IMPLEMENTING RULES & REGULATIONS REPUBLIC ACT NO. 11934 (NTC MEMORANDUM CIRCULAR NO. 001-12-2022), December 12, 2022

RULES AND REGULATIONS IMPLEMENTING REPUBLIC ACT NO. 11934, OTHERWISE KNOWN AS THE "SUBSCRIBER IDENTITY MODULE (SIM) REGISTRATION ACT"

WHEREAS, Executive Order No. 546 series of 1979 (EO 546) created the National Telecommunications Commission (NTC) will mandate, among others, to supervise and regulate public telecommunications network and services;

WHEREAS, Republic Act (RA) No. 7925 (RA 7925), otherwise known as the "Public Telecommunications Policy Act" likewise recognizes the essential role of telecommunication in economic development, integrity and security of the Philippines, and as such shall be developed and administered as to safeguard, enrich and strengthen the economic, cultural, social and political fabric of the Philippines;

WHEREAS, under Section 12 of Republic Act No. 11934 (RA 11934), otherwise known as the "Subscriber Identity Module (SIM) Registration Act", the NTC, in coordination with other concerned agencies such as, but not limited to the Department of Information and Communications Technology (DICT), Department of Trade and Industry (DTI), National Privacy Commission (NPC), as well as Public Telecommunications Entities (PTEs) and major consumer groups, shall set the guidelines for the monitoring and proper implementation of the said Act and shall promulgate the implementing rules and regulations as may be necessary to ensure the effective implementation of said Act;

NOW, THEREFORE, pursuant to EO 546, RA 7925 and RA 11934, the following rules and regulations are hereby promulgated:

RULE I

PRELIMINARY PROVISIONS

Section 1. Title. These rules and regulations shall be known as the "Implementing Rules and Regulations (IRR) of the SIM Registration Act".

SECTION 2. Scope. This Memorandum Circular prescribes the general rules and guidelines for the registration of new and existing SIMs of end-users with the respective PTEs.

SECTION 3. Definition of Terms. For the purpose of this Memorandum Circular, the following terms shall mean:

(a) Act refers to Republic Act No. 11934, otherwise known as Subscriber Identity Module (SIM) Registration Act.

(b) Automatic deactivation refers to the automated process of rendering a SIM incapable of being used for outgoing and incoming calls, internet access, or sending and receiving messages, upon the registration of the period for registration set forth under the Act and this IRR.

(c) Barring or temporarily deactivating a SIM refers to the blocking of the SIM rendering it unusable for all incoming or outgoing calls and short messaging service (SMS) or any mobile date services without permanently deactivating the SIM.

(d) Consent refers to any freely given, specific, informed, indication of will whereby the subscriber/end-user agrees to the processing of personal data about and/or relating to him or her. Consent shall be evidenced by written, electronic, or recorded means. It may also be given on behalf of the subscribed/end-user by an agent specifically authorized by the subscriber/end-user to do so.

(e) Competent Authority refers to such law enforcement agencies, cybercrime prevention bodies, or prosecutorial offices, with subpoena powers, as established or created by laws, and relevant orders, rules, circulars and regulations.

(f) Deactivated state refers to the condition or status of a SIM rendering it incapable of being used for outgoing and incoming calls, internet access, or sending and receiving messages, except for exclusively enabling and informing such SIM to be registered.

(g) End-users refers to any existing subscriber; and/or any individual or juridical entity which purchases a SIM from the PTEs, its agents, resellers, or any entity.

(h) Persons of Concern or POC refer to refugees, asylum seekers, stateless persons, stateless applicants, and populations at risk of statelessness as defined and covered under the 1951 Convention Relating to the Status of Refugees and its 1967 Protocol, and the 1954 Convention Relating to the Status of Stateless Persons and the 1961 Convention on the Reduction of Statelessness.

(i) Postpaid subscription refers to the subscription wherein service is provided by virtue of a prior arrangements with a public telecommunications entity, and the end-user thereof is billed at the end of the monthly billing cycle according to the use of mobile service.

(j) Prepaid subscription refers to the subscription wherein credit is purchased in advance of service use. The purchased credit is used to pay for mobile phone services at the point the service is accessed or consumed. If there is no available credit, then access to the requested service is denied.

(k) Public Telecommunications Entity or PTE refers to any person, natural or juridical, who dispenses or sells a SIM to an end-user.

(l) Purchase of SIM refers to the acquisition of a SIM by an end-user whether for consideration or otherwise including through sale, barter, donation or other means.

(m) Reseller refers to a person, natural or juridical, who dispenses or sells a SIM to an end-user.

(n) Serial Number refers to a unique PTE-generated registration reference or tracking number. This number is automatically generated in the SIM registration platform upon registration of the SIM by the end-user.

(o) SIM refers to the Subscriber Identity Module which is an embedded circuit that securely stores International Mobile Subscriber Identity (IMSI) and related keys or an electronic equivalent thereof, used to identify and authenticate subscribers on mobile devices, such as mobile phones and computers, and other electronic devices. For purposes of the Act and this IRR, this shall include e-SIMs and other variations thereof.

(p) SIM Register refers to the secure digital database containing the required information under Section 5 of the Act, for registered postpaid and prepaid subscribers or end-users, whether commingled or kept separately in a secure physical or virtual location under the control of the PTE.

(q) Spoofing refers to the act of transmitting misleading or inaccurate information about the source of the phone call or text message, with the intent to defraud, cause harm, or wrongfully obtain anything of value.

RULE II
SIM REGISTRATION AND REGISTRATION GUIDELINES

Section 4. Sim Registration.

(a) In order to regulate the registration and use of SIMs, all end-users shall be required to register their SIMs with their respective PTEs as a per-requisite to the activation thereof.

All covered SIMs, including embedded SIMs (eSIMs), other variations/technologies and other future technologies thereof, which are provisioned by any PTE to provide SMS, voice, and/or data services are subject for registration. These include SIMS intended for data-only or used for fixed wireless broadband modem and/or wireless local loop, machine-to-machine (M2M) service and/or Internet of Things (IoT).

(b) An end-user who fails to comply with the requirements for registration shall result in their SIM not being activated.

(c) All the SIMs to be sold and/or issued by the PTEs, its agents, resellers, or any entity shall be in a deactivated state as defined in Rule 1 Section 3(f) of this IRR. It shall only be activated after the end-user completes the process of registration.

(d) The SIMs that are registered for foreign national end-users visiting as tourists under Section 9(a) of Commonwealth Act No. 613, as amended, shall only be valid temporarily for thirty (30) days, and shall automatically be deactivated upon expiration of the validity of the SIM. The validity of such SIM may be extended only upon presentation or submission by the said foreign national of an approved visa extension.

(e) Foreign nationals with other types of visas can acquire SIMs without the thirty (30)-day temporary validity period, and register the same following the respective PTE's registration process.

(f) The relevant government agencies, such as but not limited to the DICT, NTC, Department of the Interior and Local Government (DILG), and Department of Education (DepEd); and concerned PTEs shall facilitate al SIM registrations in remote areas with limited telecommunication or internet access. The DICT and NTC shall initiate the necessary coordination in such facilitation efforts. The registration facilities in remote areas shall be established within sixty (60) days from the effectivity of this Act.

(g) SIM registration shall be implemented at no cost to the end-users.

Section 5. registration of Existing Subscribers.

(a) All existing SIM subscribers/end-users shall register within one hundred eighty (180) days from effectivity of the Act. The registration may be extended for a period not exceeding one hundred twenty (120) days. Failure to register the existing SIM within the period prescribed shall result in the automatic deactivation of the SIM. The deactivated SIM may only be reactivated after registration; provided, however, that reactivation shall be made not later than five (5) days after such automatic deactivation.

(b) PTEs shall include the information and date of existing postpaid subscribers in the SIM register to align with the registration requirements hereunder. To complete registration however, such existing postpaid subscribers shall be required to confirm their information and data included in the SIM Register, through the PTE's registration platform or website established under the Act and this IRR.

Section 6. Registration Form and Registration Process.

(a) The Registration Form shall be accomplished electronically through a secure platform or website to be provided by the PTEs to their respective subscribers. The same shall include a declaration by the end-user that the identification documents presented are true and correct, and that said person is the one who accomplished the registration form.

(b) The platform or website to be used for the registration as well as the registration form shall give due consideration on the user interface, user experience, and accessibility. The registration portal shall be easy to use and navigate, considering the needs of various end-users.

(c) A privacy notice shall be made available on the platform or website. It shall explain the details of the processing of personal data for the SIM Register.

(d) The registration process shall be guided by the following parameters:

(i) Submission of the electronically and duly accomplished registration form with the following data and information only:
cralawred

By individual (natural person) end-user:
(1) Full Name;
(2) Date of Birth;
(3) Sex;
(4) Present/Official Address (Choice by end-user);
(5) Type of ID Presented; and
(6) ID Number Presented.

By juridical entity end-user:
(1) Business Name;
(2) Business Address; and
(3) Full Name of Authorized Signatory.

By foreign national end-user:
(1) Full Name;
(2) Nationality;
(3) Date of Birth;
(4) Passport;
(5) Address in the Philippines;
(6) For Persons of Concerns or POCs, the Type of Travel or Admission Document Presented; and
(7) ID Number or Number of Document Presented.
cralawred

(ii) Presentation of valid government-issued identification (ID) card or other similar form of document with photo.

(iii) Inputting of the assigned mobile number of the SIM with its serial number.
cralawred

(e) The PTEs shall be enjoined to include processes to verify the submitted information and data, subject to the applicable provisions of the Data Privacy Act, its IRR, and other relevant issuances of the National Privacy Commission.

Section 7. Valid government-issued identification (ID) cards or other similar forms of documents with photo that will verify the identity of the end-user.

(a) For individual end-user, ANY of the following identification cards or documents with photo shall be presented:

(i) Passport;
(ii) Philippine Identification System ID, or the Philippine Identification Card;
(iii) Social Security Service ID;
(iv) Government Service Insurance System e-Card;
(v) Driver's License;
(vi) National Bureau of Investigation clearance;
(vii) Police clearance;
(viii) Firearms' License to Own and Possess ID;
(ix) Professional Regulation Commission ID;
(x) Integrated Bar of the Philippines ID;
(xi) Overseas Workers Welfare Administration ID;
(xii) Bureau of Internal Revenue ID;
(xiii) Voter's ID;
(xiv) Senior Citizen's card;
(xv) Unified Multi-purpose Identification Card;
(xvi) Persons with Disabilities card; or
(xvii) Other valid government-issued ID with photo.
cralawred

(b) For juridical entity end-user, ALL of the following shall be presented

(i) Certificate of Registration; and
(ii) In the case of corporations, duly adopted resolution designating the authorized representative, and in the case of other juridical entities, a special power of attorney.cralawred

(i) ANY of the identification (ID) cards identified in Section 7(a) of this IRR; and

(ii) Consent of the minor's parent or guardian,� to register the SIM.

(d) For foreign national end-user visiting as tourists under Section 9(a) of Commonwealth Act No. 613, as amended, ALL of the following shall be presented:

(i) Passport (i.e. copy of the bio-page and pages where the current 9(a) visa is stamped or shown);
(ii) Proof of address in the Philippines (i.e. booking in a hotel or other type of accommodation, or in the absence thereof, an affidavit/letter from the owner of the house or residence where such foreign national will stay; and
(iii) Return ticket to own country of the tourist or any other ticket showing the date and time of departure from the Philippines.
cralawred

(e) For foreign national end-user with other types of visas. ALL of the following shall be presented:

(i) Passport (i.e. copy of the bio-page and pages where the type of visa is stamped or shown);
(ii) Proof of address in the Philippines (i.e. booking in a hotel or other type of accommodation, or in the absence thereof, an affidavit/letter from the owner of the house or residence or contract of lease of residence/space where such foreign national will stay); and
(iii) Other pertinent document, whichever is applicable

(1) Alien Employment Permit issued by the Department of Labor and Employment (DOLE);
(2) Alien Certificate of Registration Identification Card (ACRI Card) issued by the Bureau of Immigration (BI) or other types of official ID issued by any other visa-issuing agency;
(3) School registration and ID for students; or
(4) For Persons of Concern or POCs, the type of travel or admission document validly issued by the Department of Justice.
cralawred

Section 8. SIM Register.

(a) All PTEs shall maintain their own database containing information required under the Act. The database shall strictly serve as a SIM Register to be used by PTEs to process, activate or deactivate a SIM or subscription and shall not be used for any other purpose, unless otherwise provided under the Act.

(b) The successful submission and acceptance of the required registration form shall serve as the certification of registration by the end-user.

RULE III
OBLIGATIONS OF END-USERS

Section 9. Obligations of End-users. The end-users shall have the following obligations:

(a) Undertake registration of their own SIMs within one hundred eighty (180) days from the effectivity of the Act, without prejudice to the possible extension by the DICT up to a maximum period of one hundred twenty (120) days, as provided under the Act.

(b) Immediately report to their respective PTEs:

(1) any change in the information supplied in their applications for SIM registration;
(2) lost or stolen SIM by providing the following information:
(i) Name;
(ii) Address;
(iii) Date of Birth;
(iv) Mobile Subscriber Number; and
(v) Such other relevant and reasonable information as may be required by the PTE to fully establish ownership of the SIM.
cralawred

(c) In case of death of the end-user, the immediate family or relatives shall immediately report said information to the respective PTE.

(d) Submit to their respective PTEs any request for SIM activation/deactivation.

(e) Undertake not to sell or transfer registered SIMs without complying with the registration requirements under the Act and this IRR.

RULE IV
OBLIGATIONS OF PTES

Section 10. Obligations of Public Telecommunications Entities. The PTEs shall have the following obligations:

(a) Establish their own secure online SIM registration platform. The online registration platform shall be user-friendly and easy to use for the benefit of the registering subscribers/end-users. PTEs shall also provide additional means to assist persons with disabilities, senior citizens, pregnant women, and/or persons with special needs in registering their respective SIMs. PTEs shall be enjoined to also include procedures to verify the data and information submitted and presented by the registering subscribers/end-users.

(b) Maintain a register of the SIMs of their respective end-users and include the data of existing postpaid subscribers in the SIM register.

(c) Send notice of successful submission and acceptance of registration form to the end-users on the same day.

(d) Effect any change in the information in their respective SIM registers requested by their respective end-user, loss or theft of a SIM, or request for deactivation.

(f) Immediately effect barring of any SIM reported as lost of stolen thereby rendering it unusable for any incoming or outgoing text, call and use of mobile data service. Such SIM will be permanently deactivated upon issuance of a new SIM to the verified end-user or within twenty-four (24) hours as provided under Section 10(e) of this IRR, whichever comes earlier.

(g) Deactivate, temporarily or permanently, the SIM used for fraudulent text or call, upon due investigation.

(h) Deactivate all prepaid SIMS for sale to the public upon the effectivity of the Act. Otherwise, the concerned PTE shall be liable for the penalties prescribed under the Act.

(i) Retain for ten (10) years from date of deactivation the relevant data and information of any deactivated SIM.

(j) Treat as absolutely confidential and not to disclose to any person any information of any deactivated SIM.

(k) Provide user-friendly reporting mechanism for their respective end-users to report any potentially fraudulent text or call, change of information, lost or stolen SIM, or death of a registered end-user.

(l) Ensure that the end-users' data are secured, encrypted and protected at all times and comply with the minimum information security standards prescribed by the DICT consistent with internationally-accepted cybersecurity standards and relevant laws, rules and regulations.

(m) Report to the DICT, within twenty-four (24) hours of detection, any incident of cyber-attack on the SIM register. In the event that the cyber-attack should also result in personal data breach, PTEs shall comply with the personal data breach notifications and other reportorial requirements pursuant to the provisions of the Data Privacy Act of 2012 (DPA) and applicable issuances of the National Privacy Commission (NPC).

(n) Allow DICT to perform an annual audit on the PTEs' compliance with information security standards.

(o) Submit to the NTC, DICT, and both Houses of Congress, on or before the 30^th day of April of each year, an annual report on the implementation of the provisions of the Act and this IRR for the previous calendar year.

(p) Facilitate, together with the relevant government agencies, the SIM registration process in remote areas with limited telecommunications or internet access.

(q) Comply, at all times, with the requirements of the DPA of 2012 and issuances of the NPC such as, among others:

(i) Conduct of mandatory privacy impact assessment on the respective SIM Registers prior to the entry of any personal data in the Registers, or within a reasonable time thereafter.

(iii) Implementation of reasonable and appropriate physical, organizational, and technical security measures to protect personal data of data subjects throughout the data lifecycle of the SIM Register.

(iv) Enable mechanisms for the exercise of the rights of end-users as data subjects under the DPA of 2012.

(v) Ensure that any processing of personal data submitted by the end-user in the registration of their SIM shall have a legitimate purpose which is not contrary to law, morals, public order, and public policy, and meets the criteria for lawful processing of personal data under the DPA.

RULE V
CONFIDENTIALITY CLAUSE AND DISCLOSURE OF INFORMATION

Section 11. Confidentiality Clause. - Any information and data obtained in the registration process described under the Act shall be treated as absolutely confidential and shall not be disclosed to any person.

Notwithstanding this provision, the PTE shall disclose the full name and address of an end-user in the following instances:

(a) In compliance with any law obligating the PTE to disclose such information in accordance with the provisions of Republic Act No. 10183 or the Data Privacy Act of 2012;

(b) In compliance with a court order or legal process upon finding of probable cause;

(c) In compliance with Section 10 of the Act and Section 12 of this IRR; or

(d) With the written consent of the subscriber: Such waiver of absolute confidentiality shall not be made as a condition for the approval of subscription agreements with the PTEs:

The confidentiality clause in the SIM registration shall take effect at the point of activation and shall continue even after deactivation of the SIM and for as long as the end-user's data is still retained by the PTEs. For this purpose, the point of activation shall mean the time when the concerned PTE receives the required data or information from the registering subscriber/end-user.

Section 12. Disclosure of Information. Notwithstanding the provisions on confidentiality, the PTEs shall be required to provide information obtained in the registration process only upon the issuance of a subpoena by a competent authority pursuant to an investigation based on a sworn written complaint that a specific mobile number, was or is being used in the commission of a crime or that it was utilized as a means to commit a malicious, fraudulent or unlawful act, and that the complaint is unable to ascertain the identity of the perpetrator.No PTE shall be held administratively, civilly, or criminally liable on account of any disclosure done in compliance with the Act.

The relevant data and information shall be kept by the PTEs for a period of ten (10) years from the time a particular subscriber/end-user's mobile number is deactivated, and solely for the purpose discussed under Section 10 of the Act.

RULE VI
PENAL PROVISIONS

The following penalties shall be imposed for violation of any provision of the Act:

Section 13. For providing false or fictitious information or for using fictitious identities or fraudulent identification documents to register a SIM. The penalty of imprisonment ranging from six (6) months to two (2) years, or a fine of not less than one hundred thousand pesos (P100,000.00) but not more than three hundred thousand pesos (P300,000.00), or both, shall be imposed upon anyone who provides false or fictitious information or who uses a fictitious identity or fraudulent identification documents to register a SIM.

Section 14. For sale or transfer of a registered SIM without complying with the required registration. The penalty of imprisonment ranging from six (6) months to six (6) years, or a fine of one hundred thousand pesos (P100,000.00) to three hundred thousand pesos (P300,000.00), or both, shall be imposed upon anyone who sells or transfers a registered SIM without complying with the required registration under the Act.

Section 15. For spoofing a registered SIM. The penalty of imprisonment of no less than six (6) years, or a fine of two hundred thousand pesos (P200,000.00), or both, shall be imposed upon anyone who causes to transmit misleading or inaccurate information about the source of the phone call or text message, with the intent to defraud, cause harm, or wrongfully obtain anything of value, unless such transmission is exempted in connection with: (1) authorized activities of law enforcement agencies; or (2) a court order specifically authorizing the use of caller ID manipulation.

Section 16. For failure or refusal to register a SIM. The following fines shall be imposed upon the PTEs who shall fail or refuse to register a SIM, without a valid reason, despite compliance by the end-user with the requirements for SIM registration under the Act:

(a) First offense: a fine of not less than one hundred thousand pesos (P100,000.00) but not more than three hundred thousand pesos (P300,000.00);

(b) Second offense: a fine of not less than three hundred thousand pesos (P300,000.00) but not more than five hundred thousand pesos (P500,000.00); and

(c) Third and subsequent offenses: a fine of not less than five hundred thousand pesos (P500,000.00) but not more than one million pesos (P1,000,000.00) for every offense thereof.

Section 17. For sale of a stolen SIM. Any PTE, its agents, resellers, or entity that shall engage in the sale of stolen SIMs shall be criminally liable under the Act. The penalty of imprisonment ranging from six (6) months to two (2) years, or a fine of not less than one hundred thousand pesos (P100,000.00) but not more than three hundred thousand pesos (P300,000.00), or both, shall be imposed upon the PTEs, its agents, resellers, or any entity that will engage in the sale of stolen SIM.

If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon the responsible officers, as the case may be, who participated in, or by their gross negligence, allowed the commission of the crime.

Section 18. For breach of confidentiality. The penalty of a fine of not less than five hundred thousand pesos (P500,000.00) but not more than four million (P4,000.000.00) shall be imposed upon PTEs, its agents or its employees who shall directly or indirectly reveal or disclose any information or data of an end-user obtained during the registration requirement under the Act, unless otherwise permitted by the Act or other laws.

Section 19. For breach of confidentiality due to negligence. The penalty of a fine of not less than five hundred thousand pesos (P500,000.00) but not more than four million pesos (P4,000,000.00) shall be imposed upon PTEs, its agents or its employees who, due to negligence, shall reveal or disclose any information or data of an end-user obtained during the registration requirement under the Act.

Section 20. Liability as Co-Principal and Liability Without Prejudice to any violation of the Revised Penal Code, as amended, or special law. Any person who abets or aids in the commission of any of the offenses enumerated in the Act shall be held liable as a co-principal. A prosecution under the Act shall be without prejudice to any liability or violation of any provision of the Revised Penal Code, as amended, or special laws.

Section 21. Filing of Complaints. Any complaint involving any of the above criminal offenses shall be filed by the proper party before the relevant agency, prosecution office or court having competent jurisdiction thereof.

RULE VII
MISCELLANEOUS PROVISIONS

Section 22. Interpretation. Any doubt in the interpretation of any provision of this Memorandum Circular shall be construed in a manner that accords the highest respect for privacy, and liberally interpreted in manner mindful of the rights and interest of SIM subscribers/end-users.

Section 23. Supplemental Issuances. The NTC may issue such orders, circulars, guidelines, and/or regulations in order to supplement the implementation of any particular provision or group of provisions under this IRR.

Section 24. Repealing Clause. Any circular, order, memoranda or parts thereof inconsistent herewith are deemed repealed or amended accordingly.

Section 25. Separability Clause. If any clause, sentence, provision or section of this Circular is held unconstitutional or invalid, the other sections or provisions not otherwise affected shall remain in full force and effect.

Section 26. Effectivity. This Memorandum Circular shall take effect fifteen (15) days after publication in a newspaper of general circulation and three (3) certified true copies furnished the University of the Philippines Law Center.chanroblesvirtuallawlibrary

Done this 12^th day of December 2022 in Quezon City, Philippines.�