Subscriber Identity Module (SIM) Registration Act

Case Overview and Summary

Summary of the Subscriber Identity Module (SIM) Registration Act

Declaration of Policy (Section 2):
- Recognizes the vital role of information and communications technology in nation-building.
- Aims to provide law enforcement tools to resolve crimes involving SIM use and deter wrongdoings.
- Requires registration of SIMs for electronic devices by all users.

Definitions (Section 3):
- End-user: Subscriber or entity purchasing a SIM.
- Postpaid subscription: Service provided with prior arrangement and billed monthly.
- Prepaid subscription: Credit purchased in advance for service use.
- Public Telecommunications Entity (PTE): Entity providing telecommunications services.
- Reseller: Person or entity selling SIMs to end-users.
- SIM: Circuit storing subscriber identity for mobile devices.
- Spoofing: Transmitting misleading information about call/text source with intent to defraud.

SIM Registration (Section 4):
- All end-users must register SIMs with PTEs before activation.
- SIMs sold by PTEs, agents, or resellers must be deactivated until registered.
- Existing SIM subscribers must register within 180 days, extendable by 120 days.
- Failure to register will result in automatic deactivation.
- PTEs must include data of existing postpaid subscribers in the SIM Register.

Registration Guidelines (Section 5):
- Submit control-numbered registration form with personal details.
- Present valid government-issued ID with photo.
- Input assigned mobile number and SIM serial number.
- Minors must register under parent/guardian's name with consent.
- Foreign nationals must provide passport, address, and other documents.
- SIMs registered by tourists valid for 30 days only.
- PTEs must facilitate registration in remote areas within 60 days.
- Registration must be free of cost for end-users.

SIM Register (Section 6):
- PTEs must maintain a database (SIM Register) for processing SIM activation/deactivation.
- End-user data must be secured and protected per DICT standards.
- DICT to perform annual audit on PTEs' compliance with security standards.
- End-users must report changes, loss, death, or deactivation request.
- PTEs must deactivate SIM within 24 hours of such reports.
- Data retained for 10 years after deactivation.
- Cyber-attacks on SIM Register must be reported to DICT within 24 hours.
- PTEs must provide mechanisms for reporting fraudulent texts/calls.

Subsequent Sale of Registered SIM (Section 7):
- Registered SIMs cannot be sold or transferred without re-registration.

Sale of Stolen SIMs (Section 8):
- PTEs, agents, or resellers engaging in sale of stolen SIMs are criminally liable.

Confidentiality and Disclosure (Sections 9-10):
- Registration data is confidential and cannot be disclosed, except:
- As required by law or court order.
- For investigation based on sworn complaint of crime/unlawful act.
- With subscriber's written consent.
- PTEs not liable for disclosures made in compliance with the Act.
- Data kept for 10 years after deactivation for disclosure purposes.

Penalties (Section 11):
- Failure to register SIM: Fines from P100,000 to P1,000,000 for PTEs.
- Breach of confidentiality: Fine of P500,000 to P4,000,000 for PTEs/agents.
- Providing false information or using fictitious identities: 6 months to 2 years imprisonment or P100,000 to P300,000 fine, or both.
- Spoofing: At least 6 years imprisonment or P200,000 fine, or both.
- Sale of stolen SIM: 6 months to 2 years imprisonment or P100,000 to P300,000 fine, or both.
- Sale/transfer of registered SIM without re-registration: 6 months to 6 years imprisonment or P100,000 to P300,000 fine, or both.

Implementing Rules and Regulations (Section 12):
- NTC to set guidelines and issue IRR within 60 days, in coordination with DICT, DTI, NPC, PTEs, and consumer groups.
- PTEs must submit annual reports to NTC, DICT, and Congress.

Transitory Provision (Section 13):
- Upon effectivity, PTEs must deactivate all prepaid SIMs for sale, or face penalties.

Interpretation (Section 14):
- Doubts to be construed with highest respect for privacy and mindful of subscribers' rights and interests.