Online Death Verification System Act

Wifer oft TWENTIETH CONGRESS OF THE REPUBLIC OF THE PHILIPPINES AUG -6 P1:31 First Regular Session SENATE RICEMED BY S. No. 1024 Introduced by Senator Jinggoy Ejercito Estrada AN ACT ESTABLISHING AN ONLINE DEATH VERIFICATION (ODV) SYSTEM UNDER THE PHILIPPINE STATISTICS AUTHORITY (PSA), THEREBY ENSURING GOVERNMENT EFFICIENCY AND FACILITATING THE ADMINISTRATION OF JUSTICE BY STRENGTHENING THE FRAUD DETECTION, PREVENTION AND ELIMINATION CAPABILITY OF THE GOVERNMENT EXPLANATORY NOTE In June 2019, it was reported that a certain dialysis center was filing claims before the Philippine Health Insurance Corporation (Philhealth) on behalf of their dead patients since 2016. During that period, the health facility received payments and reimbursements from Philhealth for such bogus claims. Dubbed as "ghost dialysis," the scheme highlighted weaknesses in the bureaucracy and lack of cooperation among government agencies as it provided impetus for stronger anti- fraud mechanisms and more effective fraud detection and prevention efforts. Meanwhile, it has been a perennial problem of the electoral system that "ghost voters" or those who have already departed, even many years prior, still appear in the list of registered voters. Come Election Day, their names could be used by unscrupulous individuals to manipulate the results, hence undermining the integrity and credibility of the electoral process. The bloated book of voters, along with double and multiple registrations, also leads to unnecessary expenditures as funds are spent to the printing of such additional ballots.

This proposed measure seeks to facilitate the sharing of information between the Philippine Statistics Authority (PSA) and government bodies which manage insurance and pension funds to suppress any fraudulent acts. It seeks to create a centralized and integrated online database from which the Philhealth, Social Security System (SSS), Philippine Veterans Affairs Office (PVAO), Government Service Insurance System (GSIS), Home Development Mutual Fund (HDMF) and the Commission on Elections (COMELEC) can access timely information on mortality data which would enable them to easily verify claims and update their own records. The immediate passage of this legislation is earnestly sought. JINGGOY EJERCITO ESTRADA

Offer ofits TWENTIETH CONGRESS OF THE REPUBLIC OF THE PHILIPPINES First Regular Session AUG -6 P1:32 SENATE RECEIVED BY S. No. 1024 Introduced by Senator Jinggoy Ejercito Estrada AN ACT ESTABLISHING AN ONLINE DEATH VERIFICATION (ODV) SYSTEM UNDER THE PHILIPPINE STATISTICS AUTHORITY (PSA), THEREBY ENSURING GOVERNMENT EFFICIENCY AND FACILITATING THE ADMINISTRATION OF JUSTICE BY STRENGTHENING THE FRAUD DETECTION, PREVENTION AND ELIMINATION CAPABILITY OF THE GOVERNMENT Be it enacted by the Senate and House of Representatives of the Philippines in Congress assembled:

Section 1. Short Title. - This Act shall be known as the "Online Death

2 Verification System Act".

Sec. 2. Declaration of Policy. - The State acknowledges that lack of

4 immediate access to death data is being exploited by criminals and syndicates in 5 perpetrating fraudulent activities and corrupt practices. The State recognizes the 6 vital role of information and communication technology in protecting the government and Filipinos against identity fraud. Therefore, it is hereby declared the policy of the State to establish an efficient, integrated and centralized online death verification system that allows immediate access to death data by government instrumentalities, such as the Commission on Elections (COMELEC), Philippine Health Insurance Corporation (PHIC), Government Service Insurance System (GSIS), Social Security System (SSS), Home Development Mutual Fund (HDMF), and Philippine Veterans Affairs Office (PVAO) in order to ensure early detection and toward the prevention of identity fraud perpetrated against the Government and its instrumentalities and agencies.

Sec. 3. Definition of Terms. - As used in this Act:

a) Authentication - refers to the process of verifying the death of any person with the Philippine Death Check Register through the Online Death Verification System; b) COMELEC - refers to the Commission on Elections; c) Data subject - refers to an individual whose death is being verified; d) GSIS - refers to the Government Service Insurance System; e) HDMF - refers to the Home Development Mutual Fund; f) Mortality Data - refers to the information indicated in the Death Certificate duly registered with the Local Civil Registrar in accordance with Act No. 3753; g) Personal Information - refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual; h) PHIC - refers to the Philippine Health Insurance Corporation; i) SSS - refers to the Social Security System.

Sec. 4. Philippine Death Check Register. - There shall be established a

Philippine Death Check (PDC) Register to be maintained by the Philippine Statistics Authority (PSA). The PDC is a centralized and electronic database containing mortality data registered with the Local Civil Registrar. PSA shall ensure the security and integrity of the PDC by safeguarding these from data breach and any other mode of tampering data to perpetuate fraud. The PDC Register may take the form of any existing information and communications technology (ICT)-enabled or online civil registry database established, maintained and managed by the PSA, which can be reconfigured, modified or upgraded for purposes and objectives of this Act. Once death is registered with the Local Civil Registry, the information shall be immediately uploaded to the PDC Register Electronic System. The PSA, in coordination with the Department of Information and 32 Communications Technology (DICT) and the National Privacy Commission (NPC),

shall implement programs to facilitate immediate and timely access to mortality data registered with the Local Civil Registrars. The PSA shall have the exclusive authority to make changes and amendments in the PDC Register to ensure security and integrity thereof and to safeguard the same from data breach, tampering and data loss.

Sec. 5. Online Death Verification System. - The PSA shall establish an Online

7 Death Verification System, which shall be a centralized and online system for death 8 verification that shall ensure timely detection and prevention of identity theft of 9 deceased persons and strengthen efforts against insurance fraud and fraudulent 10 claims. The PSA, through the Online Death Verification System, shall verify the death of the data subject upon receipt of information necessary to verify the identity of the data subject as may be required in the Implementing Rules and Regulations, and shall immediately notify COMELEC, PHIC, GSIS, SSS, HDMF, and PVAO of the death verification result. Except for COMELEC, PHIC, SSS, GSIS, HDMF, and PVAO, an Information Sharing Agreement between PSA and other government instrumentalities or government agencies shall be required prior to being granted access to the Online Death Verification System.

Sec. 6. Information Sharing. - The PSA shall immediately make available to

the COMELEC, Philhealth, GSIS, SSS, HDMF, and PVAO, without cost, other information, such as date of death, age at death, place of death, civil status, in the PDC Register as may be necessary for the validation of any member or beneficiary claim made with said agencies. Provisions of the Republic Act No. 10173, otherwise known as the "Data Privacy Act of 2012" on the processing of personal information, particularly the principles of proportionality, legitimate purpose and transparency, shall be strictly complied with.

Sec. 7. Data Privacy and Confidentiality. - Government instrumentalities and

agencies granted access under Section 5 of this Act shall ensure that all times the confidentiality of any personal information that comes to its knowledge and possession, and the same shall be used exclusively for verification and

authentication purposes in relation to the lawful performance of their official 2 functions and mandate.

Sec. 8. Penal Provisions. -

a) Unauthorized processing of personal information, as defined by RA 10173, shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (P500,000.00) but not more than Two million pesos (P2,000,000.00). The unauthorized processing of personal sensitive information shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (P500,000.00) but not more than Four million pesos (P4,000,000.00). b) Accessing personal information due to negligence shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (P500,000.00) but not more than Two million pesos (P2,000,000.00). Accessing sensitive personal information due to negligence shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (P500,000.00) but not more than Four million pesos (P4,000,000.00). c) Processing of personal information for unauthorized purposes shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (P500,000.00) but not more than One million pesos (P1,000,000.00). The processing of sensitive personal information for unauthorized purposes shall be penalized by imprisonment ranging from two (2) years to seven (7) years and a fine of not less than Five hundred thousand pesos (P500,000.00) but not more than Two million pesos (P2,000,000.00). d) Unauthorized access or intentional breach, as defined under RA 10173, shall be penalized by imprisonment ranging from one (1) year to three

(3) years and a fine of not less than Five hundred thousand pesos (P500,000.00) but not more than Two million pesos (P2,000,000.00). e) Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (P500,000.00) but not more than One million pesos (P1,000,000.00). f) The maximum penalty in the scale of penalties respectively provided herein for the preceding offenses shall be imposed when the personal information of at least one hundred (100) persons is harmed, affected or involved as the result of the abovementioned actions. g) When the offender or the person responsible for the offense is a public officer as defined in the Administrative Code of the Philippines in the exercise of his or her duties, an accessory penalty consisting in the disqualification to occupy public office for a term double the term of criminal penalty imposed shall he applied.

Sec. 9. Implementing Rules and Regulations. - The Philippine Statistics

Authority (PSA), in coordination with the COMELEC, PhilHealth, GSIS, SSS, HDMF and PVAO, shall issue rules and regulations to implement the provisions of this Act within one hundred twenty (120) days from the effectivity of this Act.

Sec. 10. Appropriations. - The amount necessary to carry out the initial

implementation of this Act shall be sourced from any available funds of the National Treasury, and is hereby appropriated and authorized to be released for its initial operations.

Sec. 11. Separability Clause. - If any provision of this Act is declared invalid

or unconstitutional, the remaining provision not affected thereby shall continue to be in full force and effect.

Sec. 12. Repealing Clause. - All laws, decrees, orders or regulations or part

thereof inconsistent with this Act are hereby repealed or modified accordingly.

Sec. 13. Effectivity. - This Act shall take effect fifteen (15) days following the

completion of its publication in the Official Gazette or in a national newspaper of general circulation. Approved,