I 
THIRTEENTH CONGRESS OF THE REPUBLIC 
Second Regular Session 
1 
OF THE PHILIPPINES 
) 
5 
-2 P(; 
S E N A  
c 
S. B. No. 
3 ', 
~~~~~~~~ 
BY.- .+"-.--- 
- 
INTRODUCED BY THE HONORABLE MAR ROXAS 
EXPLANATORY NOTE 
This bill seeks to establish fair practices in the collection, recording, 
organization, storage, updating or modification, retrieval, consultation, use, 
consolidation, dissemination by any means, merging, linking, blocking, erasure or 
destruction of personal data of natural persons and to penalize the unauthorized 
processing and disclosure thereof. 
Privacy is a fundamental human right recognized in all major international 
treaties and agreements on human rights. The first comprehensive national act on 
privacy in the world was enacted in Sweden in 1973, which regulates the 
establishment and use, in both public and private sectors, of automated data files on 
physical and natural persons. On 10 January 1985, the Convention for the Protection 
of Individuals With Regard to Automatic Processing of Personal Data drawn up within 
the Council of Europe entered into force. Said Convention obligates the signatories to 
enact legislation concerning the automatic processing of personal data which many of 
the member States of the Council of Europe subsequently did. On 14 December 1990, 
the United. Nations promulgated the Guidelines Concerning Computerized Personal 
Data Files which provided for the procedures in implementing regulations concerning 
computerized personal data files. In 1995, the European Union (EU) likewise passed a 
Directive on the Protection of Individuals With Regard to the Processing of Personal 
Data and on the Free Movement of Such Data. This Directive addressed the 
shortcomings of law and the many differences in the level of protection in each of the 
EU States. It further mandates each EU state to pass complementary legislation by 
October 1998. 
There i s  a growing trend towards the enactment of comprehensive privacy and 
data protection laws to address past governmental abuses on the privacy of identity, 
communication, and correspondence; promote e-commerce; and ensure compatibility 
with international standards. In the Philippines, there i s  no special law that 
specifically addresses the protection of personal data. But the right to privacy is 
recognized and enshrined in several provisions of the Philippine Constitution, 
particularly in the different sections of the Bill of Rights. Zones of privacy are likewise 
recognized and protected in Philippine laws, particularly in civil, criminal and 
remedial law. The Civil Code holds a public officer or employee or any private 
individual liable for damages for any violation of the rights and liberties of another 
person, and recognizes the privacy of letters and other private communications. In 
criminal law, the Revised Penal Code makes a crime the violation of secrets by an 
officer, the revelation of trade and industrial secrets, and trespass to dwelling. 
Invasion of privacy i s  an offense in special laws like the Anti-Wiretapping Law, the 
Secrecy of Bank Deposits Act, and the Intellectual Property Code. The Rules of Court 
on privileged communication likewise recognize the privacy of certain information. 
Despite the existence of constitutional guarantees and the existence of laws 
upholding the right to privacy of our citizens, the increasing sophistication of 


Despite 'the existence of constitutional guarantees and the existence of laws 
upholding the right to privacy of our citizens, the increasing sophistication of 
information technology with i t s  capacity to collect, analyze and disseminate 
information on individuals has introduced a sense of urgency in the demand for 
relevant legislation. Furthermore, new developments in medical research and care, 
telecommunications, advanced transportation systems, and financial transfers have 
dramatically increased the level of information generated by each individual. 
Computers linked together by high-speed networks with advanced processing systems 
can create comprehensive dossiers on any person without the need for a single central 
computer system. 
The 'expression of the protection of personal data may vary in various 
declarations and laws but all require that personal information must be obtained 
fairly and lawfully; used only for the original purpose specified; adequate, relevant 
and not excessive to the purpose; accurate and up to date; and destroyed after its 
purpose is completed. 
This proposed measure complies with the aforementioned 
requirements and addresses the need for legislation to protect personal data. 
This bill stipulates that personal data must be set up only for a specified 
purpose that i s  relevant to the interests of the party and must be obtained 
legitimately and in accordance with the purpose for which the file was set up. The 
party controlling the data has a duty to make appropriate measures to ensure that the 
data processed is complete and accurate, i t s  use i s  compatible with the purpose of 
the data file, and is not disclosed to unauthorized persons. Under this measure, a 
person shall have the right to unimpeded access to his or her personal records and act 
accordingly on the same. 
This bill likewise penalizes the following acts: 1) processing of personal data 
without the consent of, and despite the opposition of, the data subject, or without 
being authorized under any existing lawlor this Act to do so; 2) the processing of 
personal data for purposes not authorized by the data subject, or otherwise 
prohibited under the existing laws or this Act; 3) the malicious reporting of any person 
of a personal data obtained by him or her from a data controller or transferred to him 
or her unknowingly; and, 4)the breach of confidentiality when the information has 
been published or reported by media. 
In view of the foregoing, the immediate approval of this measure i s  earnestly 
requested. 


mci -2 P6. 3 
THIRTEENTH CONGRESS OF THE REPUBLIC 
Second Regular Session 
) 
OF THE PHILIPPINES 
) 
Introduced by the HONORABLE MAR ROUS 
AN ACT 
TO ESTABLISH FAIR PRACTICES IN THE PROCESSING OF INFORMATION RELATING OR 
PERSONAL TO INDIVIDUALS, CREATING FOR THE PURPOSE A PERSONAL DATA 
PROTECTION COMMISSION, AND FOR OTHER PURPOSES 
Be it enacted by the Senate and the House of Representatives of the 
Philippines in Congress assembled: 
Section 1. Title. - This Act shall be known as- the “Data Protection Act of 
2005. ” 
Section 2. Declaration of Policy. - It is hereby declared the policy of the state 
to protect the fundamental human rights and freedoms of natural persons, in 
particular the inviolability of private life with respect to the processing of data and to 
regulate the processing of personal data to ensure that all transactions related 
thereto are conducted in an efficient and responsible manner. 
I 
Any doubt in the interpretation of any provision of this Act shaN be interpreted 
in favor of the rights and interests of the individual whose private information i s  being 
processed. 
Section 3. 
Definition of Terms. - Whenever used in this Act, the following 
terms shall have the respective meanings hereafter set forth, unless the context 
requires otherwise: 
1. 
2. 
3. 
4. 
“Data” means information which- 
a) 
i s  
being 
processed 
by 
means 
of 
equipment 
operating 
automatically in response to instructions given for that purpose; 
b) 
i s  recorded with the intention that it should be processed by 
means of such equipment; and 
c) 
i s  recorded as part of a relevant filing system or with the 
intention that is should form part of a relevant filing system 
“Personal data” means any information relating to an identified or 
identifiable data subject which can be linked by a data controller or a 
third person belonging to a specific data subject 
“Data subject” means a natural person who may directly or indirectly be 
referred to in a data processing system, and i s  identified with 
particularity in the said system for his or her physical, physiological, 
mental, economic, cultural or social identity, among others. 
“Data controller” means a natural or juridical person, public authority, 
agency or any other body duly authorized by law who is qualified and 
competent to process the personal data pertaining to a data subject, 
and duly registered with the National Data Protection Commission 


5. 
“Data processor” means any natural or juridical person qualified to act 
as such under this Act to whom a data controller may outsource the 
processing of personal data pertaining to a data subject 
6. 
“Processing” 
shall mean any operation or any set of operations 
concerning personal data, including, but not limited to, the collection, 
recording, organization, storage, updating or modification, retrieval, 
consultation, use, consolidation, blocking, erasure, or destruction of 
data 
, ,  
7. 
’ 
“Filing system” means any set of information relating to natural or 
juridical persons to the extent that, although the information i s  not 
processed by means of equipment operating automatically in response to 
instructions given for that ‘purpose, the set i s  structured, either by 
reference to individuals or by reference to criteria relating to 
individuals, in such a way that specific information relating to a 
particular person is readily accessible. 
’ “Sensitive personal data” means personal data which is likely to give rise 
.to unlawful or arbitrary discrimination, which includes, but i s  not limited 
,’ to, data which indicate the ;race, ethnic origin, religious, philosophical 
’ 
’ or political affiliations,~ and financial, transactions, or which provide 
information as to the health or sexual life of a person, or any proceeding 
for any offense committed or alleged to have been committed by such 
person, the disposal of such proceedings, or the sentence of any court in 
such proceedings. 
“Consent of the data subject” means any freely given, specific and 
informed expression of will, either in written or electronic form 
executed personally and voiuntarily by the data subject, whereby the 
data subject agrees to the processing of personal data about and/or 
relating to him or her: 
’ 
8. 
9. 
I O .  
’ 
“Commission” shall refer to the National Data Protection Commission 
created by virtue of this Act. 
Section 4. Scope - This Act applies to the processing of all types of personal 
data, and to any natural and juridical person involved in personal data processing. 
This Act does not apply to the information ‘systems made by natural persons in 
which personal data are processed for personal or household and family purposes and 
in which the personal data collected are not disclosed to other persons. 
Section 5. Exceptions- Sections 7, 8 and 13 of this Act shall not apply if 
personal data are processed for journalistic, artistic or Literary purposes, and it is not 
otherwise prohibited by law. 
CHAPTER 11. THE NATIONAL DATA PROTECTION COMMISSION 
Section 6. Functions of the National Data Protection Commission - To 
administer and implement the provisions of this Act and monitor the compliance of 
the country with international standards set for data protection, there i s  hereby 
created an independent body to be known as the National Data Protection 
Commission, which shall have the following functions: 


ensure compliance of 'data controllers' and data processors with the 
provisions of this Act; 
receive complaints, institute investigations, adjudicate, or award 
indemnity on matters affecting any personal data. For this purpose, the 
Commission may be given access to personal data subject of any 
complaint and to collect the information necessary to adjudicate or 
award indemnity on matters affecting any personal data; 
issue cease and desist orders, impose a temporary or permanent ban on 
the processing of personal data, upon finding that the processing will be 
detrimental to national security and public interest; 
examine applications for grants of authority to implement a personal 
data processing system and register personal data processing systems; 
oversee and monitor the plocessing of personal data to prevent any 
breach in the protection of the same and ensure that the rights of the 
data subject are upheld at all times 
coordinate with other government agencies and the private sector on 
efforts to formulate and implement plans and policies to strengthen the 
protection of personal data in the country; 
Section 7. Organizational Structure of the Commission - The Commission 
shall be attached to the Office of the President and shall be headed by an Executive 
Director and to be assisted by two (2) Deputy Directors, one to be responsible for 
Data Processing Systems and one to be responsible for Policies and Planning. The 
Executive Director and the two (2) Deputy Directors shall be appointed by the 
President of the Philippines for a term of three (3) years. 
The Executive Director must be a member of the Philippine Bar, at least thirty- 
five (35) years of age and of good moral character, unquestionable integrity and 
known probity. The Executive Director shall enjoy the benefits, privileges and 
emoluments equivalent to the rank of Undersecretary. 
The Deputy Directors must be recognized experts in the field of data processing 
and intellectual property. They shall enjoy the benefits, privileges and emoluments 
equivalent to the rank of Assistant Secretary. 
Section 8. The Secretariat - The Commission i s  hereby authorized to establish 
a Secretariat. Majority of the members of the Secretariat must have served for at 
least five (5) years in any agency of the government that i s  involved in the processing 
of personal data, including, but not limited to the following offices: National 
Statistical Office (NSO), 
Government Service Insurance System (GSIS), Land 
Transportation Office ( LTO), 
Bureau of Internal Revenue (BIR), Philippine Health 
insurance Corporation (PhilHealth), Commission on Elections (Comelec), Department 
of Foreign Affairs (DFA), Department of Justice, and Philippine Postal Corporation 
(PhilPost). 
CHAPTER 111. PROCESSING OF PERSONAL DATA 
Section 9. General principles of data processing - Personal data shall not be 
processed at all, except when certain conditions are met. The processing of personal 


data, if allowed, shall adhere to the principles of transparency, legitimate purpose 
and proportionality. 
1, 
Personal data must be: 
a) 
collected for specified and legitimate purposes determined and 
declared before collecting personal data and later processed in a 
way compatible with such declared, specified and legitimate 
purposes; 
processed accurately, ]precisely, fairly and lawfully; 
accurate, relevant, and, where necessary for the processing of 
personal data, kept up to date; inaccurate or incomplete data 
must be rectified, supplemented, destroyed or their further 
processing must be restricted 
consistent, adequate and not excessive in relation to the purposes 
for which they are collected and processed; 
kept within a period not exceeding the time within which the 
purposes for which the data was obtained would be achieved 
kept in a form which permits identification of data subjects for no 
longer than i s  necessary for the purposes for which the data were 
collected and processed; Provided, that personal data collected 
for other purposes may be processed for historical, statistical or 
scientific purposes and in cases laid down in law may be stored 
for longer periods; Provided, further, that adequate safeguards 
are guaranteed by said laws authorizing their processing. 
I 
b) 
c) 
d) 
e) 
f) 
2. 
The controller must ensure implementation of personal data processing 
principles set out in paragraphs 1 and 2 of this section. 
Section I O .  Criteria for lawful processing of personal data - The processing of 
personal data shall be permitted only if not otherwise prohibited by law, and at least 
one of the following conditions exist: 
1 .) 
2.) 
the personal data is necessary and is a legal consequence of a 
the data subject has given his or her unambiguous consent; 
contractual obligation of the data subject; 
3.) 
the processing is necessary to protect vitally important interests of the 
data subject, including life and health; or 
the processing i s  necessary in order to respond to national emergency, 
to comply with the requirements of public order and safety, or to fulfill 
functions of public authority which necessarily includes the processing of 
personal data for the fulfillment of i t s  mandate. 
4.) 
Section 11. Sensitive data- The processing of sensitive personal data shall be 
prohibited, except in the following cases: 
1 .) 
the data subject has given his or her consent prior to the processing; 


the processing of the same is 'provided for by existing laws and 
regulations, Provided, that such regulatory enactments guarantee the 
protection of the sensitive personal data, and Provided further, that the 
consent of the data subject is not required by the law, or regulation 
permitting the processing of :sensitive personal data; 
the processing i s  necessary :to protect the life and health of the data 
subject or another person, and the data subject i s  not legally or 
physically able to express his or her consent prior to the processing; 
processing is necessary to'achieve the lawful, non-commercial objectives 
of public organizations and their associations, Provided, such processing 
is only confined and related to the bonafide members of these 
organizations or'their associations, Provided further, that the sensitive 
personal data are not transferred to third parties, and Provided finally, 
that consent of the data subject was obtained prior to processing; 
the processing i s  necessary for the purposes of medical treatment, is 
carried out by a medical practitioner or a medical treatment institution, 
and an adequate level of protection of personal data i s  ensured; or 
the processing concerns such personal data as i s  necessary for the 
protection of lawful rights and interests of natural or legal persons in 
court proceedings, 
, 
Provided that, in all cases, the data controller is duly authorized by the 
Commission to engage in the processing of sensitive personal data. 
Section 12. Data controller - Any person, natural or juridical, may be granted 
the authority to act as a data controller by the Commission upon application and 
examination, taking into consideration the impartiality, independence and technical 
competence of the applicant. 
Section 13. Data processor- A data controller may subcontract the processing 
of personal data to a personal data processor; Provided, that, prior to the 
commencement of any contract, the data processor has been duly qualified to act as 
such by and i s  registered with the Commission; Provided, further, that the data 
controller shall retain primary control over the personal data processed by the data 
processor; and Provided, finally, that the data controller shall be responsible for 
ensuring that proper safeguards are in place to ensure the confidentiality of the 
personal data processed, guarantee i t s  non-transferability to unauthorized persons, 
and prevent i t s  use for unauthorized purposes. 
Section 14. Storage of data- Persokal data shall be stored and used only for as 
long as it is necessary to achieve the purpose for which it was processed, after which 
the personal data shall be deleted or blocked from a personal database, unless 
otherwise provided by law. 
CHAPTER IV. RIGHTS OF THE DATA SUBJECT 
Section 15. Rights of the data subject- The data subject is entitled to: 
1. 
be informed whether personal data pertaining to him or her shall 
be, are being, or have been processed; 


3. 
4. 
5. 
~ 
before the entry of his or her personal data into the processing 
system of the data controller, be furnished the following: 
a. 
description of the personal data of to be entered into the 
system; 
purposes for which they are being or are to be processed; 
scope and method of the personal data processing; 
recipients or classes of recipients to whom they are or may 
be disclosed; and 
b. 
c. 
d. 
e. 
methods utilized for automated access, if the same is 
allowed by the data subject, and the extent to which such 
access i s  authorized. 
Any information supplied or declarations made to the data 
subject on these matters shall not be amended without prior 
notification of data subject; 
be given access to, upon demand, the following: 
a. 
b. 
C. 
d. 
e. 
f. 
g. 
contents of his/her personal data that were processed 
source from which personal data were obtained 
names and addresses of recipients of the personal data 
manner by which such data were processed 
reasons for the disclosure of the personal data to recipients 
information on the decision-making involved in selecting 
the manner by which personal data shall or will be 
disclosed on data that will or i s  likely to be made as the 
sole basis for any decision significantly affecting or will 
affect a data subject; 
date when his or her personal data concerning the data 
subject were last accessed and modified; 
dispute the inaccuracy of erroneous personal data and have the 
data controller correct it immediately and accordingly. If the 
personal data has been corrected, the data controller shall ensure 
the accessibility of both the new and the retracted information 
and the simultaneous receipt of the new and the retracted 
information by recipients thereof; 
suspend, withdraw or order the blocking, removal or destruction 
of his or her personal data from the data controller’s filing system 
upon discovery and substantial proof that the personal data are 
incomplete, outdated, false, unlawfully obtained, used for 
unauthorized purposes, or are no longer necessary for the 
purposes for which they were collected. In this case, the data 
controller shall rectify the inaccuracy without delay and notify 


third parties who have previously received such processed data. 
Likewise, the data controller shall indemnify the data subject for 
any damages sustained by the latter due to such inaccuracy; 
Section 16. Non-applicability. The preceding section i s  not applicable if the 
processed data are used only for the needs of scientific and statistical research and, 
on the basis of such, no activities are carried out and no decisions are taken regarding 
the data subject, Provided, that the personal data shall be held under strict 
confidentiality and shall be used the same only for the declared purpose 
CHAPTER v. REGISTRATION OF PERSONAL DATA PROCESSING SYSTEM 
Section 17. The Application - (1) Prior to the carrying out or commencing of 
personal ' data processing or ,the establishment of a system for personal data 
processing, a data controller shall first submit for the Commission's approval the 
personal data processing system it seeks to implement. For this purpose, the data 
controller shall submit an application to the Commission, which shall contain the 
following: 
a. 
A request for the grant of authority to implement a particular personal 
data processing system; 
Name of the data controller or data processor, date of i t s  registration 
with the Commission, the place where i t s  principal office i s  located, and 
the term for which it has been authorized by the Commission'to act as 
The legal basis for the operation of the personal data processing system; 
' The type of personal data to! be included in the system, the purposes for 
b. 
. '  
, 
, such; 
,, 
, 
c. 
' 
d. 
which it i s  intended and the :cope of personal data to be processed; 
The categories of data subjects; 
The categories of recipients of personal data; 
The intended method of personal data processing; 
The planned method of obtainins personal data and a mechanism for the 
control of their quality; 
Other data processing systems which will be connected with the system 
i 
,
,
 
e. 
f. 
g. 
h,. 
i. 
, 
, to be registered; 
j. 
Such other data systems which will be able to obtain data from the 
system to be registered, and what data the system to be registered will 
be able to obtain from connected systems; 
The method for transferring data from the system to be registered to 
another system; 
The identification codes of natural or juridical persons that will be used 
by the system to be registered; 
The method for exchanging information with the data subject; 
k. 
l. 
m. 


n. 
The procedures whereby a data subject i s  entitled to obtain information 
concerning himself or herself; 
0. 
The procedures for supplementing and updating of personal data; 
p. 
Technical and organizational measures to ensure the protection of 
personal data; and 
q. 
What personal data will be transferred to other countries or jurisdictions 
The registration procedure prescribed by this Act i s  not applicable to the 
personal data processing carried out by institutions specially authorized by law in the 
areas of public safety, law enforcement, national security and defense. 
Section 18. Publication of Application - After the payment of filing fees and 
prior to the formal review of the application, the Commission shall, at the expense of 
the applicant, cause the publication of the items set out in subparagraph a and b of 
the preceding section and the notice of the formal review of the application once 
every week in at least (2) newspapers of general circulation for a period of and 
deadline for submission of comments three (3) consecutive weeks. If the required fees 
for the grant are not paid or the printing i s  not done in due time, the application shall 
be deemed withdrawn. 
Section 19. Following the publication of the application, any person may 
submit, in writing, his or her comments or opposition on the application. The 
comment or opposition shall be submitted to the Commission at least ten (15) days 
prior to the scheduled formal review of the application. The Commission shall notify 
the applicant of such comment or opposition and the latter may submit i t s  comment 
or answer within ten (IO) days from receipt of the notice. 
Section 20. The Commission shall conduct the formal review of the application 
within thirty (30) days from the publication of the application and shall approve or 
deny the application within thirty (30) days from the completion of the review. 
Section 21. Amendment of Application - An applicant may amend i t s  
application on or before the date of review; Provided, that, such amendment shall 
not include new matters outside the scope of the disclosures contained in the 
application as filed. If new matters are to be included in the amended application, 
the same shall be treated as a new application and the corresponding time periods 
shall apply. 
Section 22. Grant of Authority- If the application meets all the requirements 
of this Act, the Commission shall grant the authority to implement the particular 
personal data processing system subject of the application. The grant to implement a 
personal data processing system shall take effect upon the issuance of certificate of 
registration. 
CHAPTER VI. SECURITY OF DATA 
Section 23. Security of Data - 
1. The data controller and data processor shall implement appropriate 
measures to protect personal data against natural dangers, such as accidental loss or 
destruction and human dangers such as unlawful access, fraudulent misuse, unlawful 
destruction, alteration, and contamination. These measures, specified in a written 


document or i t s  equivalent, must be appropriate to the nature of the data to be 
protected and the risks represented by the processing. 
2. The employees, agents or representative of the data controller, and data 
processor, and their representatives who are involved in the processing personal data 
shall operate hold personal data under strict confidentiality if these personal data are 
not intended for public disclosure. This obligation shall continue even after leaving 
the public service, transfer to another position or upon termination of employment or 
contractual relations. 
CHAPTER VII. TRANSFER OF PERSONAL DATA 
Section 24. Transfer of Personal Data to Data Recipients in Foreign 
Jurisdiction - 
1. Prior to the transfer of, personal data to recipients in foreign jurisdictions, 
the consent of the data subject and the approval of the Commission must first be 
sought, except in the cases referred to in paragraph 3 of this section. 
2. The Commission shall grant an authorization'for transfer of personal data to 
foreign jurisdictions upon, finding and proof, that there is an adequate level of 
personal data protection in such:' jurisdiction, taking into consideration: a) the 
existence and implementation 'of laws on protection of personal information in the 
jurisdiction; b) the nature of the data and the circumstances by which a data transfer 
operation may be done in such jurisdiction; and c) the purpose of the transfer, the 
duration of the use for the personal data, the respectability of the rights of the data 
subject provided in this Act in the foreign jurisdiction. 
3. ;Without the authorization of, the Commission, personal data may, be 
transferred to a foreign jurisdiction or an international law enforcement organization 
only if: 
a) 
the transfer of personal data is necessary for the conclusion or 
performance of a contract between the data controller and a third 
party; 
b) 
the transfer of personal data is necessary for the performance of a 
contract between the data controller and the data subject or the 
implementation of pre-contractual measures ; 
, the transfer of personal data is necessary or required by a 'lawful order 
of a competent court of'local jurisdiction; 
the personal data is contained in and is being transferred from a public 
data file in accordance with the procedure prescribed by laws and other 
rules and regulations. 
c) 
d) 
CHAPTER VIII. PENAL PROVISIONS 
Section 25. Penalties for the Unauthorized Processing of Personal Data - The 
penalty of imprisonment ranging from six (6) to twelve (12) years and a fine of not 
less than one million pesos (Php 1,000,000.00) but not more than three million pesos 
(Php 3,000,000.00) shall be imposed on persons who process personal data without 
the consent of the data subject, or without being authorized under this Act or any 
existing law. 


Section 26. Penalties for the Processing of Personal Data for Unauthorized 
Purposes - The penalty of imprisonment from six (6) years and one day to eight (8) 
years and a fine of not 'less than Five hundred thousand Philippine pesos 
(Php500,000.00) but not more than one million Philippine pesos (Php, 1,000,000.00) 
shall be imposed on persons processing personal data for purposes not authorized by 
the data subject, or otherwise authorized under this Act or under existing laws. 
Section 27. Malicious Disclosure. Any person who, with malice or in bad faith, 
discloses unwarranted or false information relative to any personal data obtained by 
him or her from a data controller or unknowingly transferred to him or her, shall be 
subject to'a penalty of six (6) months and one (1) day to two (2) years and four (4) 
months of imprisonment and a fine of not less than One hundred thousand pesos 
(PhplOO,OOO.OO) but not more than Five hundred thousand pesos (Php500, 000.00). 
Section 28. Breach of Confidentiality. 'The penalty of imprisonment ranging 
from two (2) years, four (4) months and 1 day,, to four ,(4) 
years and two (2) months 
and a fine of, not less than Two'hundred thousand pesos (Php 200,000.00) but not 
more than Five Hundred Thousand pesos (Php 500,000.00) shall be imposed in case of 
a breach of confidentiality where such breach has resulted in the information being 
published or reported by media. In this case, the responsible reporter, writer, 
president, publisher, manager and editor-in-chief shall be liable under this Act. 
Section 29. Extent of, Liability - If the offender i s  a corporation, association, 
partnership or any juridical person, the penalty,shall be imposed upon the responsible 
officers, as the case may be, who participated in, 'or allowed by their gross 
negligence, allowed the commission of the crime. If the offender i s  a juridical person, 
the court may suspend or revoke any of i t s  rights under this Act. If the offender i s  an 
alien, he shall, in addition to the penalties herein prescribed, be deported without 
further proceedings after serving the penalties herein prescribed. If the offender i s  a 
public official or employee and he i s  found guilty of acts penalized under Sections 25 
and 26 of this Act, he or she shall, in addition to the penalties prescribed herein, 
suffer perpetual or temporary absolute disqualification from office, as the case may 
be. 
, 
Section 30. Restitution. - Restitution for any aggrieved party shall be 
governed by the provisions of the New Civil Code. 
CHAPTER IX. MISCELLANEOUS PROVISIONS 
Section 31, Implementing Rules and Regulations - Within thirty (60) days from 
the appointment of the Executive Director of the Commission and the constitution of 
the Secretariat, the Commission shall promulgate the rules and regulations to 
effectively implement the provisions of this Act. Said rules and regulations shall be 
submitted to the Congressional Oversight Committee for approval. Aside from those 
expressly stipulated under this Act, the Commission shall issue implementing rules and 
regulations (IRR), on the following: 
1. 
restrictions on the use and transfer of personal data to foreign 
jurisidictions; 
sanctions to be imposed by the Commission on: 
a. 
2. 
delay in or non-submission of reports it may require the data 
controller or data processor to submit in the performance of i t s  
functions 


b. 
entities other than data controller or data processor, for breaches 
of confidentiality of, or misuse of, personal data obtained from 
the Commission 
3. 
suspension or cancellation of the authority of data controllers and/or 
data protectors 
4. 
measures by which the Commission may be allowed to release and 
disclose personal data without the consent of the data subject, 
consistent with existing lawsland regulations 
Upon the approval of the IRR by the Congressional Oversight Committee 
created under this Act, the same shall be immediately published in at least two (2) 
newspapers of general circulation. 
Section 32. Congressional Oversight Committee. - There i s  hereby created a 
Congressional Oversight Committee composed of seven (7) members from the Senate 
and seven (7) members from the House of Representatives. The members from the 
respective Houses shall be appointed by the Senate President or Speaker of the House 
of Representatives based on the proportional representation of the parties or 
coalitions therein with at least two (2) members of each House representing the 
minority. The Oversight Committee shall have the power to promulgate its own rules, 
to oversee the implementation of this Act, and to review or revise the implementing 
rules issued by the Commission within thirty (30) days from the promulgation of the 
said rules. 
Section 33. Appropriations Clause - The Commission shall be provided with 
an initial appropriation of Twenty-five million Philippine pesos (Php25,000,000.00) to 
be drawn from the national government. Appropriations for the succeeding years shall 
be included in the General Appropriations Act. 
Section 34. Separability Clause - If any part or provision of this Act shall be 
held unconstitutional or invalid, other provisions hereof that are not affected thereby 
shall continue to be in full force and effect. 
Section 35. Repealing Clause - All other laws, decrees, executive orders, 
proclamations and administrative regulations, or parts thereof inconsistent herewith 
are hereby repealed or modified accordingly. 
Section 36. Effectivity Clause - This Act shall take effect fifteen (15) days 
after i t s  publication in at least two (2) national newspapers of general circulation. 
Approved,