The National Telecommunications Commission (NTC) Releases the Implementing Rules and Regulations (IRR) of the Subscriber Identity Module (SIM) Registration Act

On Monday, December 12, 2022, the National Telecommunications Commission (NTC) released the implementing rules and regulations (IRR) of the Subscriber Identity Module (SIM) Registration Act, also known as Republic Act No. 11934. The law is set to take effect next Tuesday, December 27. The IRR of RA No. 11934 can be accessed here.

The new law requires all users of new and existing SIM cards in the Philippines to register their phone numbers with their respective telecommunication companies. Not doing so will result in the SIM card’s deactivation. The law was signed on October 10 of this year by President Ferdinand “Bongbong” Marcos Jr.

The following state the salient points of the IRR:

• Users with existing and new SIMs must register their phone numbers within 180 days from the law’s effectivity, but an extension of at most 120 days is allowed.

• Failure to comply with the registration guidelines will result in SIM deactivation in old SIMI cards and no activation for new cards.

• SIM registration is done through virtual platforms provided by their respective public telecommunications entities (PTE). Individuals must submit their full name, date of birth, and sex, and present any government-issued identification (ID) card and card number.

• SIM Card holders who are below 18 years old must also present any government-issued ID along with their parents or legal guardians’ IDs.

• Companies and businesses are required to submit their full name, authorized signatory, business name, and address. They must also present a certificate of registration and submit an adopted resolution indicating the authorized representative or a special power of attorney.

• Foreign nationals in the country who are here to work or study should submit their full name, nationality, date of birth, passport, current address in the Philippines, and ID number. ● Tourists staying in in the Philippines for less than a month must register their local SIM using their passport and their address while in the country, and fill up the SIM registration form.

In Section 4 Rule 4(d) of the IRR, tourists with local SIMs are only valid for 30 days and will be automatically deactivated after the given period, in compliance with Section 9(a) of the Commonwealth Act No. 613 otherwise known as An Act to Control and Regulate the Immigration Of Aliens into the Philippines. The SIM’s activation can only be extended if the tourist presents am approved visa extension document.

PSA also highlights the penalties stated in the IRR:

• Submitting and using a fake identity to register a SIM may result in imprisonment from 6 months to 2 years or will be fined an amount of not less than PHP 300,000 or may receive both.

• Registered SIMs cannot be sold; if done, there is a penalty of imprisonment ranging from 6 months to 6 years or may be fined an amount of PHP 100,000 to PHP 300,000 or may receive both.

• Any individual and entity selling stolen SIMs will be criminally liable under the law and will face imprisonment ranging from 6 months to 2 years, and may be fined not less than PHP 100,000 but not more than PHP 300,000.

• A breach of confidentiality by public telecommunication entities (PTEs), its agents, and employees will be fined an amount of less than PHP 500,00 but not exceeding PHP 4,000,000.

As advised by the National Privacy Commission (NPC), each PTE will establish their own database for SIM registration instead of using a centralized server to avoid the risks of security breach. The PTEs are only authorized to access the database to “process, activate, or deactivate a SIM or subscription.” Section 11 Rule 5 of the IRR states that any information and data provided by the users “shall be treated as absolutely confidential and shall not be disclosed to any person.” The relevant data will be kept by the PTEs for a period of 10 years from the time a user’s mobile phone number is deactivated.

PSA notes that as stated in the IRR, courts may order public telecommunications entities (PTE) to release personal data of individuals involved in criminal activities, including mobile phone-based crimes, for identity tracing.

The following points from Section 11 Rule 5 of the IRR state what instances the PTEs can disclose the full name and address of a SIM user:

(a) In compliance with any law obligating the PTE to disclose such information in accordance with the provisions of Republic Act No. 10173, known as the Data Privacy Act of 2012;

(b) In compliance with a court order or legal process upon finding of probable cause;

(c) In compliance with Section 10 of the Act and Section 12 of the IRR; or

(d) With the written consent of the user: such waiver of absolute confidentiality shall not be made as a condition for the approval of subscription agreements with the PTEs

Additionally, in Section 12 Rule 5, PTEs are required to present collected during the SIM registration process only when a subpoena is issued by authorities pursuant to the investigation on a sworn written complaint indicating that a specific mobile number was used or is being used in criminal activity, and that the identity of owner of the said number needs to be identified.