Summary
RMC No. 66-2023 circularizes the criminal penalties under RA No. 10173 (Data Privacy Act of 2012) and the administrative penalties for ICT Security Infrastructure System violations under RMO No. 67-2010.
Key points
- Penalty scale by offense. Penalties differ for personal and sensitive personal information. Unauthorized processing of personal information carries imprisonment of 1 year to 3 years and a fine of not less than ₱500K to ₱2.0 Million, and for sensitive personal information 3 years to 6 years and a fine of not less than ₱500K to ₱4.0 Million. The same scale is set for accessing information due to negligence and improper disposal, processing for unauthorized purposes, unauthorized access or intentional breach, concealment of security breaches, malicious disclosure, and unauthorized disclosure.
- Combination of acts. A combination or series of acts carries imprisonment of 3 years to 6 years and a fine of not less than ₱1.0 Million to ₱5.0 Million.
- Maximum penalty. The maximum penalty in the scale applies when the personal information of at least one hundred (100) persons is harmed, affected or involved.
- Public officers. A public officer acting in the exercise of duties also gets an accessory penalty of disqualification from public office for a term double the criminal penalty imposed. This is without prejudice to administrative cases against the public official or employee.
- RMO No. 67-2010 penalties. The penalties for ICT Security Infrastructure offenses, and the additional circumstances that are grounds for administrative disciplinary action, are in Sections II and III of the Circular.
Who is affected
- BIR personnel and others who handle personal information
- Public officers and employees
Summary by Tax Resources PH. It is not a substitute for the full text of the issuance or professional advice.
Copies of BIR issuances are hosted here for reference. For the official version, check bir.gov.ph. Summaries by Tax Resources PH are not a substitute for the full text or professional advice.