Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

EIGHTEENTH CONGRESS

First Regular Session

House Bill'No.940 7

Introduced by HON. ROZZANO RUFINO B. BIAZON

EXPLANATORY NOTE ’

This bill seeks to protect children who are using the internet by prohibiting the
unauthorized collection, use or disclosure of personal information of a child. It provides certain
conditions that must be met first in order that the collection, use or disclosure of personal
information from a child may be allowed.

Digital technology is already a part of our lives in these modern times. According to
the United Nations Children’s Fund (UNICEF) in its “The State of the World's Children 2017:
Children in a digital world,” report, one in three internet users worldwide is a child. While it
has many benefits, the internet also has negative impacts, especially on children — from
cyberbullying to misuse of their private information to online sexual abuse and exploitation.

If there is one user of the internet therefore who needs special protection, it should be
the child. The UNICEF report further recommends the following in order to address the
protection of children using the internet:

Safeguard children’s privacy and identities online;
Teach digital literacy to keep children informed, engaged and safe online;
Leverage the power of the private sector to advance ethical standards and practices;
that protect and benefit children online; and

© Putchildren at the center of digital policy.

In view of the foregoing, the early passage of this bill is eamestly sought.

RO whol B. for

Representative
Lone District, Muntinlupa City


Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

EIGHTEENTH CONGRESS
First Regular Session

House Bill No. 5407

Introduced by HON. ROZZANO RUFINO B. BIAZON

AN ACT
PROVIDING PROTECTION FOR CHILDREN USING THE INTERNET

Be it enacted by the Senate and House of Representatives of the Philippines in
Congress, assembled:

SECTION 1. Short Title. — This Act shali be known as the “Children's Online Privacy
Protection Act.”

Sec. 2. Definition of Terms. ~ As used in this Act:
a. “Child” refers to a person under eighteen (18) years of age.

b. “Department” refers to the Department of Information and Communication
Technology. ‘

c. “Disclosure” means, with respect to personal information:

1. the release of personal information collected from a child in identifiable form
by an operator for any purpose, except where such information is provided to
aperson other than the operator who provides support for the internal
operations of the website and does not disclose or use that information for any
other purpose; and

2. making personal information collected from a child by a website or online
service directed to children or with actual knowledge that such information
was collected from a child, publicly available in identifiable form, by any
means including by a public posting, through the Internet, or through:

(i) ahome page of a website;

(ii) a pen pal service;


(iii)_an electronic mail service;
(iv) a message board; or
(v) achat room.

“Internet” means collectively the myriad of computer and telecommunicatior
facilities, including equipment and operating software, which comprise the
interconnected world-wide network of networks that employ the Transmission
Control Protocol/Internet Protocol, or any predecessor or successor protocols to
such protocol, to communicate information of all kinds by wire or radio.

“Online contact information” refers to an e-mail address or another substantially
similar identifier that permits direct contact with a person online;

“Operator” refers to any person who operates a website located on the Internet or
an online service and who collects or maintains personal information from or about
the users of or visitors to such website or online service, or on whose behalf such
information is collected or maintained, where such website or online service is
operated for commercial purposes, including any person offering products
or services for sale through that website or online.

“Parent” includes a legal guardian.

“Person” refers to any individual, partnership, corporation, trust, estate,
cooperative, association, or other entity. ‘

“Personal information” refers to individually identifiable information about an
individual collected online, including:

1. a first and last name;

2. a home or other physical address including street name and name of a city
ora municipality;

3. an email address;
4. a telephone number;

5. @ government service insurance system identification number or a social
service security number;

6. any other identifier that the Department determines permits the physical or
online contacting of a specific individual; or A

7. information concerning the child or the parents of that child that the website
collects online from the child and combines with an identifier described in
this section;


j. “Verifiable parental consent” means any reasonable effort, taking into account
available technology, including a request for authorization for the collection, use
and disclosure described in the notice, to ensure that a parent of a child receives
notice of the operator's personal information collection, use and disclosure
practices, and authorizes the collection, use and disclosure, as applicable, of
personal information and the subsequent use of that information before that
information is collected from that child.

k. Website or online service directed to children. ~ (1) In general, the term “website
or online service directed to children” means:

(i) acommercial website or online service that is targeted to children; or

(ii) that portion of a commercial website or online service that is targeted to
children.

(2) Limitation. — A commercial website or online service, or a portion of a
commercial website or online service, shall not be deemed directed to children
solely for referring or linking to a commercial website or online service directed to
children by using information location tools, including a directory, index, reference,
pointer, or hypertext link.

Sec. 3. Prohibited Act. — An operator of a website or online service directed to children

shall be prohibited from collecting, using or disclosing personal information from a child in a
manner that violates the provisions of this Act. An operator of such a website or
online service or the operator’s agent shall not be held liable for any disclosure made in good
faith and following reasonable procedures in responding to a request for disclosure of personal
information to the parent of a child as provided under this Act.

Sec. 4 Collection of Personal Information from a Child; When Allowed. — The

collection of personal data from a child by any website or online service directed to children
may be allowed provided that the following requirements are complied with:

(a) the operator provides notice on the website or online service of what information is
collected from children, how the operator uses such information, and
the operator’s disclosure practices for such information; and

(b) the operator obtains verifiable parental consent for the collection, use or disclosure
of personal information from children.

Sec. 5. When Consent Not Required. ~ Verifiable parental consent shall not be required

under the following circumstances:

‘
a, online contact information collected from a child that is used only to respond
directly on a one-time basis to a specific request from the child and is not used to
recontact the child and is not maintained in retrievable form by the operator;

b. arequest for the name or online contact information of a parent or child that is used
for the sole purpose of obtaining parental consent or providing notice under this


section and where such information is not maintained in retrievable form by
the operator if parental consent is not obtained after a reasonable time;

c. online contact information collected from a child that is used only to respond more
than once directly to a specific request from the child and is not used to recontact
the child beyond the scope of that request:

(i) if, before any additional response after the initial response to the child,
the operator uses reasonable efforts to provide a parent notice of
the online contact information collected from the child, the purposes for
which it is to be used, and an opportunity for the parent to request that
the operator make no further use of the information and that it not be
maintained in retrievable form; or

(ii) without notice to the parent in such circumstances as the Department may
determine are appropriate, taking into consideration the benefits to
the childof access to information and services, and risks to
the security and privacy of the child, in rules and regulations promulgated
for the implementation of this Act; ’

d. the name of the child and online contact information, to the extent reasonably
necessary to protect the safety of a child participant on the site, is:

(i) _ used only for the purpose of protecting such safety;

(ii) not used to recontact the child or for any other purpose; and

(iii) not disclosed on the site;
If the operator uses reasonable efforts to provide a parent notice of the name
and online contact information collected from the child, the purposes for which it is

to be used, and an opportunity for the parent to request that the operator make no
further use of the information and that it not be maintained in retrievable form; or

e. the collection, use, or dissemination of such information by the operator of such a
website or online service is necessary:

(i) _ to protect the security or integrity of its website; '‘

(ii) _ to take precautions against liability;

(iii) to respond to judicial process; or

(iv) to the extent permitted under other provisions of law, to provide
information to law enforcement agencies or for an investigation on a

matter related to public safety.

Sec. 6. Role of the Department of Information and Communication Technology. — The
Department of Information and Communication Technology shall be the primary agency


tasked with the protection of children using the internet and the implementation of this Act. In
order to accomplish this mandate, it shall:

a. require an operator to provide, upon request of a parent whose child has provided
personal information to that website or online service and upon proper verification
of the identification of that parent:

() _adescription of the specific types of personal information collected from
the child by that operator;

(ii) the opportunity at any time to refuse to permit the operator's
further use or maintenance in retrievable form, or future online
collection, of personal information from that child; and

Gi) notwithstanding any other provision of law, a means that is reasonable
under the circumstances for the parentto obtain any personal
information collected from that child;

b. prohibit an operator from conditioning a child’s participation in a game, the
offering of a prize, or another activity on the child disclosing more personal
information than is reasonably necessary to participate in such activity; and

¢. require the operator of such a website or online service to establish and maintain
reasonable procedures to protect the confidentiality, security, and integrity of
personal information collected from children.

Sec. 7. Extraterritorial Application. —‘This Act applies to an act done or practice
engaged in and outside of the Philippines by an entity if:

a. The act, practice or processing relates to personal information about a Philippine
citizen or a resident;

b. The entity has a link with the Philippines, and the entity is processing personal
information in the Philippines or even if the processing is outside the Philippines as
long as it is about Philippine citizens or residents such as, but not limited to,
following:

(1) A contract is entered in the Philippines;

(2) A juridical entity unincorporated in the Philippines but has central
management and control in the country; and

(3) An entity that has a branch, agency, office or subsidiary in the Philippines
and the parent or affiliate of the Philippine entity has access to personal
information; and

c. The entity has other links in the Philippines such as, but not limited to:

(1) The entity carries on business in the Philippines; and


(2) The personal information was collected or held by an entity in the
Philippines.

Sec. 8. Penalties. — A violation of any of the provisions of this Act shall be penalized
by imprisonment ranging from one (1) year to three (3) years or a fine of not less than Five
hundred thousand pesos (PhpS00,000.00) but not more than Two million pesos
(Php2,000,000.00), or both, at the discretion of the courts.

SEC. 9. Implementing Rules and Regulations. ~ Within ninety (90) days upon the
effectivity of this Act, the Secretary of Information and Communication Technology shall
promulgate the necessary rules and regulations to effectively implement the provisions of this
Act.

SEC. 10. Separability Clause. — If any provision or part hereof, is held invalid or
unconstitutional, the remainder of the law or the provision not otherwise affected shall remain
valid and subsisting.

See. 10. Repealing Clause. — Any law, presidential decree, executive order, letter of
instruction, administrative order, rule or regulation contrary to, or is inconsistent with, the

provisions of this Act is hereby repealed or amended accordingly.

Sec. 11, Effectivity. This Act shall take effect fifteen (15) days after its publication in
at least two (2) newspapers of general circulation.

Approved,