It’s Privacy Awareness Week (PAW) following Proclamation No. 527, s. 2018, and as such, we examine the concept of privacy in the Philippines, its legal foundation, and the laws that govern it.
According to the 2018 report by the Office of the United Nations High Commissioner for Human Rights (OHCHR), privacy is considered as the presumption that individuals should have an area of autonomous development, interaction and liberty, a “private sphere” with or without interaction with others, free from State intervention and excessive unsolicited intervention by other uninvited individuals.
In the digital environment, this manifests as informational privacy, which reserves the right to non-disclosure of information that exists or can be derived about a person and her or his life, and the decisions based on that information.
To surmise, the right to privacy and its protection are not limited to private, secluded spaces, such as a person’s home, but extend to public spaces and publicly available information.
“Privacy” in the Philippines
In the Philippines, privacy is essentially defined as the right to be left alone. Article III Section 2 of the 1987 Constitution protects people “against unreasonable searches and seizures of whatever nature,” and Section 3 declares the right of people to privacy as to their communications and correspondence. Likewise, Article 26 of the Civil Code of the Philippines affirms that every person shall respect the dignity, personality, privacy, and peace of mind of their neighbors […].
While there is no singular, direct law governing all of the different and evolving aspects of privacy, the country upholds these principles through subsequent mandates and cases. For instance, the Updated Inventory of Exceptions to the Right to Access of Information under Executive Order (EO) No. 02, Series of 2016 limits public access to information deemed confidential to protect individuals’ privacy, especially that of minors, crime victims, or accused persons.
In jurisprudence, particularly in the landmark case Ople v. Torres, the Supreme Court introduced the reasonable expectation of privacy test to determine if an invasion of privacy has occurred. This involves two critical points of contention:
- Whether by one’s conduct, the individual has exhibited an expectation of privacy;
- and whether this expectation is one that society recognizes as reasonable.
This test remains a legal standard in evaluating potential violations of privacy rights, especially in matters involving surveillance, public exposure, and data handling.
Given these constitutional, statutory, and judicial frameworks, privacy in the Philippines—while still evolving—has found footing in both public and private spheres. However, in an increasingly digital society, a stronger and more cohesive legal structure becomes imperative. This brings us to the relevant statutes designed to uphold and enforce privacy in the country.
Relevant Laws Against Invasion of Privacy
Revised Penal Code
Chapter III of the Revised Penal Code punishes violations against one’s privacy by the discovery and revelation of secrets. Article 290 penalizes anyone who seizes and reveals the contents of another’s papers or letters with correctional imprisonment minimum and medium periods and a fine not exceeding ₱500.00.
Anti-Wiretapping Act of 1965 (RA 4200)
The Anti-Wiretapping Act of 1965 prohibits the unauthorized (over)hearing, interception, and recording of private communication through the use of wiretapping devices and similar recording and surveillance equipment.
Violators can face imprisonment ranging from six (6) months to more than six (6) years. If a public official is convicted, they face perpetual disqualification from public office. If the violator is a foreigner, they can face deportation.
Electronics Engineering Law of 2004 (RA 9292)
Article VI, Section 35 (h) of the Electronics Engineering Law of 2004 fines any individual with a Certificate of Registration and Professional Identification Card as a Professional Electronics Engineer, Electronics Engineer, or Electronics Technician who:
- illegally wiretaps, clones, hacks, cracks, pirates;
- and/or is involved in any form of unauthorized and malicious electronic eavesdropping;
- and/or uses any electronic devices to violate another’s privacy and the privilege of private communication,
- and in turn disregards their safety to life, physical, and/or intellectual property,
with an amount not less than ₱100,000 nor more than ₱1,000,000, or by imprisonment of not less than six (6) months nor more than six (6) years, or both, in the discretion of the court.
Anti-Terrorism Act of 2020 (RA 11479, repealing the Human Security Act of 2007 [RA 9372])
Section 16 of the Anti-Terrorism Act of 2020, which repealed the similar law, Human Security Act of 2007, explicitly allows the surveillance, interception, and recording of communications using any means and modes or forms of technology or tracking equipment and devices of individuals suspected of and/or judicially declared involvement in terrorism upon a written order of the Court of Appeals.
Under Section 24, any law enforcement agent or military personnel who violates Sections 16 and 17 of the Act, which contain the judicial requisites, and conducts surveillance activities without proper judicial authorization, is sentenced to imprisonment for ten (10) years.
Anti-Photo and Video Voyeurism Act of 2009 (RA 9995)
The Anti-Photo and Video Voyeurism Act of 2009, in itself, recognizes and protects the privacy, most notably of women and children, with the burgeoning number of intimate and graphically sensitive photos being spread through the evolving technological landscape.
Section 4 specifically punishes the capturing and/or distribution of images and videos of person/s engaging in intimate or sexual activities, and/or of private areas of a person, which includes naked or undergarment-clad genitals, public area, buttocks, or female breast, without the person’s consent, or if they have a resonable expectation of privacy. These crimes are subject to:
- Imprisonment of not less than three (3) years but not more than seven (7) years
- Or a fine of not less than ₱100,000 but not more than ₱500,000,
- Or both at the discretion of the court.
Data Privacy Act of 2012 (RA 10173)
The Data Privacy Act (DPA) of 2012 (Republic Act 10173) aims to protect personal information. It applies to both public and private organizations and covers all personal data, whether in digital or physical form. The law protects the privacy of individuals while still allowing the secure flow of information to support progress and development. It outlines the rights of individuals over their personal data and sets clear responsibilities for those who handle it.
Personal data or information refers to any information, or when put together, from which an individual’s identity can be reasonably and directly inferred by another individual holding the information. While sensitive data refers to personal information of an individual that includes:
- race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
- health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
- those that are issued by government agencies peculiar to an individual, which include, but are not limited to, social security numbers, previous or current health records, licenses or their denials, suspensions or revocations, and tax returns; and
- specifically established by an executive order or an act of Congress to be kept classified.
Born through DPA, the National Privacy Commission (NPC) is an independent body mandated to administer and implement the Act.
The NPC can impose imprisonment that can range from one (1) to seven (7) years for violations and serious offenses of the Act, and a fine ranging from ₱500,000 to ₱5,000,000. The list of specific offenses includes:
- Unauthorized Processing of Personal Information and Sensitive Personal Information
- Accessing Personal Information and Sensitive Personal Information Due to Negligence
- Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes
- Unauthorized access or intentional breach
- Concealment of a security breach
- Malicious disclosure
- Unauthorized disclosure
Additionally, the Implementing Rules and Regulations (IRR) of DPA direct on the retention and disposal of data.
According to the General Data Privacy Principles in Chapter III, Section 11(e) of the DPA, personal information must be retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained. While Rule IV, Section 19.d states that personal data shall be disposed of or discarded in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other party or public, or prejudice the interests of the data subjects.
Cybercrime Prevention Act of 2012 (RA 10175)
The Cybercrime Prevention Act of 2012 addressed crimes committed in cyberspace. Similar to the Human Security Act, Chapter IV of this Act also allows the collection, preservation, disclosure, search, seizure, and examination of computer data by law enforcement authorities upon due cause and presentation of a court warrant.
In terms of privacy, however, it prohibits unauthorized access to computer systems and data. It lists the following cybercrime offenses:
- Offenses against the confidentiality, integrity, and availability of computer data and systems.
- Illegal access and interception
- Data and system interference
- Misuse of devices
- Content-related offenses.
- Cybersex
- Child pornography
- Unsolicited commercial communications
- Libel
Penalties can include imprisonment of prision mayor, a range of penalties from six (6) years and one (1) day to twelve (12) years, and a fine of at least ₱200,000 and up to ₱1,000,000.
Privacy Awareness Week 2025
In an increasingly interconnected society, the protection of privacy must keep pace with technological and societal developments. The Philippines continues to build its framework, balancing the right to access information with the right to be left alone. As we observe PAW, it is essential to remember that privacy is more than just a legal concept—it is a fundamental human right that empowers autonomy, dignity, and freedom.
Disclaimer: The content of this blog is for informational and educational purposes only and should not be considered as legal advice. While we strive to provide accurate and up-to-date information, the blog does not create an attorney-client relationship. For legal concerns or specific legal guidance, please consult a qualified lawyer.
To read more STLAF legal tidbits, visit www.sadsadtamesislaw.com/bits-of-law.
For comments, suggestions, and inquiries, email legal@sadsadtamesislaw.com.
Author/s: Patricia Mae L. Minimo
About the author: Patricia Mae L. Minimo is the STLAF's Legal Writer-Researcher. She is a Communication graduate from the University of the Philippines – Baguio with a major in Journalism and a minor in Speech Communication.