Pres. Ferdinand Marcos Jr. signed on Monday, Oct. 10, the Subscriber Identity Module (SIM) Registration Act, which is also the first bill he signed into law as chief executive.
Photo from the House of Representatives
Re-filed in the 19th Congress, the measure seeks to regulate the registration and use of SIMs by mandating subscribers to register with telecommunication entities before SIMs are activated. Existing subscribers must also register or risk deactivating or retiring their SIMs.
The legislation does no longer contain the provision on social media registration, which pushed former president Rodrigo Duterte to veto the previous version of the bill.
The law comes at a time when smishing and other forms of scam and spam messaging, and a host of other SIM-aided criminal activity have been escalating, with perpetrators remaining anonymous.
Local telcos Globe and Smart Communications both issued statements saying they support the signing of the bill and are ready to comply with it.
Globe called at the same time for the full rollout of the national ID system, stressing that a verifiable and fool-proof identification system is the foundation of the SIM Registration law.
“If people are allowed to submit any form of identification which can easily be falsified, SIM registration will be useless for law enforcers and fraudsters will continue to operate,” it said.
“For this reason, our position has been clear from the beginning, a National ID system must be in place to ensure the safe and successful implementation of this new law,” said Globe general counsel Froilan M. Castelo.
Globe said it welcomes a new regulatory environment that has stronger safeguards against cyberthreats and other crimes carried out using mobile phones.
“Globe is working with the government in drafting the implementing rules and regulations (IRR) for the rational enforcement of the law, including the rollout of the retroactive registration of tens of millions of prepaid SIM users,” it said.
Smart Communications, meanwhile, called for more time to prepare for SIM registration.
“There is a clamor from Public telecommunication entities (PTEs) like Smart to be given more time to prepare and test its systems to ensure the safety of the information that will be collected from prepaid subscribers — as an information campaign on the SIM registration process will be launched and Smart will ensure to provide its prepaid customers a smooth and hassle-free experience upon registry of their SIMs,” said Roy D. Ibay, Smart VP and head of regulatory affairs.
“This industry-wide effort will impact not just the telecommunications companies but the thousands of retailers and millions of Filipinos using telco services as well,” he added.
Smart has also reiterated its readiness to participate in the crafting of the bill’s IRR. “We are ready to participate in the formulation of the IRR within the prescribed period,” Ibay added.
Sen. Grace Poe, chairperson of the Senate committee on public services who sponsored the SIM Registration Act in the Senate, hailed the signing of the “long-overdue measure into law”.
“We worked hard to pass the legislation anew as a crucial first step to fend off text scammers, while guaranteeing utmost respect to fundamental human rights,” Poe said.
“The law has instituted sufficient safeguards that accord primacy to consumers’ right to privacy to ensure a safe and secure mobile use in the country.”
Poe said any information obtained in SIM registration will be treated as confidential and cannot be disclosed, except in compliance with any law authorizing such disclosure or in adherence to a court order or legal process upon finding of probable cause.
“Breach of data and violations of the provisions of the law shall be meted with heavy penalties,” she said.
The National Privacy Commission (NPC), in an earlier statement, said it is fully aware that implementing a SIM card registration system will entail a massive collection of personal data.
“Hence, there is a strong need to develop a technology-neutral approach and to future-proof the proposed legislation to achieve its intended purpose, in a manner that respects the rights and freedoms of the data subjects,” the agency said.
The NPC said it advocated to the House and Senate to consider the proportionality principle and data minimization mechanisms concerning the provisions on social media providers and authorized resellers.
“Mechanisms must be developed and implemented to prevent security risks and data breaches that may arise from overcollection and improper or inadequate monitoring practices,” it said.
The NPC said it recommended that the burden to determine the SIM card buyer’s identity should not fall on retailers who may not have the necessary know-how or resources to properly verify the identity of data subjects and the authenticity of the identification cards that will be presented.
“Delegating it to these retailers may result in overcollection and improper or inadequate monitoring and security practices. This was adopted in Section 5 of the bill,” it noted.
The NPC also discouraged the use of a centralized server or database as it carries greater risks if a security breach occurs.
“This recommendation was adopted in Section 6 of the Bill, which requires that the designated government agencies or public telecommunications entities (PTEs) maintain their own databases,” the privacy body said.
“The PTE must strictly use the database to process, activate, or deactivate a SIM or subscription, and not for any other purpose. In fulfillment of its duty to uphold the rights of data subjects, the NPC will closely coordinate with other agencies to develop the necessary guidelines to properly implement the Bill.”
