Rfid Users Protection Act

Offers of t TWENTIETH CONGRESS OF THE REPUBLIC OF THE PHILIPPINES First Regular Session AUG -6 P1:40 SENATE RECOVED GY 1032 S. No.. Introduced by Senator Jinggoy Ejercito Estrada AN ACT PROTECTING THE USERS OF RADIO FREQUENCY IDENTIFICATION DEVICES EXPLANATORY NOTE The use of Radio Frequency Identification (RFID) tags and trackers are proven useful, convenient and economical in various industries. They are widely used in the transportation sector for toll, train and bus cards. It is also embedded in identification documents such as passports, company IDs, school IDs, and membership IDs. RFIDs are reliable devices for tracking both objects and persons such as merchandise, packages, pets, or patients in hospital settings. The National Telecommunications Commission (NTC) issued in 2006 Memorandum Circular No. 03-08-2006 regarding the Use and Operation of Radio Frequency Identification (RFID) within the 13.553-13.567 MHz, 918-920 MHz, and 2446-2454 MHz Bands. It regulates the approval, acceptance, registration and licensing of RFID proximity readers and provides for penalties for violations of its provisions. The "RFID Users Protection Act" seeks to provide complete and appropriate information to the consumers about the use of RFID tags and protect them from unauthorized access to their personal information stored in the said tags. It also

mandates the seller or user of RFID tags to employ security measures to ensure that are consistent with industry standards and are commensurate with the amount and sensitivity of the information being stored in the system. In this light, the immediate passage of this bill is highly recommended. SÍNGGOY EJERCITO ESTRADA

TWENTIETH CONGRESS OF THE ) REPUBLIC OF THE PHILIPPINES First Regular Session ) 25 AUG -6 P1:40 SENATE RECLINTO BY S. No. 1032 Introduced by Senator Jinggoy Ejercito Estrada AN ACT PROTECTING THE USERS OF RADIO FREQUENCY IDENTIFICATION DEVICES Be it enacted by the Senate and House of Representatives of the Philippines in Congress assembled:

Section 1. Short Title. - This Act shall be known as the "RFID Users

Protection Act.

Sec. 2. Definition of Terms. - As used in this Act, the term:

(a) Data means personal information, numerical values associated with a person's facial features, or unique personal identifier numbers stored in an identification device; (b) Identification device means an item that uses radio frequency identification technology; (c) Personal Information includes any of the following information associated with an individual: (1) Social security number; (2) Driver's license number; (3) Bank account number; (4) Credit or debit card number; (5) Personal identification number; (6) Automated or electronic signature; (7) Unique biometric data;

(8) Account passwords; (9) Telephone number; (10) Address; (11) Date of birth; or, (12) Any other piece of information that can be used to access an individual's financial accounts or to obtain goods or services, or offer goods or services based on that information without an individual's consent; (d) Radio frequency identification or RFID means a technology that uses radio waves to transmit data remotely to readers and are intended to carry data in suitable transponders, generally known as tags, and to retrieve data, by hand- or machine-readable means, at a suitable time and place to satisfy particular application needs. Data within a tag may provide identification of an item, goods in transit, a location, the identity of persons and/or their belongings, a vehicle or assets, an animal or other types of information; RFID systems employ tiny chips and wireless antennas that can be embedded into products and used for unique identification purposes. It is a contact-less solution that works with proximity readers and RFID tags. (e) Proximity reader is a device that transmits an interrogating / querying signal to an RFID tag and receives unique information from the tag. Readers have two high level versions - those that store data and those that simply store a reference key for look-up on host system; (f) Remotely means that no physical contact between the identification device and the reader is necessary in order to transmit data; and, (g) RFID tag is a microchip attached to an antenna that picks up signals from and sends signals to a reader. A tag contains a unique number, but may have other information. RFID tags may be classified as: 1) Active tag which is used for long distance purposes such as in toll highways, parking areas, and gas stations. This tag uses small batteries which enable it to send signals at a longer distance; and,

2) Passive tag which is used very near or in close proximity to a reader and does not use any internal battery. (h) Unique personal identifier number means a randomly assigned string of numbers or symbols that is encoded on the identification device and is intended to identify the identification device.

Sec. 3. Notice Requirement. - Any person who sells, issues, or distributes

items containing an RFID tag must post a notice informing the consumer of the use of such technology. The notice must disclose the following information: a) The item contains or may contain an electronic communication device; b) The consumer has the legal right to request that an item containing an RFID tag be removed or deactivated before the item leaves the store premises; and, c) The consumer has the right to request a copy of all personal information collected about himself or herself through an RFID tag, including the identity of any person who has had access to the consumer's personal information.

Sec. 4. Labelling Requirement. - Any person who sells, uses or distributes an

item that contains an RFID tag must label the item with a notice stating that: a) The item contains an RFID tag capable of engaging in electronic communication; and, b) The RFID tag can transmit personal information to an independent reader or scanner both before and after purchase or issuance.

Sec. 5. Requesting Review of Personal Information. - A consumer may

request all stored personal information pertaining to himself or herself, including the identity of any individual or entity who has had access to the consumer's personal information. After reviewing one's personal information, the consumer must be given the opportunity to contest the accuracy of his or her personal data, correct or amend the data, and request that the information be removed or destroyed from the 29 database, unless such removal or destruction is prohibited by law.

Sec. 6. Removal or Deactivation. - Upon request by a consumer, a person

31 who sells, issues or distributed an item containing an RFID tag must remove or 32 deactivate the device before the consumer leaves the store premises. Any costs

1 associated with removal or deactivation cannot be passed on to the consumer. Once 2 deactivated, it must not be reactivated without the express written consent of the consumer associated with the item.

Sec. 7. Security Measures. - Any person who sells or utilizes an RFID tag

5 must implement adequate security measures to ensure that information is secure 6 from unauthorized access, loss or tampering. These security measures should be 7 consistent with industry standards that are commensurate with the amount and sensitivity of the information being stored on the system.

Sec. 8. Unauthorized Scanning and Other Prohibited Uses. - A person may

10 not use an electronic communication devise to remotely scan, or attempt to scan, an item associated with a consumer without the consumer's knowledge. A person may not disclose, either directly or through an affiliate, a consumer's personal information associated with information gathered by, or contained within, an RFID tag. A person may not use, either directly or through an affiliate or non-affiliated third party, 15 information gathered by, or contained within, an RFID tag in order to identify a consumer.

Sec. 9. Penalty for Unlawful Scanning. - A person who intentionally scans

18 another person's identification device remotely, without that person's prior 19 knowledge and prior consent, for the purpose of fraud, identity theft, or for any other purpose, shall be subject to a fine of not less than Fifty thousand pesos (P50,000.00) but not more than Five hundred thousand pesos (P500,000.00).

Sec. 10. Separability Clause. - If any part, section or provision of this Act is

held invalid or unconstitutional, other provisions not affected thereby shall remain in full force and effect.

Sec. 11. Repealing Clause. - All laws, decrees, orders, rules and regulations

or parts thereof inconsistent with this Act are hereby repealed or amended accordingly.

Sec. 12. Effectivity. - This Act shall take effect fifteen (15) days after its

29 publication in the Official Gazette or in two (2) newspapers of general circulation. Approved,