PhilippinesCybercrime Prevention Act of 2012, Illegal Access, Interception, and Data Interference
Republic Act No. 10175 (2012), Sections 4(a)(1)-(3), 8
In force.
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Audit expectation
- none
What it requires
- Do not access the whole or any part of a computer system without right, intercept a non-public transmission of computer data without right, or intentionally or recklessly alter, damage, delete, or deteriorate computer data without right.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to fall within illegal access, illegal interception, or data interference.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 8 punishes a Section 4(a) offense (illegal access, illegal interception, or data interference) with imprisonment of prision mayor (six years and one day to twelve years) or a fine of at least two hundred thousand pesos up to a maximum amount commensurate to the damage incurred, or both.
What it makes you log
Logging duty
Section 4(a)(1) to (3) define illegal access, illegal interception and data interference and Section 8 sets their penalties. None creates a duty to create, keep or produce a log or record. The row cites those sections only; Section 13 of the same Act requires a service provider to preserve the integrity of traffic data and subscriber information for a minimum of six months, which is a separate duty on service providers outside the cited sections. Section 21 gives the Regional Trial Court jurisdiction over any violation of the Act, including by a Filipino national anywhere, where an element was committed in the Philippines or with a computer system wholly or partly situated there, or where damage is caused to a person who was in the Philippines.
- Kind
- None
- As of
What this law does
Section 4(a) makes illegal access (accessing the whole or any part of a computer system without right), illegal interception (intercepting a non-public transmission of computer data without right), and data interference (intentionally or recklessly altering, damaging, deleting, or deteriorating computer data without right) offenses against the confidentiality, integrity, and availability of computer data and systems.
On a plain reading each offense turns on acting "without right", so reading a public, unauthenticated page without defeating any access control does not itself fall within any of the three. Section 8 punishes a Section 4(a) or 4(b) offense with imprisonment of prision mayor (six years and one day to twelve years) or a fine of at least two hundred thousand pesos up to an amount commensurate to the damage incurred, or both.
Section 21 gives the Regional Trial Court jurisdiction over any violation of the Act, including a violation committed by a Filipino national regardless of the place of commission. Jurisdiction lies if any of the elements was committed within the Philippines or with the use of any computer system wholly or partly situated in the country, or if the commission damages a natural or juridical person who was then in the Philippines.
Only the ground for a Filipino national mentions nationality; the others turn on where an element was committed, which computer system was used, or where the person damaged was. Section 31 of the Act provides that it takes effect fifteen (15) days after the completion of its publication in the Official Gazette or in at least two (2) newspapers of general circulation. No notice stating the day that publication was completed has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .