EIGHTEENTH CONGRESS OF THE 
)
REPUBLIC OF THE PHILIPPINES 
)
First Regular Session 
)
S E N A T E
S. No. 
454
'V ■ ' i \  
csr ) ^
,
of t5)C €•■ ■
*19 JUL 15 A9 59
RECt:V^D )'•
Introduced by SENATOR RAMON BONG REVILLA, JR.
AN ACT
PROTECTING 
THE 
USERS OF 
RADIO 
FREQUENCY IDENTIFICATION 
DEVICES
EXPLANATORY NOTE
Radio frequency identification tags and trackers were introduced as early as 
1970s but their use was limited due to high cost. The continuous development in 
information and technology together with the gradual increase in its use brought 
down the cost of using RFID and expanded its features and uses.
At present, different industries have already shifted to radio frequency 
identification device (RFID) for various purposes and it is, in fact, present in items 
that we use everyday such as passports, train cards, toll booth cards, access cards in 
offices and schools, and microchip implants in animals. The use of RFID tags and 
trackers undoubtedly make various systems and operations in our daily lives 
convenient and efficient, but authorities should put in place measures to ensure that 
such usage is regulated and monitored.
The National Telecommunications Commission (NTC) issued Memorandum 
Circular No. 03-08-2006 regarding "Use and operation of Radio Frequency


Identification (RFID) within the 13.553-13.567 MHz, 918-920 MHz, and 2446-2454 
MHz bands", which provides for rules and regulations regarding RFIDs as well as 
penalties for violations thereof.
This bill intends to further protect the users of RFID, particularly by ensuring 
that its usage does not violate any rights of our citizens as enshrined in the 
Constitution, particularly their right to privacy. It outlines the measures on how RFID 
users can protect their personal information that have been solicited or gathered.
In this light, the immediate passage of this bill is highly recommended.
RAMOMBONG REVILLA, 3R.


EIGHTEENTH CONGRESS OF THE 
)
REPUBLIC OF THE PHILIPPINES 
)
First Regular Session 
)
Of iiK
S E N A T E
454
S. No
*19 JUL 15 A9 59
RECE1\,'^l' o
Introduced by SENATOR RAMON BONG REVILLA, JR.
AN ACT
PROTECTING THE 
USERS OF 
RADIO 
FREQUENCY 
IDENTIFICATION 
DEVICES (RFID)
Be it enacted by the Senate and House o f Representative o f the Philippines in 
Congress assembled:
1
2
3
4
5
6
7
8 
9
10
11
12
13
14
Section 1. 
Short Tide. - This Act shall be known as the "RFID Users 
Protection Act'.
Sec. 2. Definition o f Terms. -  As used in this Act, the term:
a) "Data" means personal information, numerical values associated with a 
person's facial features, or unique personal identifier numbers stored 
on an identification device;
b) "Identification device" means an item that uses radio frequency 
identification technology;
c) "Personal Information" includes any of the following information 
associated with an individual:
1) Social security number;
2) Driver's license number;
3) Bank account number;
4) Credit or debit card number;


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28 
29
5) Personal identification number;
6) Automated or electronic signature;
7) Unique biometric data;
8) Account passwords;
9) Telephone number;
10) Address;
11) Date of birth; or
12) Any other piece of information that can be used to access an 
individual's financial accounts or to obtain goods or services, or 
offer goods or services based on that information without an 
individual's consent;
d) "Radio frequency identification device" or "RFID" means a technology 
that uses radio waves to transmit data remotely to readers and are 
intended to carry data in suitable transponders, generally known as 
tags, and to retrieve data, by hand- or machine-readable means, at a 
suitable time and place to satisfy particular application needs. 
Data 
within a tag may provide identification of an item, goods in transit, a 
location, the identity of persons and/or their belongings, a vehicle or 
assets, an animal or other types of information.
RFID systems employ tiny chips and wireless antennas that can be 
embedded into products and used for unique identification purposes. 
It is a contact-less solution that works with proximity readers and RFID 
tags;
e) "Proximity reader" is a device that transmits an interrogating / 
querying signal to an RFID tag and receives unique information from 
the tag. Readers have two high level versions -  those that store data 
and those that simply store a reference key for look-up on host 
system;


1 
f) "R em otel/' means that no physical contact between the identification
2 
device and the reader is necessary in order to transmit data; and,
3 
g) "RFID tag" is a microchip attached to an antenna that picks up signals
4 
from and sends signals to a reader. A tag contains a unique number,
5 
but may have other information, such as customers' account number.
6 
RFID tags may be classified as:
7 
1) Active tag which is used for long distance purposes such
8 
as in toll highways, parking areas, and gas stations. This
9 
tag uses small batteries which enable it to send signals at
10 
a longer distance; and,
11 
2) Passive tag which is used very near or in close proximity
12 
to a reader and does not use any internal battery.
13 
h) "Unique personal identifier number" means a randomly assigned string
14 
of numbers or symbols that is encoded on the identification device and
15 
is intended to identify the identification device.
16 
Sec. 3. Notice Requirement — Any person who sells, issues, or distributes
17 
items containing an electronic communication device must post a notice informing
18 
the consumer of the use of such technology. The notice must disclose the following
19 
information:
20 
a) The item contains or may contain an electronic communication device;
21 
b) The consumer has the legal right to request that an item containing an
22 
electronic communication device be removed or deactivated before the
23 
item leaves the premises; and,
24 
c) The consumer has the right to request a copy of all personal
25 
information collected about himself or herself through an electronic
26 
communication device, including the identity of any person who has
27 
had access to the consumer's personal information.


1 
Sec. 4. Labelling Requirement -  A person must not sell, use or distribute an
2 
item that contains an electronic communication device without labelling the item
3 
with a notice stating that:
4 
a) The item contains an electronic communication device capable of
5 
engaging in electronic communication; and,
6 
b) The device can transmit personal information to an independent reader
7 
or scanner both before and after purchase or issuance.
8 
Sec. 5. 
Requesting Review o f Persona! Information. -  A consumer may
9 
request all stored personal information pertaining to himself or herself, including the
10 
identity of any individual or entity who has had access to the consumer's personal
11 
information. 
After reviewing one's personal information, the consumer must be
12 
given the opportunity to contest the accuracy of his or her personal data, correct or
13 
amend the data, and request that the information be removed or destroyed from the
14 
database, unless such removal or destruction is prohibited by law.
15 
Sec. 6. Removal or Deactivation. — Upon request by a consumer, a person
16 
who sells, issues or distributed an item containing an electronic communication
17 
device must remove or deactivate the device before the consumer leaves the
18 
premises. Any costs associated with removal or deactivation cannot be passed on to
19 
the consumer. 
Once deactivated, it must not be reactivated without the express
20 
written consent of the consumer associated with the item.
21 
Sec. 7. Security Measures. -  Any person who sells or utilizes an electronic
22 
communication device must implement adequate security measures to ensure that
23 
information is secure from unauthorized access, loss or tampering. These security
24 
measures should be consistent with industry standards that are commensurate with
25 
the amount and sensitivity of the information being stored on the system.
26 
Sec. 8. 
Unauthorized Scanning and Other Prohibited Uses. -  A person may
27 
not use an electronic communication devise to remotely scan, or attempt to scan, an
28 
item associated with a consumer without the consumer's knowledge. A person may
29 
not disclose, either directly or through an affiliate, a consumer's personal information


2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21
1
associated with information gathered by, or contained within, a device capable of 
engaging in electronic communication. 
A person may not use, either directly or 
through an affiliate or non-affiliated third party, information gathered by, or 
contained within, a device capable of engaging in eiectronic communication in order 
to identify a consumer.
Sec. 9. 
Penalty fo r Unlawful Scanning. — A person who intentionally scans 
another person's identification device remotely, without that person's prior 
knowledge and prior consent, for the purpose of fraud, identity theft, or for any 
other purpose, shall be subject to a fine of not less than Fifty Thousand Pesos 
(P50,000.00) but not more than Five Flundred Thousand Pesos (P500,000.00).
Sec. 10. Separability Clause. — If any part, section or provision of this Act is 
held invalid or unconstitutional, other provisions not affected thereby shall remain in 
fuil force and effect.
Sec. 11. Repealing Clause. -  All laws, decrees, orders, rules and regulations 
or parts thereof inconsistent with this Act are hereby repealed or amended 
accordingly.
Sec. 12. 
EffectMty. -  This Act shali take effect fifteen (15) days after its 
pubiication in the Official Gazette or in two (2) newspapers of general circulation.
Approved,