AN ACT REQUIRING THE REGISTRATION OF SUBSCRIBER IDENTITY MODULE

Nineteenth Congress
First Regular Session

Begun and held in Metro Manila, on Monday, the twenty-fifth day of July, two thousand twenty-two.

[ REPUBLIC ACT NO. 11934, October 10, 2022 ]

AN ACT REQUIRING THE REGISTRATION OF SUBSCRIBER IDENTITY MODULE

Be it enacted by the Senate and House of Representatives of the Philippines in Congress assembled:

Section 1. Short Title. - This Act shall be known as the "Subscriber Identity Module (SIM) Registration Act".

Section 2. Declaration of Policy. — The State recognizes the vital role of information and communications technology in nation-building and encourages its growth and development.

It is equally cognizant that beneficial as modern technology is, its illegal or malicious use endangers people' lives, damages property, poses hazards to public order, and even threatens the security of nations.

The State shall promote responsibility in the use of Subscriber Identity Module (SIM) and provide law enforcement agencies the tools to resolve crimes which involve its utilization and a platform to deter the commission of wrongdoings.

Towards this end, the State shall require the registration of SIM for electronic devices by all users.

Section 3. Definition of Terms. - As used in this Act:

Section 4. SIM Registration. - In order to regulate the registration and use of SIMs, all end-users shall be required to register their SIMs with PTEs as a pre-requisite to the activation thereof, in accordance with the guidelines set forth under this Act.

For purposes of this Act, all the SIMs to be sold by the PTEs, its agents, resellers, or any entity shall be in a deactivated state. It shall only be activated after the end-user completes the process of registration.

All existing SIMs subscribers shall register the same with their respective PTEs within one hundred eighty (180) days from the effectivity of this Act. The Department of Information and Communications Technology (DICT) may extend registration for a period not exceeding one hundred twenty (120) days.

Failure to register the existing SIM within the periods prescribed herein shall result in automatic deactivation of the SIM. The deactivated SIM may only be reactivated after registration in accordance with this Act.

PTEs shall include the data of existing postpaid subscribers in the SIM Register to align with the registration requirement of this Act.

Section 5. Registration Guidelines. - The SIM process shall be guided by the following parameters:

The SIMs that are registered under Subsection e(1) shall only be valid temporarily for thirty (30) days, and shall automatically be deactivated upon expiration of the validity of the SIM.

The relevant government agencies and concerned PTEs shall facilitate all SIM registrations in remote areas with limited telecommunication or internet access: Provided, That said registration facilities in remote areas shall be established within sixty (60) days from the effectivity of this Act.

A buyer who fails to comply with the requirements for registration shall result in their SIM not being activated.

Section 6. SIM Register. All PTEs shall maintain their own database containing information required under this Act. The database shall strictly serve as a SIM Register to be used by PTEs to process, activate or deactivate a SIM or subscription and shall not be used for any other purpose, unless otherwise provided under this Act. The successful submission and acceptance of the required registration form shall serve as the certification of registration by the end-user.

The registration required under this Act shall be implemented at no cost to the end-users.

In the recordkeeping of information, PTEs shall ensure that the end-users' data are secured and protected at all time. The PTEs shall comply with the minimum information security standards prescribed by the DICT consistent with internationally accepted cybersecurity standards and relevant laws, rules and regulations.

The DICT shall establish and perform an annual audit on PTEs' compliance with information security standards.

In case of any change in the information of the end-user, or the loss of the SIM, death of the end-user, or any request for deactivation, the end-user shall immediately inform the PTE through its facility established for such purpose: Provided, That in the case of death of an end-user, such fact shall be reported to the concerned PTE by the immediate family, relatives, or guardian.

In case of any change in the information of the end-user, the concerned PTE shall clearly note such change in its database.

In case of loss of the SIM, death of the end-user, or request for deactivation, the concerned PTE shall deactivate said SIM within twenty-four (24) hours from the report of the end-user, immediate family, relatives or guardian.

Provided, That regardless of any deactivation, the relevant data and information shall be retained by the PTE pursuant to the pertinent provisions of this Act, which is ten (10) years.

In case of a cyber-attack on the SIM Register, the incident shall be reported to the DICT within twenty-four (24) hours of detection.

PTEs shall provide user-friendly reporting mechanisms for their respective end-users upon the latter's receipt of any potentially fraudulent text or call, and shall, upon due investigation, deactivate, either temporarily or permanently, the SIM used for the fraudulent text or call.

Section 7. Subsequent Sale of a Registered SIM. - A registered SIM shall not be sold or transferred without complying with the registration requirements under Section 6 of this Act.

Section 8. Sale of a Stolen SIM. - Any PTE, its agents, resellers, or entity that shall engage in the sale of stolen SIMs shall be criminally liable under this Act.

Section 9. Confidentiality Clause. - Any information and data obtained in the registration process described under this Act shall be treated as absolutely confidential and shall not be disclosed to any person.

Notwithstanding this provision, disclosure of the full name and address shall be made:

The confidentiality clause in the SIM registration shall take effect at the point of activation.

Section 10. Disclosure of Information. - Notwithstanding the provisions on confidentiality, the PTEs shall be required to provide information obtained in the registration process only upon the issuance of a subpoena by a competent authority pursuant to an investigation based on a sworn complaint that a specific mobile number was or is being used in the commission of a crime or that it was utilized as a means to commit a malicious, fraudulent or unlawful act, and that the complaint is unable to ascertain the identity of the perpetrator.

Provided, however, That the PTE shall be held administratively, civilly, or criminally liable on account of any disclosure done in compliance with this Act.

For this purpose, the relevant data and information shall be kept by the PTEs for ten (10) years from the time the end-user deactivates his or her mobile number.

Section 11. Penalties. - The following penalties shall be imposed for violation of any provision of this Act:

Any person who abets or aids in the commission of any of the offenses enumerated in this Act shall be held liable as a co-principal.

A prosecution under this Act shall be without prejudice to any liability or violation of any provision of the Revised Penal Code, as amended, or special laws.

Section 12. Implementing Rules and Regulations (IRR). - Within sixty (60) days from the effectivity of this Act, the National Telecommunications Commission (NTC), in coordination with other concerned agencies such as, but not limited to, DICT. Department of Trade and Industry (DTI), National Privacy Commission (NPC), as well as PTEs and major consumer groups, shall set the guidelines for the monitoring and proper implementation of this Act and shall promulgate the implementing rules and regulations as may be necessary to ensure the effective implementation of this Act.

All PTEs are required to submit to the NTC, DICT, and to both Houses of Congress an annual report on the implementation of the provisions of this Act.

Section 13. Transitory Provision. - Upon the effectivity of this Act, all PTEs are mandated to deactivate ll prepaid SIMS for sale to the public. Otherwise, they shall be liable for the penalties prescribed in this Act.

Section 14. Interpretation. - Any doubt in the interpretation of any provision of this Act and its implementing rules and regulations shall be construed in a manner that accords the highest respect for privacy, and liberally interpreted in a manner mindful of the rights and interests of SIM subscribers.

Section 15. Repealing Clause. - All laws, decrees, executive orders, proclamations, rules and regulations, and issuances, or parts thereof which are inconsistent with the provisions of this Act are hereby repealed, amended or modified accordingly.

Section 16. Separability Clause. - Should any part of this Act is declared unconstitutional or invalid, the the other provisions hereof that are not affected thereby shall continue to be in full force and effect.

Section 17. Effectivity. — This Act shall take effect fifteen (15) days after its publication in the Official Gazette or in a newspaper of general circulation.

Approved,

This Act, which is a consolidation of Senate Bill No. 1310 and House Bill No. 14, was passed by the Senate of the Philippines and the House of Representatives on September 28, 2022.

Approved: OCT 10 2022

(SGD.) FERDINAND ROMUALDEZ MARCOS JR.
President of the Philippines