'~A'lTON TO TIiN 1'1IOIJSANI> (10,000) RI-XCORDS - 
Ifa request is approved, the head oTthe agency shall limit the access to not 
more than ten thousand (I 0,000) records at a time. 
(3) ENCRYPTION .. Any technology used to store, transport, or access 
sensitive data for purposes of off-sitc access approved undcr this subsection shall 
be secured by the use of the most secure encryption standard recognized by the 
T>cpartment of Scicncc and 'l'cchnology. 
(c) lmplemenlation -. The requirements of this subsection shall be implemented 
not later than six (6) months after the date of the enactment of this Act. 
SECTION 6. Requirements Rehling to Governmenl Conlraclon Involving Sensitive 
I>crta. - 
(a) Applicability to Government Contractors - In entering into any contract that 
may involve scnsitivc data in electronic or digital forin on ten thousand (1 0,000) or more 
Filipino citizens, ai agency shall require the contractor and employees of the conlractor 
to coinply with the requirements of seetioiis 4 and 5 ofthis Act in the performance ofthe 
contract. in the same manner as agencies and government employees comply with such 
requirements. 
(b) Implementation - The requirements of this subsection shall be implemented 
with respect to contracts entered into on or after thc date occurring six (6) months aRcr 
the date of the cnactinent ofthis Act. 
3 


8 
9 
10 
11 
12 
SECTION 7. 
Rppropriufions. 
Such sums as may be necessary fbr the initial 
implementation of this Act shall bc taken from the cnrrent appropriations of the governn~ent 
agency involved. Thereafter, the Cund necessary to carry out thc provisions of this Act shall be 
includcd in the annual General Appropriations Act. 
SECTION 8. Separability Clause. - In m y  provision, or part hereof, is held invalid or 
unconstitutional, the remainder of the law or the provision not otherwise affected shall remain 
valid and subsisting. 
SECTION 9. Repealing Clause. - Any law, presidential decree or issuance, executive 
order, letter of instruction, administrative order, rule or regulation contrary to or inconsistent 
with the provisions oE this Act is hereby repealed, modified, or amended accordingly. 
SECTION 10. Effectivity. - This Act shall take effect fifteen (15) days after its 
publication in at least two (2) newspapers of general circulation. 
Approved, 
/jab 
4