RA 10173 - Data Privacy Act

Republic Act No. 10173 August 15, 2012 Republic of the Philippines Congress of the Philippines Metro Manila Fifteenth Congress Second Regular Session Begun and held in Metro Manila, on Monday, the twenty-fth day o July, two thousand eleven. [!"#B$%& A&' (). 101*+ AN AC PR!"C#N$ #N%#&#%'A( P"RS!NA( #NF!RMA#!N #N #NF!RMA#!N AN% C!MM'N#CA#!NS C!MM'N#CA#!NS S)S"MS #N *" $!&"RNM"N AN% *" PR#&A" S"C!R+ CR"A#N$ F!R *#S P'RP!S" A NA#!NA( PR#&AC) C!MM#SS#!N+ AN% F!R !*"R P'RP!S"S Be it enacted, by the Senate and House of Representatives of the Philippines in Congress assembled: &A"'! % !(!A$ ")/%%)( !&'% !&'%)( )( 1. Shor Shortt Titl Title. e.  'his At shall e 3nown as the 4ata "rivay At o 20126. !&. 2. !eclaration of Policy.  %t is the 7oliy o the tate to 7rot 7rote ett the the und unda8 a8en enta tall hu8a hu8an n righ rightt o 7riv 7riva ay, y, o  o88uni o88uniation ation while ensuring ensuring ree 9ow o inor8at inor8ation ion to 7ro8ote innovation and growth. 'he tate reogni:es the

vital role o inor8ation and o88uniations tehnology in nation- nation-uild uilding ing and its inheren inherentt oligation oligation to ensure ensure that 7ersonal 7ersonal inor8atio inor8ation n in inor8atio inor8ation n and o88uni o88uniation ations s syste8s in the govern8ent and in the 7rivate setor are seured and 7roteted. !&. +. !e"nition of Terms. ; a? Commission sha shall reer er to the (at (ation ional &o88ission reated y virtue o this At.

"riva ivay y

>? Consent of the data sub#ect reers to any reely given, s7ei s7eif, f, inor inor8ed 8ed india indiatio tion n o will, will, wher where ey y the data data su@et agrees to the olletion and 7roessing o 7ersonal inor8ati inor8ation on aout aout andor andor relatin relating g to hi8 or her. her. &onsent &onsent shall e evidened y written, eletroni or reorded 8eans. %t 8ay also e given on ehal o the data su@et y an agent s7eifally authori:ed y the data su@et to do so. >? !ata sub#ect sub#ect reer reers s to an indivi individua duall whose whose 7erson 7ersonal al inor8ation is 7roessed. >d? !irect mar$eting reers to o88uniation y whatever 8eans 8eans o any advertising advertising or 8ar3etin 8ar3eting g 8aterial 8aterial whih is direted to 7artiular individuals. >e? %iling system reers to any at o inor8ation relating to natural or @uridial 7ersons to the etent that, although the inor inor8at 8ation ion is not 7roe 7roesse ssed d y eCui7 eCui78en 8entt o7erat o7erating ing auto8ati auto8atially ally in res7ons res7onse e to instru instrutions tions given or that 7ur7 7ur7ose ose,, the the set is stru strutur tured ed,, eithe eitherr y reer reeren ene e to individuals or y reerene reerene to riteria relating to individuals, in suh suh a way way that that s7e s7eif if  inor inor8a 8ati tion on rela relati ting ng to a 7artiular 7erson is readily aessile.

>? &nformation and Communications System reers to a syste8 or generating, sending, reeiving, storing or otherwise 7roessing eletroni data 8essages or eletroni dou8ents and inludes the o87uter syste8 or other si8ilar devie y or whih data is reorded, trans8itted or stored and any 7roedure related to the reording, trans8ission or storage o eletroni data, eletroni 8essage, or eletroni dou8ent. >g? Personal information reers to any inor8ation whether reorded in a 8aterial or8 or not, ro8 whih the identity o  an individual is a77arent or an e reasonaly and diretly asertained y the entity holding the inor8ation, or when 7ut together with other inor8ation would diretly and ertainly identiy an individual. >h? Personal information controller reers to a 7erson or organi:ation who ontrols the olletion, holding, 7roessing or use o 7ersonal inor8ation, inluding a 7erson or organi:ation who instruts another 7erson or organi:ation to ollet, hold, 7roess, use, transer or dislose 7ersonal inor8ation on his or her ehal. 'he ter8 eludes= >1? A 7erson or organi:ation who 7eror8s suh untions as instruted y another 7erson or organi:ationD and >2? An individual who ollets, holds, 7roesses or uses 7ersonal inor8ation in onnetion with the individualEs 7ersonal, a8ily or household aFairs. >i? Personal information processor reers to any natural or  @uridial 7erson Cualifed to at as suh under this At to who8 a 7ersonal inor8ation ontroller 8ay outsoure the 7roessing o 7ersonal data 7ertaining to a data su@et. >@? Processing reers to any o7eration or any set o  o7erations 7eror8ed u7on 7ersonal inor8ation inluding, ut not li8ited to, the olletion, reording, organi:ation,

storage, u7dating or 8odifation, retrieval, onsultation, use, onsolidation, lo3ing, erasure or destrution o data. >3? Privileged information reers to any and all or8s o data whih under the ules o &ourt and other 7ertinent laws onstitute 7rivileged o88uniation. >l? Sensitive inor8ation=

personal

information reers

to

7ersonal

>1? Aout an individualEs rae, ethni origin, 8arital status, age, olor, and religious, 7hiloso7hial or 7olitial aGliationsD >2? Aout an individualEs health, eduation, geneti or seual lie o a 7erson, or to any 7roeeding or any oFense o88itted or alleged to have een o88itted y suh 7erson, the dis7osal o suh 7roeedings, or the sentene o  any ourt in suh 7roeedingsD >+? %ssued y govern8ent agenies 7euliar to an individual whih inludes, ut not li8ited to, soial seurity nu8ers, 7revious or 8-rent health reords, lienses or its denials, sus7ension or revoation, and ta returnsD and >H? 7eifally estalished y an eeutive order or an at o &ongress to e 3e7t lassifed. !&. H. Scope. ; 'his At a77lies to the 7roessing o all ty7es o 7ersonal inor8ation and to any natural and  @uridial 7erson involved in 7ersonal inor8ation 7roessing inluding those 7ersonal inor8ation ontrollers and 7roessors who, although not ound or estalished in the "hili77ines, use eCui78ent that are loated in the "hili77ines, or those who 8aintain an oGe, ranh or ageny in the "hili77ines su@et to the i88ediately sueeding 7aragra7h= Provided, 'hat the reCuire8ents o  etion 5 are o87lied with.

 'his At does not a77ly to the ollowing= >a? %nor8ation aout any individual who is or was an oGer or e87loyee o a govern8ent institution that relates to the 7osition or untions o the individual, inluding= >1? 'he at that the individual is or was an oGer or e87loyee o the govern8ent institutionD >2? 'he title, usiness address and oGe tele7hone nu8er o the individualD >+? 'he lassifation, salary range and res7onsiilities o the 7osition held y the individualD and >H? 'he na8e o the individual on a dou8ent 7re7ared y the individual in the ourse o e87loy8ent with the govern8entD >? %nor8ation aout an individual who is or was 7eror8ing servie under ontrat or a govern8ent institution that relates to the servies 7eror8ed, inluding the ter8s o the ontrat, and the na8e o the individual given in the ourse o the 7eror8ane o those serviesD >? %nor8ation relating to any disretionary eneft o a fnanial nature suh as the granting o a liense or 7er8it given y the govern8ent to an individual, inluding the na8e o the individual and the eat nature o the eneftD >d? "ersonal inor8ation 7roessed or @ournalisti, artisti, literary or researh 7ur7osesD >e? %nor8ation neessary in order to arry out the untions o 7uli authority whih inludes the 7roessing o 7ersonal data or the 7eror8ane y the inde7endent, entral 8onetary authority and law enore8ent and regulatory agenies o their onstitutionally and statutorily 8andated

untions. (othing in this At shall e onstrued as to have a8ended or re7ealed e7uli At (o. 1H05, otherwise 3nown as the erey o Ban3 e7osits AtD e7uli At (o. IH2I, otherwise 3nown as the oreign &urreny e7osit AtD and e7uli At (o. K510, otherwise 3nown as the &redit %nor8ation yste8 At >&%A?D >? %nor8ation neessary or an3s and other fnanial institutions under the @urisdition o the inde7endent, entral 8onetary authority or Bang3o entral ng "ili7inas to o87ly with e7uli At (o. K510, and e7uli At (o. K1I0, as a8ended, otherwise 3nown as the Anti-Money $aundering At and other a77liale lawsD and >g? "ersonal inor8ation originally olleted ro8 residents o oreign @urisditions in aordane with the laws o those oreign @urisditions, inluding any a77liale data 7rivay laws, whih is eing 7roessed in the "hili77ines. !&. 5. Protection '(orded to )ournalists and Their Sources.  (othing in this At shall e onstrued as to have a8ended or re7ealed the 7rovisions o e7uli At (o. 5+, whih aFords the 7ulishers, editors or duly aredited re7orters o  any news7a7er, 8aga:ine or 7eriodial o general irulation 7rotetion ro8 eing o87elled to reveal the soure o any news re7ort or inor8ation a77earing in said 7uliation whih was related in any onfdene to suh 7ulisher, editor, or re7orter. !&. I. *+traterritorial 'pplication.  'his At a77lies to an at done or 7ratie engaged in and outside o the "hili77ines y an entity i= >a? 'he at, 7ratie or 7roessing relates to 7ersonal inor8ation aout a "hili77ine iti:en or a residentD >? 'he entity has a lin3 with the "hili77ines, and the entity is 7roessing 7ersonal inor8ation in the "hili77ines or even

i the 7roessing is outside the "hili77ines as long as it is aout "hili77ine iti:ens or residents suh as, ut not li8ited to, the ollowing= >1? A ontrat is entered in the "hili77inesD >2? A @uridial entity uninor7orated in the "hili77ines ut has entral 8anage8ent and ontrol in the ountryD and >+? An entity that has a ranh, ageny, oGe or susidiary in the "hili77ines and the 7arent or aGliate o the "hili77ine entity has aess to 7ersonal inor8ationD and >? 'he entity has other lin3s in the "hili77ines suh as, ut not li8ited to= >1? 'he entity arries on usiness in the "hili77inesD and >2? 'he 7ersonal inor8ation was olleted or held y an entity in the "hili77ines. &A"'! %%  '! (A'%)(A$ "%/A&L &)MM%%)( !&. *. %unctions of the ational Privacy Commission.  'o ad8inister and i87le8ent the 7rovisions o this At, and to 8onitor and ensure o87liane o the ountry with international standards set or data 7rotetion, there is herey reated an inde7endent ody to e 3nown as the (ational "rivay &o88ission, winh shall have the ollowing untions= >a? !nsure o87liane o 7ersonal inor8ation ontrollers with the 7rovisions o this AtD >? eeive o87laints, institute investigations, ailitate or enale settle8ent o o87laints through the use o  alternative dis7ute resolution 7roesses, ad@udiate, award

inde8nity on 8atters aFeting any 7ersonal inor8ation, 7re7are re7orts on dis7osition o o87laints and resolution o any investigation it initiates, and, in ases it dee8s a77ro7riate, 7ulii:e any suh re7ort= Provided, 'hat in resolving any o87laint or investigation >ee7t where a8iale settle8ent is reahed y the 7arties?, the &o88ission shall at as a ollegial ody. or this 7ur7ose, the &o88ission 8ay e given aess to 7ersonal inor8ation that is su@et o any o87laint and to ollet the inor8ation neessary to 7eror8 its untions under this AtD >? %ssue ease and desist orders, i87ose a te87orary or 7er8anent an on the 7roessing o 7ersonal inor8ation, u7on fnding that the 7roessing will e detri8ental to national seurity and 7uli interestD >d? &o87el or 7etition any entity, govern8ent ageny or instru8entality to aide y its orders or ta3e ation on a 8atter aFeting data 7rivayD >e? Monitor the o87liane o other govern8ent agenies or instru8entalities on their seurity and tehnial 8easures and reo88end the neessary ation in order to 8eet 8ini8u8 standards or 7rotetion o 7ersonal inor8ation 7ursuant to this AtD >? &oordinate with other govern8ent agenies and the 7rivate setor on eForts to or8ulate and i87le8ent 7lans and 7oliies to strengthen the 7rotetion o 7ersonal inor8ation in the ountryD >g? "ulish on a regular asis a guide to all laws relating to data 7rotetionD >h? "ulish a o87ilation o ageny syste8 o reords and noties, inluding inde and other fnding aidsD

>i? eo88end to the e7art8ent o Justie >)J? the 7roseution and i87osition o 7enalties s7eifed in etions 25 to 2K o this AtD

>o? (egotiate and ontrat with other data 7rivay authorities o other ountries or ross-order a77liation and i87le8entation o res7etive 7rivay lawsD

>@? eview, a77rove, re@et or reCuire 8odifation o 7rivay odes voluntarily adhered to y 7ersonal inor8ation ontrollers= Provided, 'hat the 7rivay odes shall adhere to the underlying data 7rivay 7rini7les e8odied in this At= Provided, further, 'hat suh 7rivay odes 8ay inlude 7rivate dis7ute resolution 8ehanis8s or o87laints against any 7artii7ating 7ersonal inor8ation ontroller. or this 7ur7ose, the &o88ission shall onsult with relevant regulatory agenies in the or8ulation and ad8inistration o  7rivay odes a77lying the standards set out in this At, with res7et to the 7ersons, entities, usiness ativities and usiness setors that said regulatory odies are authori:ed to 7rini7ally regulate 7ursuant to the law= Provided, "nally. 'hat the &o88ission 8ay review suh 7rivay odes and reCuire hanges thereto or 7ur7oses o o87lying with this AtD

>7? Assist "hili77ine o87anies doing usiness aroad to res7ond to oreign 7rivay or data 7rotetion laws and regulationsD and

>3? "rovide assistane on 8atters relating to 7rivay or data 7rotetion at the reCuest o a national or loal ageny, a 7rivate entity or any 7ersonD >l? &o88ent on the i87liation on data 7rivay o 7ro7osed national or loal statutes, regulations or 7roedures, issue advisory o7inions and inter7ret the 7rovisions o this At and other data 7rivay lawsD >8? "ro7ose legislation, a8end8ents or 8odifations to "hili77ine laws on 7rivay or data 7rotetion as 8ay e neessaryD >n? !nsure 7ro7er and eFetive oordination with data 7rivay regulators in other ountries and 7rivate aountaility agents, 7artii7ate in international and regional initiatives or data 7rivay 7rotetionD

>C? enerally 7eror8 suh ats as 8ay e neessary to ailitate ross-order enore8ent o data 7rivay 7rotetion. !&. . Con"dentiality.  'he &o88ission shall ensure at all ti8es the onfdentiality o any 7ersonal inor8ation that o8es to its 3nowledge and 7ossession. !&. K. -rganiational Structure of the Commission.   'he &o88ission shall e attahed to the e7art8ent o  %nor8ation and &o88uniations 'ehnology >%&'? and shall e headed y a "rivay &o88issioner, who shall also at as &hair8an o the &o88ission. 'he "rivay &o88issioner shall e assisted y two >2? e7uty "rivay &o88issioners, one to e res7onsile or ata "roessing yste8s and one to e res7onsile or "oliies and "lanning.  'he "rivay &o88issioner and the two >2? e7uty "rivay &o88issioners shall e a77ointed y the "resident o the "hili77ines or a ter8 o three >+? years, and 8ay e rea77ointed or another ter8 o three >+? years. /aanies in the &o88ission shall e flled in the sa8e 8anner in whih the original a77oint8ent was 8ade.  'he "rivay &o88issioner 8ust e at least thirty-fve >+5? years o age and o good 8oral harater, unCuestionale integrity and 3nown 7roity, and a reogni:ed e7ert in the feld o inor8ation tehnology and data 7rivay. 'he "rivay &o88issioner shall en@oy the enefts, 7rivileges and e8olu8ents eCuivalent to the ran3 o eretary.

 'he e7uty "rivay &o88issioners 8ust e reogni:ed e7erts in the feld o inor8ation and o88uniations tehnology and data 7rivay. 'hey shall en@oy the enefts, 7rivileges and e8olu8ents eCuivalent to the ran3 o  #nderseretary.  'he "rivay &o88issioner, the e7uty &o88issioners, or any 7erson ating on their ehal or under their diretion, shall not e ivilly liale or ats done in good aith in the 7eror8ane o their duties. owever, he or she shall e liale or willul or negligent ats done y hi8 or her whih are ontrary to law, 8orals, 7uli 7oliy and good usto8s even i he or she ated under orders or instrutions o  su7eriors= Provided, 'hat in ase a lawsuit is fled against suh oGial on the su@et o the 7eror8ane o his or her duties, where suh 7eror8ane is lawul, he or she shall e rei8ursed y the &o88ission or reasonale osts o  litigation. !&. 10. The Secretariat. ; 'he &o88ission is herey authori:ed to estalish a eretariat. Ma@ority o the 8e8ers o the eretariat 8ust have served or at least fve >5? years in any ageny o the govern8ent that is involved in the 7roessing o 7ersonal inor8ation inluding, ut not li8ited to, the ollowing oGes= oial eurity yste8 >?, overn8ent ervie %nsurane yste8 >%?, $and 'rans7ortation )Ge >$')?, Bureau o %nternal evenue >B%?, "hili77ine ealth %nsurane &or7oration >"hilealth?, &o88ission on !letions >&)M!$!&?, e7art8ent o oreign AFairs >A?, e7art8ent o Justie >)J?, and "hili77ine "ostal &or7oration >"hil7ost?. &A"'! %%% ")&!%( ) "!)(A$ %()MA'%)( !&. 11. /eneral !ata Privacy Principles. ; 'he 7roessing o  7ersonal inor8ation shall e allowed, su@et to o87liane with the reCuire8ents o this At and other laws allowing dislosure o inor8ation to the 7uli and adherene to the

7rini7les o trans7areny, 7ro7ortionality.

legiti8ate

7ur7ose

and

"ersonal inor8ation 8ust, e= >a? &olleted or s7eifed and legiti8ate 7ur7oses deter8ined and delared eore, or as soon as reasonaly 7ratiale ater olletion, and later 7roessed in a way o87atile with suh delared, s7eifed and legiti8ate 7ur7oses onlyD >? "roessed airly and lawullyD >? Aurate, relevant and, where neessary or 7ur7oses or whih it is to e used the 7roessing o 7ersonal inor8ation, 3e7t u7 to dateD inaurate or ino87lete data 8ust e retifed, su77le8ented, destroyed or their urther 7roessing restritedD >d? AdeCuate and not eessive in relation to the 7ur7oses or whih they are olleted and 7roessedD >e? etained only or as long as neessary or the ulfll8ent o the 7ur7oses or whih the data was otained or or the estalish8ent, eerise or deense o legal lai8s, or or legiti8ate usiness 7ur7oses, or as 7rovided y lawD and >? Ne7t in a or8 whih 7er8its identifation o data su@ets or no longer than is neessary or the 7ur7oses or whih the data were olleted and 7roessed= Provided, 'hat 7ersonal inor8ation olleted or other 7ur7oses 8ay lie 7roessed or historial, statistial or sientif 7ur7oses, and in ases laid down in law 8ay e stored or longer 7eriods= Provided, further, 'hat adeCuate saeguards are guaranteed y said laws authori:ing their 7roessing.

 'he 7ersonal inor8ation ontroller 8ust ensure i87le8entation o 7ersonal inor8ation 7roessing 7rini7les set out herein. !&. 12. Criteria for 0a1ful Processing of Personal &nformation. ; 'he 7roessing o 7ersonal inor8ation shall e 7er8itted only i not otherwise 7rohiited y law, and when at least one o the ollowing onditions eists= >a? 'he data su@et has given his or her onsentD >? 'he 7roessing o 7ersonal inor8ation is neessary and is related to the ulfll8ent o a ontrat with the data su@et or in order to ta3e ste7s at the reCuest o the data su@et 7rior to entering into a ontratD >? 'he 7roessing is neessary or o87liane with a legal oligation to whih the 7ersonal inor8ation ontroller is su@etD >d? 'he 7roessing is neessary to 7rotet vitally i87ortant interests o the data su@et, inluding lie and healthD >e? 'he 7roessing is neessary in order to res7ond to national e8ergeny, to o87ly with the reCuire8ents o  7uli order and saety, or to ulfll untions o 7uli authority whih neessarily inludes the 7roessing o  7ersonal data or the ulfll8ent o its 8andateD or >? 'he 7roessing is neessary or the 7ur7oses o the legiti8ate interests 7ursued y the 7ersonal inor8ation ontroller or y a third 7arty or 7arties to who8 the data is dislosed, ee7t where suh interests are overridden y unda8ental rights and reedo8s o the data su@et whih reCuire 7rotetion under the "hili77ine &onstitution. !&. 1+. Sensitive Personal &nformation and Privileged &nformation. ; 'he 7roessing o sensitive 7ersonal

inor8ation and 7rivileged inor8ation shall e 7rohiited, ee7t in the ollowing ases= >a? 'he data su@et has given his or her onsent, s7eif to the 7ur7ose 7rior to the 7roessing, or in the ase o  7rivileged inor8ation, all 7arties to the ehange have given their onsent 7rior to 7roessingD >? 'he 7roessing o the sa8e is 7rovided or y eisting laws and regulations= Provided, 'hat suh regulatory enat8ents guarantee the 7rotetion o the sensitive 7ersonal inor8ation and the 7rivileged inor8ation= Provided, further, 'hat the onsent o the data su@ets are not reCuired y law or regulation 7er8itting the 7roessing o the sensitive 7ersonal inor8ation or the 7rivileged inor8ationD >? 'he 7roessing is neessary to 7rotet the lie and health o the data su@et or another 7erson, and the data su@et is not legally or 7hysially ale to e7ress his or her onsent 7rior to the 7roessingD >d? 'he 7roessing is neessary to ahieve the lawul and nono88erial o@etives o 7uli organi:ations and their assoiations= Provided, 'hat suh 7roessing is only onfned and related to the bona "de 8e8ers o these organi:ations or their assoiations= Provided, further, 'hat the sensitive 7ersonal inor8ation are not transerred to third 7arties= Provided, "nally, 'hat onsent o the data su@et was otained 7rior to 7roessingD >e? 'he 7roessing is neessary or 7ur7oses o 8edial treat8ent, is arried out y a 8edial 7ratitioner or a 8edial treat8ent institution, and an adeCuate level o  7rotetion o 7ersonal inor8ation is ensuredD or >? 'he 7roessing onerns suh 7ersonal inor8ation as is neessary or the 7rotetion o lawul rights and interests o 

natural or legal 7ersons in ourt 7roeedings, or the estalish8ent, eerise or deense o legal lai8s, or when 7rovided to govern8ent or 7uli authority. !&. 1H. Subcontract of Personal &nformation.  ' 7ersonal inor8ation ontroller 8ay suontrat the 7roessing o  7ersonal inor8ation= Provided, 'hat the 7ersonal inor8ation ontroller shall e res7onsile or ensuring that 7ro7er saeguards are in 7lae to ensure the onfdentiality o the 7ersonal inor8ation 7roessed, 7revent its use or unauthori:ed 7ur7oses, and generally, o87ly with the reCuire8ents o this At and other laws or 7roessing o  7ersonal inor8ation. 'he 7ersonal inor8ation 7roessor shall o87ly with all the reCuire8ents o this At and other a77liale laws. !&. 15. *+tension of Privileged Communication.  "ersonal inor8ation ontrollers 8ay invo3e the 7rini7le o  7rivileged o88uniation over 7rivileged inor8ation that they lawully ontrol or 7roess. u@et to eisting laws and regulations, any evidene gathered on 7rivileged inor8ation is inad8issile. &A"'! %/ %' ) '! A'A #BJ!&' !&. 1I. Rights of the !ata Sub#ect. ; 'he data su@et is entitled to= >a? Be inor8ed whether 7ersonal inor8ation 7ertaining to hi8 or her shall e, are eing or have een 7roessedD >? Be urnished the inor8ation indiated hereunder eore the entry o his or her 7ersonal inor8ation into the 7roessing syste8 o the 7ersonal inor8ation ontroller, or at the net 7ratial o77ortunity=

>1? esri7tion o the 7ersonal inor8ation to e entered into the syste8D >2? "ur7oses or whih they are eing or are to e 7roessedD >+? o7e and 7roessingD

8ethod

o

the

7ersonal

inor8ation

>H? 'he rei7ients or lasses o rei7ients to who8 they are or 8ay e dislosedD >5? Methods utili:ed or auto8ated aess, i the sa8e is allowed y the data su@et, and the etent to whih suh aess is authori:edD >I? 'he identity and ontat details o the 7ersonal inor8ation ontroller or its re7resentativeD >*? 'he 7eriod or whih the inor8ation will e storedD and >? 'he eistene o their rights, i.e., to aess, orretion, as well as the right to lodge a o87laint eore the &o88ission. Any inor8ation su77lied or delaration 8ade to the data su@et on these 8atters shall not e a8ended without 7rior notifation o data su@et= Provided, 'hat the notifation under susetion >? shall not a77ly should the 7ersonal inor8ation e needed 7ursuant to a subpoena or when the olletion and 7roessing are or ovious 7ur7oses, inluding when it is neessary or the 7eror8ane o or in relation to a ontrat or servie or when neessary or desirale in the ontet o an e87loyer-e87loyee relationshi7, etween the olletor and the data su@et, or when the inor8ation is eing olleted and 7roessed as a result o legal oligationD

>? easonale aess to, u7on de8and, the ollowing= >1? &ontents o his or her 7ersonal inor8ation that were 7roessedD >2? oures ro8 whih 7ersonal inor8ation were otainedD >+? (a8es and addresses o rei7ients o the 7ersonal inor8ationD >H? Manner y whih suh data were 7roessedD >5? easons or the dislosure o the 7ersonal inor8ation to rei7ientsD >I? %nor8ation on auto8ated 7roesses where the data will or li3ely to e 8ade as the sole asis or any deision signifantly aFeting or will aFet the data su@etD >*? ate when his or her 7ersonal inor8ation onerning the data su@et were last aessed and 8odifedD and >? 'he designation, or na8e or identity and address o the 7ersonal inor8ation ontrollerD >d? is7ute the inauray or error in the 7ersonal inor8ation and have the 7ersonal inor8ation ontroller orret it i88ediately and aordingly, unless the reCuest is veatious or otherwise unreasonale. % the 7ersonal inor8ation have een orreted, the 7ersonal inor8ation ontroller shall ensure the aessiility o oth the new and the retrated inor8ation and the si8ultaneous reei7t o  the new and the retrated inor8ation y rei7ients thereo= Provided, 'hat the third 7arties who have 7reviously reeived suh 7roessed 7ersonal inor8ation shall he inor8ed o its inauray and its retifation u7on reasonale reCuest o the data su@etD

>e? us7end, withdraw or order the lo3ing, re8oval or destrution o his or her 7ersonal inor8ation ro8 the 7ersonal inor8ation ontrollerEs fling syste8 u7on disovery and sustantial 7roo that the 7ersonal inor8ation are ino87lete, outdated, alse, unlawully otained, used or unauthori:ed 7ur7oses or are no longer neessary or the 7ur7oses or whih they were olleted. %n this ase, the 7ersonal inor8ation ontroller 8ay notiy third 7arties who have 7reviously reeived suh 7roessed 7ersonal inor8ationD and >? Be inde8nifed or any da8ages sustained due to suh inaurate, ino87lete, o utdated, alse, unlawully otained or unauthori:ed use o 7ersonal inor8ation. !&. 1*. Transmissibility of Rights of the !ata Sub#ect.  'he lawul heirs and assigns o the data su@et 8ay invo3e the rights o the data su@et or, whih he or she is an heir or assignee at any ti8e ater the death o the data su@et or when the data su@et is ina7aitated or ina7ale o  eerising the rights as enu8erated in the i88ediately 7reeding setion. !&. 1. Right to !ata Portability.  'he data su@et shall have the right, where 7ersonal inor8ation is 7roessed y eletroni 8eans and in a strutured and o88only used or8at, to otain ro8 the 7ersonal inor8ation ontroller a o7y o data undergoing 7roessing in an eletroni or strutured or8at, whih is o88only used and allows or urther use y the data su@et. 'he &o88ission 8ay s7eiy the eletroni or8at reerred to aove, as well as the tehnial standards, 8odalities and 7roedures or their transer. !&. 1K. on2'pplicability. ; 'he i88ediately 7reeding setions are not a77liale i the 7roessed 7ersonal inor8ation are used only or the needs o sientif and statistial researh and, on the asis o suh, no ativities are arried out and no deisions are ta3en regarding the

data su@et= Provided, 'hat the 7ersonal inor8ation shall e held under strit onfdentiality and shall e used only or the delared 7ur7ose. $i3ewise, the i88ediately 7reeding setions are not a77liale to 7roessing o 7ersonal inor8ation gathered or the 7ur7ose o investigations in relation to any ri8inal, ad8inistrative or ta liailities o a data su@et.

>2? A seurity 7oliy with res7et to the 7roessing o  7ersonal inor8ationD

&A"'! / !&#%'L ) "!)(A$ %()MA'%)(

>H? egular 8onitoring or seurity reahes and a 7roess or ta3ing 7reventive, orretive and 8itigating ation against seurity inidents that an lead to a seurity reah.

>+? A 7roess or identiying and aessing reasonaly oreseeale vulnerailities in its o87uter networ3s, and or ta3ing 7reventive, orretive and 8itigating ation against seurity inidents that an lead to a seurity reahD and

!&. 20. Security of Personal &nformation. ; >a? 'he 7ersonal inor8ation ontroller 8ust i87le8ent reasonale and a77ro7riate organi:ational, 7hysial and tehnial 8easures intended or the 7rotetion o 7ersonal inor8ation against any aidental or unlawul destrution, alteration and dislosure, as well as against any other unlawul 7roessing.

>d? 'he 7ersonal inor8ation ontroller 8ust urther ensure that third 7arties 7roessing 7ersonal inor8ation on its ehal shall i87le8ent the seurity 8easures reCuired y this 7rovision.

>? 'he 7ersonal inor8ation ontroller shall i87le8ent reasonale and a77ro7riate 8easures to 7rotet 7ersonal inor8ation against natural dangers suh as aidental loss or destrution, and hu8an dangers suh as unlawul aess, raudulent 8isuse, unlawul destrution, alteration and onta8ination.

>e? 'he e87loyees, agents or re7resentatives o a 7ersonal inor8ation ontroller who are involved in the 7roessing o  7ersonal inor8ation shall o7erate and hold 7ersonal inor8ation under strit onfdentiality i the 7ersonal inor8ation are not intended or 7uli dislosure. 'his oligation shall ontinue even ater leaving the 7uli servie, transer to another 7osition or u7on ter8ination o  e87loy8ent or ontratual relations.

>? 'he deter8ination o the a77ro7riate level o seurity under this setion 8ust ta3e into aount the nature o the 7ersonal inor8ation to e 7roteted, the ris3s re7resented y the 7roessing, the si:e o the organi:ation and o87leity o its o7erations, urrent data 7rivay est 7raties and the ost o seurity i87le8entation. u@et to guidelines as the &o88ission 8ay issue ro8 ti8e to ti8e, the 8easures i87le8ented 8ust inlude= >1? aeguards to 7rotet its o87uter networ3 against aidental, unlawul or unauthori:ed usage or intererene with or hindering o their untioning or availailityD

>? 'he 7ersonal inor8ation ontroller shall 7ro87tly notiy the &o88ission and aFeted data su@ets when sensitive 7ersonal inor8ation or other inor8ation that 8ay, under the iru8stanes, e used to enale identity raud are reasonaly elieved to have een aCuired y an unauthori:ed 7erson, and the 7ersonal inor8ation ontroller or the &o88ission elieves >at suh unauthori:ed aCuisition is li3ely to give rise to a real ris3 o  serious har8 to any aFeted data su@et. 'he notifation shall at least desrie the nature o the reah, the sensitive 7ersonal inor8ation 7ossily involved, and the 8easures ta3en y the entity to address the reah. (otifation 8ay e delayed only to the etent neessary to deter8ine the

so7e o the reah, to 7revent urther dislosures, or to restore reasonale integrity to the inor8ation and o88uniations syste8.

organi:ationEs o87liane with this At. 'he identity o the individual>s? so designated shall e 8ade 3nown to any data su@et u7on reCuest.

>1? %n evaluating i notifation is unwarranted, the &o88ission 8ay ta3e into aount o87liane y the 7ersonal inor8ation ontroller with this setion and eistene o good aith in the aCuisition o 7ersonal inor8ation.

&A"'! /%% !&#%'L ) !(%'%/! "!)(A$ %()MA'%)( %( )/!(M!('

>2? 'he &o88ission 8ay ee87t a 7ersonal inor8ation ontroller ro8 notifation where, in its reasonale  @udg8ent, suh notifation would not e in the 7uli interest or in the interests o the aFeted data su@ets. >+? 'he &o88ission 8ay authori:e 7ost7one8ent o  notifation where it 8ay hinder the 7rogress o a ri8inal investigation related to a serious reah. &A"'! /% A&&)#('AB%$%'L ) 'A(! ) "!)(A$ %()MA'%)( !&. 21. Principle of 'ccountability.  !ah 7ersonal inor8ation ontroller is res7onsile or 7ersonal inor8ation under its ontrol or ustody, inluding inor8ation that have een transerred to a third 7arty or 7roessing, whether do8estially or internationally, su@et to ross-order arrange8ent and oo7eration. >a? 'he 7ersonal inor8ation ontroller is aountale or o87lying with the reCuire8ents o this At and shall use ontratual or other reasonale 8eans to 7rovide a o87arale level o 7rotetion while the inor8ation are eing 7roessed y a third 7arty. >? 'he 7ersonal inor8ation ontroller shall designate an individual or individuals who are aountale or the

!& 22. Responsibility of Heads of 'gencies. ; All sensitive 7ersonal inor8ation 8aintained y the govern8ent, its agenies and instru8entalities shall e seured, as ar as 7ratiale, with the use o the 8ost a77ro7riate standard reogni:ed y the inor8ation and o88uniations tehnology industry, and as reo88ended y the &o88ission. 'he head o eah govern8ent ageny or instru8entality shall e res7onsile or o87lying with the seurity reCuire8ents 8entioned herein while the &o88ission shall 8onitor the o87liane and 8ay reo88end the neessary ation in order to satisy the 8ini8u8 standards. !&. 2+. Re3uirements Relating to 'ccess by 'gency  Personnel to Sensitive Personal &nformation.  >a? )n-site and )nline Aess ; !e7t as 8ay e allowed through guidelines to e issued y the &o88ission, no e87loyee o  the govern8ent shall have aess to sensitive 7ersonal inor8ation on govern8ent 7ro7erty or through online ailities unless the e87loyee has reeived a seurity learane ro8 the head o the soure ageny. >? )F-site Aess ; #nless otherwise 7rovided in guidelines to e issued y the &o88ission, sensitive 7ersonal inor8ation 8aintained y an ageny 8ay not e trans7orted or aessed ro8 a loation oF govern8ent 7ro7erty unless a reCuest or suh trans7ortation or aess is su8itted and a77roved y the head o the ageny in aordane with the ollowing guidelines=

>1? eadline or A77roval or isa77roval ; %n the ase o any reCuest su8itted to the head o an ageny, suh head o  the ageny shall a77rove or disa77rove the reCuest within two >2? usiness days ater the date o su8ission o the reCuest. %n ase there is no ation y the head o the ageny, then suh reCuest is onsidered disa77rovedD >2? $i8itation to )ne thousand >1,000? eords ; % a reCuest is a77roved, the head o the ageny shall li8it the aess to not 8ore than one thousand >1,000? reords at a ti8eD and >+? !nry7tion ; Any tehnology used to store, trans7ort or aess sensitive 7ersonal inor8ation or 7ur7oses o oF-site aess a77roved under this susetion shall e seured y the use o the 8ost seure enry7tion standard reogni:ed y the &o88ission.  'he reCuire8ents o this susetion shall e i87le8ented not later than si >I? 8onths ater the date o the enat8ent o this At. !&. 2H. 'pplicability to /overnment Contractors. ; %n entering into any ontrat that 8ay involve aessing or reCuiring sensitive 7ersonal inor8ation ro8 one thousand >1,000? or 8ore individuals, an ageny shall reCuire a ontrator and its e87loyees to register their 7ersonal inor8ation 7roessing syste8 with the &o88ission in aordane with this At and to o87ly with the other 7rovisions o this At inluding the i88ediately 7reeding setion, in the sa8e 8anner as agenies and govern8ent e87loyees o87ly with suh reCuire8ents. &A"'! /%%% "!(A$'%! !&. 25. 4nauthoried Processing of Personal &nformation and Sensitive Personal &nformation.  >a? 'he unauthori:ed 7roessing o 7ersonal inor8ation shall e 7enali:ed y

i87rison8ent ranging ro8 one >1? year to three >+? years and a fne o not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than 'wo 8illion 7esos >"h72,000,000.00? shall e i87osed on 7ersons who 7roess 7ersonal inor8ation without the onsent o the data su@et, or without eing authori:ed under this At or any eisting law. >? 'he unauthori:ed 7roessing o 7ersonal sensitive inor8ation shall e 7enali:ed y i87rison8ent ranging ro8 three >+? years to si >I? years and a fne o not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than our 8illion 7esos >"h7H,000,000.00? shall e i87osed on 7ersons who 7roess 7ersonal inor8ation without the onsent o the data su@et, or without eing authori:ed under this At or any eisting law. !&. 2I. 'ccessing Personal &nformation and Sensitive Personal &nformation !ue to egligence. ; >a? Aessing 7ersonal inor8ation due to negligene shall e 7enali:ed y i87rison8ent ranging ro8 one >1? year to three >+? years and a fne o not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than 'wo 8illion 7esos >"h72,000,000.00? shall e i87osed on 7ersons who, due to negligene, 7rovided aess to 7ersonal inor8ation without eing authori:ed under this At or any eisting law. >? Aessing sensitive 7ersonal inor8ation due to negligene shall e 7enali:ed y i87rison8ent ranging ro8 three >+? years to si >I? years and a fne o not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than our 8illion 7esos >"h7H,000,000.00? shall e i87osed on 7ersons who, due to negligene, 7rovided aess to 7ersonal inor8ation without eing authori:ed under this At or any eisting law. !&. 2*. &mproper !isposal of Personal &nformation and Sensitive Personal &nformation.  >a? 'he i87ro7er dis7osal o 7ersonal inor8ation shall e 7enali:ed y i87rison8ent

ranging ro8 si >I? 8onths to two >2? years and a fne o  not less than )ne hundred thousand 7esos >"h7100,000.00? ut not 8ore than ive hundred thousand 7esos >"h7500,000.00? shall e i87osed on 7ersons who 3nowingly or negligently dis7ose, disard or aandon the 7ersonal inor8ation o an individual in an area aessile to the 7uli or has otherwise 7laed the 7ersonal inor8ation o an individual in its ontainer or trash olletion. ? 'he i87ro7er dis7osal o sensitive 7ersonal inor8ation shall e 7enali:ed y i87rison8ent ranging ro8 one >1? year to three >+? years and a fne o not less than )ne hundred thousand 7esos >"h7100,000.00? ut not 8ore than )ne 8illion 7esos >"h71,000,000.00? shall e i87osed on 7ersons who 3nowingly or negligently dis7ose, disard or aandon the 7ersonal inor8ation o an individual in an area aessile to the 7uli or has otherwise 7laed the 7ersonal inor8ation o an individual in its ontainer or trash olletion. !&. 2. Processing of Personal &nformation and Sensitive Personal &nformation for 4nauthoried Purposes.  'he 7roessing o 7ersonal inor8ation or unauthori:ed 7ur7oses shall e 7enali:ed y i87rison8ent ranging ro8 one >1? year and si >I? 8onths to fve >5? years and a fne o not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than )ne 8illion 7esos >"h71,000,000.00? shall e i87osed on 7ersons 7roessing 7ersonal inor8ation or 7ur7oses not authori:ed y the data su@et, or otherwise authori:ed under this At or under eisting laws.  'he 7roessing o sensitive 7ersonal inor8ation or unauthori:ed 7ur7oses shall e 7enali:ed y i87rison8ent ranging ro8 two >2? years to seven >*? years and a fne o  not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than 'wo 8illion 7esos >"h72,000,000.00? shall e i87osed on 7ersons 7roessing sensitive 7ersonal inor8ation or 7ur7oses not authori:ed y the data su@et,

or otherwise authori:ed under this At or under eisting laws. !&. 2K. 4nauthoried 'ccess or &ntentional Breach.  'he 7enalty o i87rison8ent ranging ro8 one >1? year to three >+? years and a fne o not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than 'wo 8illion 7esos >"h72,000,000.00? shall e i87osed on 7ersons who 3nowingly and unlawully, or violating data onfdentiality and seurity data syste8s, rea3s in any way into any syste8 where 7ersonal and sensitive 7ersonal inor8ation is stored. !&. +0. Concealment of Security Breaches &nvolving Sensitive Personal &nformation.  'he 7enalty o  i87rison8ent o one >1? year and si >I? 8onths to fve >5? years and a fne o not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than )ne 8illion 7esos >"h71,000,000.00? shall e i87osed on 7ersons who, ater having 3nowledge o a seurity reah and o the oligation to notiy the &o88ission 7ursuant to etion 20>?, intentionally or y o8ission oneals the at o suh seurity reah. !&. +1. 5alicious !isclosure.  Any 7ersonal inor8ation ontroller or 7ersonal inor8ation 7roessor or any o its oGials, e87loyees or agents, who, with 8alie or in ad aith, disloses unwarranted or alse inor8ation relative to any 7ersonal inor8ation or 7ersonal sensitive inor8ation otained y hi8 or her, shall e su@et to i87rison8ent ranging ro8 one >1? year and si >I? 8onths to fve >5? years and a fne o not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than )ne 8illion 7esos >"h71,000,000.00?. !&. +2. 4nauthoried !isclosure.  >a? Any 7ersonal inor8ation ontroller or 7ersonal inor8ation 7roessor or any o its oGials, e87loyees or agents, who disloses to a third 7arty 7ersonal inor8ation not overed y the

i88ediately 7reeding setion without the onsent o the data su@et, shall he su@et to i87rison8ent ranging ro8 one >1? year to three >+? years and a fne o not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than )ne 8illion 7esos >"h71,000,000.00?.

!&. +5. 0arge2Scale.  'he 8ai8u8 7enalty in the sale o  7enalties res7etively 7rovided or the 7reeding oFenses shall e i87osed when the 7ersonal inor8ation o at least one hundred >100? 7ersons is har8ed, aFeted or involved as the result o the aove 8entioned ations.

>? Any 7ersonal inor8ation ontroller or 7ersonal inor8ation 7roessor or any o its oGials, e87loyees or agents, who disloses to a third 7arty sensitive 7ersonal inor8ation not overed y the i88ediately 7reeding setion without the onsent o the data su@et, shall e su@et to i87rison8ent ranging ro8 three >+? years to fve >5? years and a fne o not less than ive hundred thousand 7esos >"h7500,000.00? ut not 8ore than 'wo 8illion 7esos >"h72,000,000.00?.

!&. +I. -(ense Committed by Public -6cer. 
!&. ++. Combination or Series of 'cts.  Any o8ination or series o ats as defned in etions 25 to +2 shall 8a3e the 7erson su@et to i87rison8ent ranging ro8 three >+? years to si >I? years and a fne o not less than )ne 8illion 7esos >"h71,000,000.00? ut not 8ore than ive 8illion 7esos >"h75,000,000.00?. !&. +H. *+tent of 0iability. ; % the oFender is a or7oration, 7artnershi7 or any @uridial 7erson, the 7enalty shall e i87osed u7on the res7onsile oGers, as the ase 8ay e, who 7artii7ated in, or y their gross negligene, allowed the o88ission o the ri8e. % the oFender is a @uridial 7erson, the ourt 8ay sus7end or revo3e any o its rights under this At. % the oFender is an alien, he or she shall, in addition to the 7enalties herein 7resried, e de7orted without urther 7roeedings ater serving the 7enalties 7resried. % the oFender is a 7uli oGial or e87loyee and lie or she is ound guilty o ats 7enali:ed under etions 2* and 2 o this At, he or she shall, in addition to the 7enalties 7resried herein, suFer 7er7etual or te87orary asolute disCualifation ro8 oGe, as the ase 8ay e.

!&. +*. Restitution.  estitution or any aggrieved 7arty shall e governed y the 7rovisions o the (ew &ivil &ode. &A"'! %O M%&!$$A(!)# ")/%%)( !&. +. &nterpretation.  Any dout in the inter7retation o  any 7rovision o this At shall e lierally inter7reted in a 8anner 8indul o the rights and interests o the individual aout who8 7ersonal inor8ation is 7roessed. !&. +K. &mplementing Rules and Regulations 7&RR8. ; K0? days ro8 the eFetivity o this At, the &o88ission shall 7ro8ulgate the rules and regulations to eFetively i87le8ent the 7rovisions o this At. !&. H0. Reports and &nformation. ; 'he &o88ission shall annually re7ort to the "resident and &ongress on its ativities in arrying out the 7rovisions o this At. 'he &o88ission shall underta3e whatever eForts it 8ay deter8ine to e neessary or a77ro7riate to inor8 and eduate the 7uli o data 7rivay, data 7rotetion and air inor8ation rights and res7onsiilities.

!&. H1. 'ppropriations Clause.  'he &o88ission shall e 7rovided with an initial a77ro7riation o 'wenty 8illion 7esos >"h720,000,000.00? to e drawn ro8 the national govern8ent. A77ro7riations or the sueeding years shall e inluded in the eneral A77ro7riations At. %t shall li3ewise reeive 'en 8illion 7esos >"h710,000,000.00? 7er year or fve >5? years u7on i87le8entation o this At drawn ro8 the national govern8ent. !&. H2. Transitory Provision. ; !isting industries, usinesses and oGes aFeted y the i87le8entation o  this At shall e given one >1? year transitory 7eriod ro8 the eFetivity o the % or suh other 7eriod as 8ay e deter8ined y the &o88ission, to o87ly with the reCuire8ents o this At. %n ase that the %&' has not yet een reated y the ti8e the law ta3es ull ore and eFet, the (ational "rivay &o88ission shall e attahed to the )Ge o the "resident.

!&. H+. Separability Clause.  % any 7rovision or 7art hereo  is held invalid or unonstitutional, the re8ainder o the law or the 7rovision not otherwise aFeted shall re8ain valid and susisting. !&. HH. Repealing Clause.  'he 7rovision o etion * o  e7uli At (o. K+*2, otherwise 3nown as the 4u8an eurity At o 200*6, is herey a8ended. !e7t as otherwise e7ressly 7rovided in this At, all other laws, derees, eeutive orders, 7rola8ations and ad8inistrative regulations or 7arts thereo inonsistent herewith are herey re7ealed or 8odifed aordingly. !&. H5. *(ectivity Clause.  'his At shall ta3e eFet fteen >15? days ater its 7uliation in at least two >2? national news7a7ers o general irulation.