NINETEENTH CONGRESS OF THE 
REPUBUC OF THE PHILIPPINES 
First Regular Session
S. No.
)
SENATE
1108
of tl.i?
72 AUG-8 P3 *08
RFCEi’/CD Br
Introduced by Senator Jinggoy Ejercito Estrada
AN ACT
PROTECTING THE USERS OF RADIO FREQUENCY IDENTIFICATION 
DEVICES
EXPLANATORY NOTE
The use of Radio Frequency Identification (RFID) tags and trackers are 
proven useful, convenient and economical in various industries. They are widely 
used in the transportation sector for toll, train and bus cards. It is also embedded in 
identification documents such as passports, company IDs, school IDs, and 
membership IDs. RFIDs are reliable devices for tracking both objects and persons 
such as merchandise, packages, pets, or patients in hospital settings.
The National Telecommunications Commission (NTC) issued in 2006 
Memorandum Circular No. 03-08-2006 regarding the Use and Operation of Radio 
Frequency Identification (RFID) within the 13.553-13.567 MHz, 918-920 MHz, and 
2446-2454 MHz Bands. It regulates the approval, acceptance, registration and 
licensing of RFID proximity readers and provides for penalties for violations of its
provisions.
The "RFID Users Protection Act' seeks to provide complete and appropriate 
information to the consumers about the use of RFID tags and protect them from 
unauthorized access to their personal information stored in the said tags. It also 
mandates the seller or user of RFID tags to employ security measures to ensure that


are consistent with industry standards and are commensurate with the amount and 
sensitivity of the information being stored in the system.
A legislative measure of this nature was originally filed by Senator Miriam 
Defensor Santiago in the 16th Congress.
In this light, the immediate passage of this bill is highly recommended.
NGGPY E3ERCITO ESTRADA


NINETEENTH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session
S. No.
)
SENATE
1108
of ftir
'22 flUG-8 P3.-08
R^:C£IV^:DBV.
Introduced by Senator Jinggoy Ejercito Estrada
AN ACT
PROTECTING THE USERS OF RADIO FREQUENCY IDENTIFICATION 
DEVICES
Be it enacted by the Senate and House of Representatives of the Philippines in 
Congress assembled:
1 
Section 1. Short Tide. - This Act shall be known as the 'XRFID Users
2 
Protection Act'.
3 
Sec. 2. Definition of Terms. - As used in this Act, the term:
4 
(a) Data means personal information, numerical values associated with a
5 
person's facial features, or unique personal identifier numbers stored in
6 
an identification device;
7 
(b) Identification device means an Item that uses radio frequency
8 
identification technology;
9
(c) Persona! Information includes any of the
10
associated with an Individual:
11
(1)
Social security number;
12
(2)
Driver's license number;
13
(3)
Bank account number;
14
(4)
Credit or debit card number;
15
(5)
Personal identification number;
16
(6)
Automated or electronic signature;
17
(7)
Unique biometric data;


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
32
(8) 
Account passwords;
(9) 
Telephone number;
(10) Address;
(11) Date of birth; or,
(12) Any other piece of information that can be used to access an 
individual's financial accounts or to obtain goods or services, 
or offer goods or services based on that information without 
an individual's consent;
(d) Radio frequency identification or RFID means a technology that uses 
radio waves to transmit data remotely to readers and are intended to 
carry data in suitable transponders, generally known as tags, and to 
retrieve data, by hand- or machine-readable means, at a suitable time 
and place to satisfy particular application needs. Data within a tag 
may provide identification of an item, goods in transit, a location, the 
identity of persons and/or their belongings, a vehicle or assets, an 
animal or other types of information;
RFID systems employ tiny chips and wireless antennas that can be 
embedded into products and used for unique identification purposes. 
It is a contact-less solution that works with proximity readers and RFID
tags.
(e) Proximity reader \s a device that transmits an interrogating / querying 
signal to an RFID tag and receives unique information from the tag. 
Readers have two high level versions - those that store data and those 
that simply store a reference key for look-up on host system,
(f) Remoteiy means that no physical contact between the identification 
device and the reader is necessary in order to transmit data; and,
(g) RFID tag is a microchip attached to an antenna that picks up signals 
from and sends signals to a reader. A tag contains a unique number, 
but may have other information. RFID tags may be classified as:
1) Active tag which is used for long distance purposes such as in toll 
highways, parking areas, and gas stations. This tag uses small 
batteries which enable it to send signals at a longer distance; and,


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
32
2) Passive tag which is used very near or in close proximity to a 
reader and does not use any internal battery.
(h) Unique persona! identifier number means a randomly assigned string of 
numbers or symbols that is encoded on the identification device and is
intended to identify the identification device.
Sec. 3. Notice Requirement — Any person who sells, issues, or distributes 
items containing an RFID tag must post a notice informing the consumer of the use 
of such technology. The notice must disclose the following Information:
a) The item contains or may contain an electronic communication device,
b) The consumer has the legal right to request that an item containing an 
RFID tag be removed or deactivated before the item leaves the store 
premises; and,
c) The consumer has the right to request a copy of all personal 
information collected about himself or herself through an RFID tag, 
including the identity of any person who has had access to the 
consumer's personal information.
Sec. 4. LabeHing Requirement — Any person who sells, uses or distributes an 
item that contains an RFID tag must iabel the item with a notice stating that:
a) The item contains an RFID tag capabie of engaging in electronic
communication; and,
b) The RFID tag can transmit personal information to an independent 
reader or scanner both before and after purchase or issuance.
Sec. 5. Requesting Review of Persona! Information. - A consumer may 
request all stored personal Information pertaining to himself or herself, including the 
identity of any individual or entity who has had access to the consumer's personal 
information. After reviewing one's personal information, the consumer must be 
given the opportunity to contest the accuracy of his or her personal data, correct or 
amend the data, and request that the information be removed or destroyed from the 
database, unless such removal or destruction is prohibited by law.
Sec. 6. Removal or Deactivation. - Upon request by a consumer, a person 
who sells, issues or distributed an item containing an RFID tag must remove or 
deactivate the device before the consumer leaves the store premises. Any costs


1 
associated with removal or deactivation cannot be passed on to the consumer. Once
2 
deactivated, it must not be reactivated without the express written consent of the
3 
consumer associated with the item.
4 
Sec. 7. Security Measures. — Any person who sells or utilizes an RFID tag
5 
must impiement adequate security measures to ensure that information is secure
6 
from unauthorized access, loss or tampering. These security measures should be
7 
consistent with industry standards that are commensurate with the amount and
8 
sensitivity of the information being stored on the system.
9 
Sec. 8. Unauthorized Scanning and Other Prohibited Uses. - A person may
10 
not use an electronic communication devise to remoteiy scan, or attempt to scan, an
11 
item associated with a consumer without the consumer's knowledge. A person may
12 
not disclose, either directly or through an affiliate, a consumer's personal information
13 
associated with information gathered by, or contained within, an RFID tag. A person
14 
may not use, either directly or through an affiliate or non-affiliated third party,
15 
information gathered by, or contained within, an RFID tag in order to identify a
16 
consumer.
17 
Sec. 9. Penaity for Uniawfui Scanning. - A person who intentionally scans
18 
another person's identification device remoteiy, without that person's prior
19 
knowledge and prior consent, for the purpose of fraud, identity theft, or for any
20 
other purpose, shall be subject to a fine of not less than Fifty thousand pesos
21 
(P50,000.00) but not more than Five hundred thousand pesos (P500,000.00).
22 
Sec. 10. Separabiiity Clause. - If any part, section or provision of this Act is
23 
held invalid or unconstitutional, other provisions not affected thereby shall remain in
24 
full force and effect.
25 
Sec. 11. Repealing Clause. - All laws, decrees, orders, rules and regulations
26 
or parts thereof inconsistent with this Act are hereby repealed or amended
27 
accordingly.
28 
Sec. 12. Effectivity. - This Act shall take effect fifteen (15) days after its
29 
publication in the Officiai Gazette or in two (2) newspapers of general circulation.
Approved,