NINETEENTH CONGRESS OF THE 
)
REPUBLIC OF THE PHILIPPINES 
)
First Regular Session 
)
SENATE 
S. No. 1R85
myiBfficr of the £ e. er.irv
’22 DEC-5 P1:i7
RECEIVEOB'~cr'
Introduced by SENATOR RAMON BONG REVILLA, JR.
AN ACT
PROTECTING THE USERS OF RADIO FREQUENCY IDENTIFICATION 
DEVICES
EXPLANATORY NOTE
Radio frequency identification (RFID) tags and trackers were introduced as 
early as 1970s but their use was limited due to high cost. The continuous development 
in information and technology, together with the gradual increase in its use, brought 
down the cost of using RFID and expanded its features and uses.
At present, different industries have already shifted to RFID for various 
purposes and it is, in fact, present in items that we use everyday such as passports, 
train cards, toll booth cards, access cards in offices and schools, and microchip 
implants in animals. The use of RFID tags and trackers undoubtedly make various 
systems and operations in our daily lives convenient and efficient, but authorities 
should put in place measures to ensure that such usage is regulated and monitored.
The National Telecommunications Commission (NTC) issued Memorandum 
Circular No. 03-08-2006 regarding "Use and operation of Radio Frequency 
Identification (RFID) within the 13.553-13.567 MHz, 918-920 MHz, and 2446-2454 
MHz bands", which provides for rules and regulations regarding RFIDs, as well as 
penalties, for violations thereof.
This bill intends to further protect the users of RFID, particularly by ensuring 
that its usage does not violate any rights of our citizens as enshrined in the 
Constitution, particularly their right to privacy. It outlines the measures on how RFID 
users can protect their personal information that have been solicited or gathered.
In this light, the immediate passage of this bill is highly recommended.
RAMON
EVILLA, JR.


NINETEENTH CONGRESS OF THE 
)
REPUBLIC OF THE PHILIPPINES 
)
First Regular Session 
)
SENATE
s. No.
Senate
i'ttr of fijf j^-rrefarj?
■22 DEC-5 P1:17
Ri:ChlV "Dif1
Introduced by SENATOR RAMON BONG REVILLA, JR.
AN ACT
PROTECTING THE USERS OF RADIO FREQUENCY IDENTIFICATION 
DEVICES
1
2
3
4
5
6
7
8 
9
Section 1. Short Title. - This Act shall be known as the "RFID Users Protection
Act'.
Sec. 2. Definition of Terms. - As used in this Act, the term:
a. Data means personal information, numerical values associated with a person's 
facial features, or unique personal identifier numbers stored on an identification 
device;
b. Identification device means an item that uses radio frequency identification 
technology;
c. Personal Information includes any of the following information associated with
10
an individual:
11
i.
Social security number;
12
ii.
Driver's license number;
13
iii.
Bank account number;
14
iv.
Credit or debit card number;
15
V.
Personal identification number;
16
vi.
Automated or electronic signature;
17
vii.
Unique biometric data;
18
viii.
Account passwords;
19
ix.
Telephone number;
20
X.
Address;


1 
xi. Date of birth; or
2 
xii. Any other piece of information that can be used to access an individuai's
3 
financial accounts, or to obtain goods or services, or offer goods or
4 
services based on that information without an individual's consent.
5 
d. Radio frequency identification or RFID means a technology that uses radio
6 
waves to transmit data remotely to readers and are intended to carry data in
7 
suitable transponders, generally known as tags, and to retrieve data, by hand-
8 
or machine-readable means, at a suitable time and place to satisfy particular
9 
application needs. Data within a tag may provide identification of an item,
10 
goods in transit, a location, the identity of persons and/or their belongings, a
11 
vehicle or assets, an animal or other types of information;
12 
e. /?/7Z7 5/5fe/775employ tiny chips and wireless antennas that can be embedded
13 
into products and used for unique identification purposes. It is a contact-less
14 
solution that works with proximity readers and RFID tags.
15 
f. Proximity reader is a device that transmits an interrogating/ querying signal to
16 
an RFID tag and receives unique information from the tag. Readers have two
17 
high level versions - those that store data and those that simply store a
18 
reference key for look-up on host system;
19 
g. Remotely medins that no physical contact between the identification device and
20 
the reader is necessary in order to transmit data; and
21 
h. RFID tag \s a microchip attached to an antenna that picks up signals from and
22 
sends signals to a reader. A tag contains a unique number, but may have other
23 
information, such as customers' account number. RFID tags may be classified
24 
as:
25 
i. Active tag which is used for long distance purposes, such as in toll
26 
highways, parking areas, and gas stations. This tag uses small batteries
27 
which enable it to send signals at a longer distance; and
28 
ii. Passive tag which is used very near or in close proximity to a reader,
29 
and does not use any internal battery.
30 
i. Unique personal identifier number means a randomly assigned string of
31 
numbers or symbols that is encoded on the identification device and is intended
32 
to identify the identification device.


1 
Sec. 3. Notice Requirement - Any person who sells, issues, or distributes
2 
items containing an electronic communication device must post a notice informing the
3 
consumer of the use of such technology. The notice must disclose the following
4 
information:
5 
a. The item contains or may contain an electronic communication device;
6 
b. The consumer has the legal right to request that an item containing an
7 
electronic communication device be removed or deactivated before the item
8 
leaves the premises; and
9 
c. The consumer has the right to request a copy of all personal information
10 
collected about himself or herself through an electronic communication device,
11 
including the identity of any person who has had access to the consumer's
12 
personai information.
13 
Sec. 4. Labeiiing Requirement - A person must not sell, use, or distribute an
14 
item that contains an electronic communication device without labelling the item with
15 
a notice stating that:
16 
a. The item contains an electronic communication device capable of engaging in
17 
electronic communication; and,
18 
b. The device can transmit personal information to an independent reader or
19 
scanner both before and after purchase or issuance.
20 
Sec. 5. Requesting Review of Personai Information. — A consumer may request
21 
all stored personal information pertaining to himself or herself, including the identity
22 
of any individual or entity who has had access to the consumer's personal information.
23 
After reviewing one's personal information, the consumer must be given the
24 
opportunity to contest the accuracy of his or her personal data, correct or amend the
25 
data, and request that the information be removed or destroyed from the database,
26 
unless such removal or destruction is prohibited by law.
27 
Sec. 6. Removai or Deactivation. - Upon request by a consumer, a person who
28 
sells, issues, or distributes an item containing an electronic communication device
29 
must remove or deactivate the device before the consumer leaves the premises. Any
30 
costs associated with removal or deactivation cannot be passed on to the consumer.
31 
Once deactivated, it must not be reactivated without the express written consent of
32 
the consumer associated with the item.


1 
Sec. 7. Security Measures. - Any person who sells or utilizes an electronic
2 
communication device must implement adequate security measures to ensure that the
3 
information is secure from unauthorized access, loss or tampering. These security
4 
measures should be consistent with industry standards that are commensurate with
5 
the amount and sensitivity of the information being stored on the system.
6 
Sec. 8. Unauthorized Scanning and Other Prohibited Uses. - A person may not
7 
use an electronic communication device to remotely scan, or attempt to scan, an item
8 
associated with a consumer without the consumer's knowledge. A person may not
9 
disclose, either directly or through an affiliate, a consumer's personal information
10 
associated with information gathered by, or contained within, a device capable of
11 
engaging in electronic communication. A person may not use, either directly or
12 
through an affiliate or non-affiliated third party, information gathered by, or contained
13 
within, a device capable of engaging in electronic communication in order to identify
14 
a consumer.
15 
Sec. 9. Penalty for Unlawful Scanning. - A person who intentionally scans
16 
another person's identification device remotely, without that person's prior knowledge
17 
and prior consent, for the purpose of fraud, identity theft, or for any other purpose,
18 
shall be subject to a fine of not less than Fifty Thousand Pesos (P50,000.00) but not
19 
more than Five Hundred Thousand Pesos (P500,000.00).
20 
Sec. 10. Separability Clause. - If any part, section or provision of this Act is
21 
held invalid or unconstitutional, other provisions not affected thereby shall remain in
22 
full force and effect.
23 
Sec. 11. Repealing Clause.-k\\ laws, decrees, orders, rules and regulations or
24 
parts thereof contrary to, or inconsistent with, this Act are hereby repealed, modified
25 
or amended accordingly.
26 
Sec. 12. Effectivity. - This Act shall take effect fifteen (15) days after its
27 
publication either in the Official Gazette or in at least two (2) newspapers of general
28 
circulation in the Philippines.
Approved,