Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

18TH CONGRESS
First Regular Session

HOUSE BILL No, 2188

Introduced by Representative Michael L. Romero

EXPLANATORY NOTE

It is the policy of the republic of the Philippines to hereby protect the
fundamental human right of privacy, of communication while ensuring free flow
of information to promote innovation and growth.

The State recognizes the vital role of information and communications
technology in nation-building and its inherent obligation to ensure that personal
information in information and communications systems in the government and
in the private sector are secured and protected.

This House Bill seeks to foster protection for individual personal information in
information and communications systems in the government and the private
Sector, providing stiffer provisions, rationalize all existing rules and regulations,
and creating a more effective and sufficient data privacy scheme.

7
A

Thus, the early passage of this bill is earnestly requested.
wo =

MICHAEL L. ROMERO Ph.D.


Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

18TH CONGRESS
First Regular Session

HOUSE BILL NO. 1188

Introduced by Representative Michael L. Romero

AN ACT
AMENDING REPUBLIC ACT NO.10173, OTHERWISE
KNOWN AS THE “DATA PRIVACY ACT OF 2012”, TO ADOPT A
MORE SYSTEMATIC, COMPREHENSIVE AND EFFECTIVE
PROTECTION PROGRAM, TO FOSTER THE IMPOSITION OF ALL
EXISTING POLICIES AND GUIDELINES, INCREASING ITS
PENALTIES AND SANCTIONS, AND FOR OTHER PURPOSES

Be it enacted by the Senate and House of Representative of the Philippines
in congress assembled:

SECTION 1.
Section 25 of chapter VIII of Republic Act No. 10173, is hereby amended to read
as follows:
CHAPTER VIII
PENALTIES
SECTION 25. Unauthorized Processing of Personal Information and

Sensitive Personal Information —


{a) The unauthorized processing of personal information shall be
penalized by imprisonment ranging from two (2) years to four (4)
years and a fine of not less than One million pesos
(Php1,000,000.00) but not more than Two million pesos
(Php2,000,000.00) shall be imposed on persons who process
personal information without the consent of the data subject, or
without being authorized under this Act or any existing law.

(b) The unauthorized processing of personal sensitive information
shall be penalized by imprisonment ranging from three (3) years to
six (6) years and a fine of not less than One million pesos
(Php1,000,000.00) but not more than Four million pesos
(Php4,000,000.00) shall be imposed on persons who process
personal information without the consent of the data subject, or
without being authorized under this Act or any existing law.

SECTION 2.

Section 26 of chapter VIII of Republic Act No. 10173, is hereby amended to read
as follows:

SECTION 26. Accessing Personal Information and Sensitive Personal
Information Due to Negligence -

(a) Accessing personal information due to negligence shall be
penalized by imprisonment ranging from two (2) years to four (4)
years and a fine of not less than One million pesos
(Php1,000,000.00) but not more than Three million pesos
(Php3,000,000.00) shall be imposed on persons who, due to
negligence, provided access to personal information without being
authorized under this Act or any existing law.

(b) Accessing sensitive personal information due to negligence shall
be penalized by imprisonment ranging from three (3) years to six (6)
years and a fine of not less than One million pesos
(Php1,000,000.00) but not more than Four million pesos
(Php4,000,000.00) shall be imposed on persons who, due to
negligence, provided access to personal information without being
authorized under this Act or any existing law.


SECTION 3.

Section 27 of chapter VIII of Republic Act No. 10173, is hereby amended to read
as follows:

SECTION 27. Improper Disposal of Personal Information and Sensitive
Personal Information-

(a) The improper disposal of personal information shall be penalized
by imprisonment ranging from one (1) year to three (3) years and a
fine of not less than ‘Three hundred thousand pesos
(Php300,000.00) but not more than One million pesos
(Php1,000,000.00) shall be imposed on persons who knowingly or
negligently dispose, discard or abandon the personal information of
an individual in an area accessible to the public or has otherwise

placed the personal information of an individual in its container for
trash collection.

b) The improper disposal of sensitive personal information shall be
penalized by imprisonment ranging from two (2) years to four (4)
years and a fine of not less than Five hundred thousand pesos
(Php500,000.00) but not more than Two million pesos
(Php2,000,000.00) shall be imposed on persons who knowingly or
negligently dispose, discard or abandon the personal information of
an individual in an area accessible to the public or has otherwise
placed the personal information of an individual in its container for
trash collection.

SECTION 4.

Section 28 of chapter VIII of Republic Act No. 10173, is hereby amended to read
as follows:

SECTION 28. Processing of Personal Information and Sensitive Personal
Information for Unauthorized Purposes ~The processing of personal
information for unauthorized purposes shall be penalized by


imprisonment ranging from three (3) years to six (6) years and a fine of not
less than One million pesos (Php1,000,000.00) but not more than Three
million pesos (Php3,000,000.00) shall be imposed on persons processing
personal information for purposes not authorized by the data subject, or
otherwise authorized under this Act or under existing laws.

The processing of sensitive personal information for unauthorized
purposes shall be penalized by imprisonment ranging from three (3) years
to seven (7) years and a fine of not less than One million pesos
(Php1,000,000.00) but not more than Three million pesos
(Php3,000,000.00) shall be imposed on persons processing sensitive
personal information for purposes not authorized by the data subject, or
otherwise authorized under this Act or under existing laws.

SECTION 5.

Section 29 of chapter VIII of Republic Act No. 10173, is hereby amended to read
as follows:

SECTION 29. Unauthorized Access or Intentional Breach -The penalty of
imprisonment ranging from two (2) years to four (4) years and a fine of not
less than One (1) milion pesos (Php1,000,000.00) but not more than
Three million pesos (Php3,000,000.00) shall be imposed on persons who
knowingly and unlawfully, or violating data confidentiality and security
data systems, breaks in any way into any system where personal and
sensitive personal information is stored.

SECTION 6.

Section 30 of chapter VIII of Republic Act No. 10173, is hereby amended to read
as follows:

SECTION 30. Concealment of Security Breaches Involving Sensitive
Personal Information ~The penalty of imprisonment of three (3) years to
six (6) years and a fine of not less than One million pesos
(Php1,000,000.00) but not more than Three million pesos
(Php3,000,000.00) shall be imposed on persons who, after having
knowledge of a security breach and of the obligation to notify the


Commission pursuant to Section 20(f) of RA10173, intentionally or by
omission conceals the fact of such security breach.

SECTION 7.

Section 31 of chapter VIII of Republic Act No. 10173, is hereby amended to read
as follows:

SECTION 31. Malicious Disclosure. — Any personal information controller
or personal information processor or any of its officials, employees or
agents, who, with malice or in bad faith, discloses unwarranted or false
information relative to any personal information or personal sensitive
information obtained by him or her, shall be subject to imprisonment
ranging from three (3) years to six (6) years and a fine of not less than One
million pesos (Php1,000,000.00) but not more than Three mil
(Php3,000,000.00).

ion pesos

SECTION 8.

Section 32 of chapter VIII of Republic Act No. 10173, is hereby amended to read
as follows:

SECTION 32. Unauthorized Disclosure -

(a) Any personal information controller or personal information
processor or any of its officials, employees or agents, who discloses
toa third party personal information not covered by the immediately
preceding section without the consent of the data subject, shall he
subject to imprisonment ranging from two (2) years to four (4) years
and a fine of not less than One million pesos (Php1,000,000.00)
but not more than Three million pesos (Php3,000,000.00).

(b) Any personal information controller or personal information
processor or any of its officials, employees or agents, who discloses
to a third party sensitive personal information not covered by the
immediately preceding section without the consent of the data
subject, shall be subject to imprisonment ranging from three (3)
years to six (6) years and a fine of not less than One million pesos


(Php1,000,000.00) but not more than Three million pesos
(Php3,000,000.00).

SECTION 9.

Section 33 of chapter VIII of Republic Act No. 10173, is hereby amended to read
as follows:

SECTION 33. Combination or Series of Acts. - Any combination or series of
acts as defined in Sections 25 to 32 shall make the person subject to
imprisonment ranging from three (3) years to six (6) years and a fine of not
less than Two million pesos (Php2,000,000.00) but not more than Five
million pesos (Php5,000,000.00)

SECTION 10.

Section 34 of chapter VIII of Republic Act No. 10173, is hereby amended to read
as follows:

SECTION 34. Extent of Liability.- If the offender is a corporation,
partnership or any juridical person, the penalty shall be imposed upon the
responsible officers, as the case may be, who participated in, or by their
gross negligence, allowed the commission of the crime. If the offender is a

juridical person, the court may suspend or revoke any of its rights under
this Act.

If the offender is an alien, he or she shall, in addition to the penalties
herein prescribed, be deported without further proceedings after serving
the penalties prescribed. If the offender is a public official or employee and
lie or she is found guilty of acts penalized under Sections 27 and 28 of this
Act, he or she shall, in addition to the penalties prescribed herein, suffer
perpetual absolute disqualification from office, as the case may be.

SECTION 11.


Section 41 of chapter IX of Republic Act No. 10173, is hereby amended to read
as follows:

CHAPTER IX
MISCELLANEOUS PROVISIONS

SECTION 41. Appropriations Clause. - The Commission shall be provided
with an initial appropriation of Twenty million pesos (Php20,000,000.00)
to be drawn from the national government.

Appropriations for the succeeding years shall be included in the General
Appropriations Act (GAA). It shall likewise receive a continuing
appropriations of Twenty million pesos (Php20,000,000.00) per year, and

every year after upon implementation of this Act drawn from the national
government.

SECTION 12.

Section 42 of chapter IX of Republic Act No. 10173, is hereby amended to read
as follows:

SECTION 42. Transitory Provision. - Existing industries, businesses and
offices affected by the implementation of this Act shall be given six (6)
months transitory period from the effectivity of the IRR or such other
period as may be determined by the Commission, to comply with the
requirements of this Act.

SECTION 13. IMPLEMENTING RULES AND REGULATIONS. - The
departments and agencies charged with carrying out the provisions of this
Act shall, within sixty (60) days after the effectivity of this Act, formulate

the necessary rules and regulations for its effective implementation.

SECTION 14. REPEALING CLAUSE. - All laws, decrees, executive
orders, rules and regulations, or parts thereof inconsistent with the
provisions of this Act are hereby repealed or modified accordingly.


SECTION 15. SEPARABILITY CLAUSE. — If, for any reason, any
section or provision of this Act is held unconstitutional or invalid, the other

sections or provisions hereof shall not be affected thereby.

SECTION 16. EFFECTIVITY CLAUSE. - This Act shall take effect
after fifteen (15) days from its publication in the Official Gazette or in at

least two (2) national newspapers of general circulation whichever comes

earlier.

Approved,