Chapter 7 8 Data Privacy
Chapter 7 8 Data Privacy
Chapter 7 8 Data Privacy
ENFORCEMENT AND
IMPLEMENTATION OF
RA 10175
SEC. 10. Law Enforcement Authorities
The National Bureau of Investigation (NBI) and the
Philippine National Police (PNP) shall be responsible for the
efficient and effective law enforcement of the provisions of
this Act. The NBI and the PNP shall organize a cybercrime
unit or center manned by special investigators to exclusively
handle cases involving violations of this Act.
SEC. 11. Duties of Law Enforcement
Authorities
To ensure that the technical nature of cybercrime and its prevention
is given focus and considering the procedures involved for
international cooperation, law enforcement authorities specifically
the computer or technology crime divisions or units responsible for
the investigation of cybercrimes are required to submit timely and
regular reports including pre-operation, post-operation and
investigation results and such other documents as may be required
to the Department of Justice (DOJ) for review and monitoring.
SEC. 12. Real-Time Collection of Traffic
Data
Law enforcement authorities, with due cause, shall be authorized to collect or
record by technical or electronic means traffic data in real-time associated with
specified communications transmitted by means of a computer system.
Traffic data refer only to the communication’s origin, destination, route, time,
date, size, duration, or type of underlying service, but not content, nor
identities.
All other data to be collected or seized or disclosed will require a court warrant.
Service providers are required to cooperate and assist law enforcement
authorities in the collection or recording of the above-stated information.
SEC. 12. Real-Time Collection of Traffic
Data
The court warrant required under this section shall only be issued or
granted upon written application and the examination under oath or
affirmation of the applicant and the witnesses he may produce and
the showing: (1) that there are reasonable grounds to believe that
any of the crimes enumerated hereinabove has been committed, or
is being committed, or is about to be committed: (2) that there are
reasonable grounds to believe that evidence that will be obtained is
essential to the conviction of any person for, or to the solution of, or
to the prevention of, any such crimes; and (3) that there are no other
means readily available for obtaining such evidence.
SEC. 13. Preservation of Computer Data
The integrity of traffic data and subscriber information relating to
communication services provided by a service provider shall be
preserved for a minimum period of six (6) months from the date of
the transaction. Content data shall be similarly preserved for six (6)
months from the date of receipt of the order from law enforcement
authorities requiring its preservation.
SEC. 13. Preservation of Computer Data
Law enforcement authorities may order a one-time extension for
another six (6) months: Provided, That once computer data
preserved, transmitted or stored by a service provider is used as
evidence in a case, the mere furnishing to such service provider of
the transmittal document to the Office of the Prosecutor shall be
deemed a notification to preserve the computer data until the
termination of the case.
The service provider ordered to preserve computer data shall keep
confidential the order and its compliance.
Service Provider
(1) Any public or private entity that provides to users of its service the
ability to communicate by means of a computer system; and
(2) Any other entity that processes or stores computer data on behalf
of such communication service or users of such service.
Traffic data or non-content data
Refers to any computer data other than the content of the
communication including, but not limited to, the communication’s
origin, destination, route, time, date, size, duration, or type of
underlying service.
Subscriber’s information
Refers to any information contained in the form of computer data or any other
form that is held by a service provider, relating to subscribers of its services other
than traffic or content data and by which identity can be established:
(1) The type of communication service used, the technical provisions taken
thereto and the period of service;
(2) The subscriber’s identity, postal or geographic address, telephone and
other access numbers, any assigned network address, billing and payment
information, available on the basis of the service agreement or arrangement;
and
(3) Any other available information on the site of the installation of
communication equipment, available on the basis of the service agreement
or arrangement.
SEC. 14. Disclosure of Computer Data
Law enforcement authorities, upon securing a court warrant, shall
issue an order requiring any person or service provider to disclose or
submit subscriber’s information, traffic data or relevant data in
his/its possession or control within seventy-two (72) hours from
receipt of the order in relation to a valid complaint officially docketed
and assigned for investigation and the disclosure is necessary and
relevant for the purpose of investigation.
SEC. 15. Search, Seizure and Examination
of Computer Data
Where a search and seizure warrant is properly issued, the law enforcement authorities shall
likewise have the following powers and duties.
Within the time period specified in the warrant, to conduct interception, as defined in this Act,
and:
(a) To secure a computer system or a computer data storage medium;
(b) To make and retain a copy of those computer data secured;
(c) To maintain the integrity of the relevant stored computer data;
(d) To conduct forensic analysis or examination of the computer data storage medium; and
(e) To render inaccessible or remove those computer data in the accessed computer or
computer and communications network.
SEC. 15. Search, Seizure and Examination
of Computer Data
Pursuant thereof, the law enforcement authorities may order any
person who has knowledge about the functioning of the computer
system and the measures to protect and preserve the computer data
therein to provide, as is reasonable, the necessary information, to
enable the undertaking of the search, seizure and examination.
Law enforcement authorities may request for an extension of time to
complete the examination of the computer data storage medium and
to make a return thereon but in no case for a period longer than
thirty (30) days from date of approval by the court.
SEC. 16. Custody of Computer Data
All computer data, including content and traffic data, examined
under a proper warrant shall, within forty-eight (48) hours after the
expiration of the period fixed therein, be deposited with the court in
a sealed package, and shall be accompanied by an affidavit of the
law enforcement authority executing it stating the dates and times
covered by the examination, and the law enforcement authority who
may access the deposit, among other relevant data.
SEC. 16. Custody of Computer Data
The law enforcement authority shall also certify that no duplicates or
copies of the whole or any part thereof have been made, or if made,
that all such duplicates or copies are included in the package
deposited with the court. The package so deposited shall not be
opened, or the recordings replayed, or used in evidence, or then
contents revealed, except upon order of the court, which shall not be
granted except upon motion, with due notice and opportunity to be
heard to the person or persons whose conversation or
communications have been recorded.
SEC. 17. Destruction of Computer Data
Upon expiration of the periods as provided in Sections 13 and 15,
service providers and law enforcement authorities, as the case may
be, shall immediately and completely destroy the computer data
subject of a preservation and examination.
Chapter 8
EXTENT OR LIABILITY OF ICT PROFESSIONALS AND OTHER
COMPUTER RELATED LAWS
Introduction
Nowadays, it is too difficult to carry with us a huge amount of money
thus many businessmen are carrying with them credit cards and/or
check instead of cash. Although credit cards and checks are not legal
tender, they are widely used and accepted in the business
community as a substitute for cash.
Legal tender is a form of money that courts of law are required to
recognize as satisfactory payment for any monetary debt.
Republic Act No. 8484
Access Devices Regulation Act of 1998
AN ACT REGULATING THE ISSUANCE AND USE OF ACCESS DEVICES, PROHIBITING
FRAUDULENT ACTS COMMITTED RELATIVE THERETO, PROVIDING PENALTIES
AND FOR OTHER PURPOSES
Access Device – means any card, plate, code, account number, electronic serial
number, personal identification number, or other telecommunications service,
equipment, or instrumental identifier, or other means of account access that can
be used to obtain money, good, services, or any other thing of value or to initiate
a transfer of funds (other than a transfer originated solely by paper instrument);
Credit Card – means any card, plate, coupon book, or other credit device existing
for the purpose of obtaining money, goods, property, labor or services or any
thing of value on credit;
What should you do if you lose your
credit card or other access device?
In case of loss of an access device, the holder must notify the issuer
of the access device of the details and circumstances of such loss
upon knowledge of the loss.
This notification is very important to avoid frauds committed through
identity thefts.
Section 9. Prohibited Acts (RA 8484)
The following acts shall constitute access device fraud and are
hereby declared to be unlawful:
(a) producing, using, trafficking in one or more counterfeit access
devices;
(b) trafficking in one or more unauthorized access devices or
access devices fraudulently applied for;
(c) using, with intent to defraud, an unauthorized access device;
Section 9. Prohibited Acts
(d) using an access device fraudulently applied for;
(e) possessing one or more counterfeit access devices or access devices
fraudulently applied for;
(f) producing, trafficking in, having control or custody of, or possessing
device-making or altering equipment without being in the business or
employment, which lawfully deals with the manufacture, issuance, or
distribution of such equipment;
(g) inducing, enticing, permitting or in any manner allowing another, for
consideration or otherwise to produce, use, traffic in counterfeit access
devices, unauthorized access devices or access devices fraudulently
applied for;
Section 9. Prohibited Acts
h) multiple imprinting on more than one transaction record,
sales slip or similar document, thereby making it appear that
the device holder has entered into a transaction other than
those which said device holder had lawfully contracted for, or
submitting, without being an affiliated merchant, an order to
collect from the issuer of the access device, such extra sales
slip through an affiliated merchant who connives therewith, or,
under false pretenses of being an affiliated merchant, present
for collection such sales slips, and similar documents;
Section 9. Prohibited Acts
(i) disclosing any information imprinted on the access device, such as, but
not limited to, the account number or name or address of the device
holder, without the latter's authority or permission;
(j) obtaining money or anything of value through the use of an access
device, with intent to defraud or with intent to gain and fleeing thereafter;
(k) having in one's possession, without authority from the owner of the
access device or the access device company, an access device, or any
material, such as slips, carbon paper, or any other medium, on which the
access device is written, printed, embossed, or otherwise indicated;
Section 9. Prohibited Acts
(l) writing or causing to be written on sales slips, approval numbers from
the issuer of the access device of the fact of approval, where in fact no
such approval was given, or where, if given, what is written is deliberately
different from the approval actually given;
(m) making any alteration, without the access device holder's authority, of
any amount or other information written on the sales slip;
(n) effecting transaction, with one or more access devices issued to
another person or persons, to receive payment or any other thing of value;
Section 9. Prohibited Acts
(o) without the authorization of the issuer of the access device, soliciting a
person for the purpose of:
1) offering an access device; or
2) selling information regarding or an application to obtain an access
device; or
(p) without the authorization of the credit card system member or its agent,
causing or arranging for another person to present to the member or its
agent, for payment, one or more evidence or records of transactions made
by credit card.
Legal Tender
Legal tender is officially defined as the coins or banknotes that must be accepted if offered in
payment of a debt.
Legal tender is the currency which the debtor can compel the creditor to accept in payment of a
debt when tendered for the right amount. While coins issued by BSP shall be fully guaranteed by the
government and shall be legal tender for all debts, both public and private, they have legal tender
power only for the following amounts:
• One peso coins and coins of higher peso value are legal tender for obligations not exceeding
P 1,000.
• Twenty-five cents and coins of lower value are legal tender for obligations not exceeding P
100 (BSP Circular 537 series of 2006)
What about notes? Is there limitation on their legal tender power? None. Notes, regardless of
denomination, are legal tender for any amount of obligation. So, you want to get even with your
creditor? Well, consider paying in coins and notes of various denominations and let your debtor count
in your presence.
Mandarin Villa, Inc. vs. CA and Clodualdo de Jesus
G.R. No. 119850. 20 June 1996.
Facts:
In the evening of 19 Oct 1989, private respondent de Jesus hosted a dinner for his
friends at the peririoner’s restaurant, the Mandarin Villa Seafoods Village in
Mandaluyong City. After dinner, the waiter handed to de Jesus the bill amounting to
P2,658.50. De Jesus offered his BANKARD credit card to the waiter for payment.
Minutes later, the waiter returned and audibly informed that said credit card had
expired. De Jesus demonstrated that the card had yet to expire on Sept 1990, as
embossed on its face. De Jesus approached the cashier who again dishonored such
card. De Jesus offered his BPI express credit card instead and this was accepted,
honored and verified. The trial court and CA held petitioner to be negligent.
Issues: WON petitioner was negligent; If negligent, WON such negligence was the
proximate cause of private respondent’s damage.
Extent of Liability in the Context of
ForeignLaws
Types of Legal Liability
Ordinary Neligence
Malpractice
Strict Liability
Liability of Programmer and/or Developer
in the Context of Philippine Law
Article 1467 of the Civil Code
Art. 1467. A contract for the delivery at a certain price of an article
which the vendor in the ordinary course of his business
manufactures or procures for the general market, whether the same
is on hand at the time or not, is a contract of sale, but if the goods
are to be manufactured specially for the customer and upon his
special order, and not for the general market, it is a contract for a
piece of work. (n)
Analyzing Art. 1467
Manufacturing or developing in the ordinary course of business.
This covers contract of sale.
Manufacturing or developing upon special order of customers. This
covers contract for piece of work.
Matrix for contract for a piece of work
and contract of sale
Contract for Piece of Work Contract of Sale
The thing transferred is one not in The thing transferred is one which
existence and which never would have would have existed and would have
existed but for the order of the party been the subject of sale to some other
desiring to acquire it. person, even if the order had not been
given
The essence of contract is the “SALE The essence of contract is the “SALE
OF SERVICE.” OF AN OBJECT.”
Not within the statute of Frauds Governed by the statute of Frauds
Overview of Statute of Fraud
The general rule is this: a contract need not be in writing to be
enforceable.
An oral agreement to pay a high-fashion model $2 million to pose for
photographs is as binding as if the language of the deal were printed
on vellum and signed in the presence of twenty bishops.
For three centuries, however, a large exception grew up around the
Statute of Frauds, first enacted in England in 1677 under the formal
name “An Act for the Prevention of Frauds and Perjuries.” The
Statute of Frauds requires that some contracts be evidenced by a
writing, signed by the party to be bound.
SECTION 3. - Contract for a Piece of
Work
Civil Code
Art. 1713. By the contract for a piece of work the contractor binds himself to
execute a piece of work for the employer, in consideration of a certain price or
compensation. The contractor may either employ only his labor or skill, or also
furnish the material.
Art. 1715. The contract shall execute the work in such a manner that it has the
qualities agreed upon and has no defects which destroy or lessen its value or
fitness for its ordinary or stipulated use. Should the work be not of such quality,
the employer may require that the contractor remove the defect or execute
another work. If the contract fails or refuses to comply with this obligation, the
employer may have the defect removed or another work executed, at the
contractor's cost.
SECTION 3. - Contract for a Piece of
Work
Art. 1719. Acceptance of the work by the employer relieves the
contractor of liability for any defect in the work, unless:
(1) The defect is hidden and the employer is not, by his special
knowledge, expected to recognize the same; or
(2) The employer expressly reserves his rights against the contractor
by reason of the defect. (n)
The E-Commerce Law
Six weeks after the “I LOVE YOU” virus, the government has
outlawed some computer crimes through the E-Commerce Law
signed into law on June 14, 2000.
It was a landmark legislation as it was the country’s response to the
changes brought about by the information age.
E-Commerce Acts aims to facilitate domestic and international
dealings, transaction, arrangements, contract and exchanges
including storage of information through the utilization of electronic,
optical and similar medium, mode instrumentality and technology
Important Concern in E-Commerce
The general security concerns in e-commerce involve the following:
User authorization
Data and transaction security
To ensure user privacy and information security in an open network like the
Internet
Password
Encrypted smart cards
Biometric
Firewalls
Important Concern in E-Commerce
Data transactions security scheme
Secret-key encryption/ Symmetric key encryption
Public/private-key encryption/ Asymmetric key encryption
Basic requirements of secured transaction
Transaction Privacy
Transaction Confidentiality
Transaction Integrity
Important Concern in E-Commerce
Encryption is a set of secret code which defends sensitive information
that crosses over public channels. It is mutation of information in any
form into a form decipherable only with a decryption key.
Important Concern in E-Commerce
Important Concern in E-Commerce
Digital signature is a cryptographic mechanism the counterpart of
writing signature on a paper-based transaction.
Its basic function is to verify the origin and contents of a message
for sender authentication purposes.
It allows the computer to notarize the message to assure the
intended recipient that the message has not been forge while it
traverse the network.
Digital Certificate
Digital certificates function similarly to identification cards such as passports and
drivers’ licenses. Digital certificates are issued by recognised authorities. When
someone requests a certificate, the authority verifies the identity of the
requester, certifies that the requester meets all requirements to receive the
certificate, and then issues it. When a digital certificate is presented to others,
they can verify the identity of its owner because the certificate provides the
following security benefits:
• It contains personal information to help identify and trace the owner.
• It contains the information that is required to identify and contact the
issuing authority.
• It is designed to be tamper-resistant and difficult to counterfeit.
Digital Certificate and Digital Signature
The difference between a digital signature and digital certificate
is that a certificate binds a digital signature to an entity,
whereas a digital signature is to ensure that a data/information
remain secure from the point it was issued.
In other words: digital certificates are used to verify the
trustworthiness of a person (sender), while digital signatures
are used to verify the trustworthiness of the data being sent.
Data Privacy