Policy, objectives, and intended outcomes
- The government policy is to provide greater convenience for persons transacting business with government.
- The government policy is to enhance the integrity and reliability of government-issued identification cards by streamlining and harmonizing government identification systems (Section 2).
- The Unified Multi-Purpose Identification System is guided by the objectives to:
- reduce costs and lessen the financial burden from multiple ID cards and redundant databases (Section 3);
- ensure greater convenience for those transacting with government and availing government services (Section 3);
- facilitate private businesses and promote the wider use of the unified ID card (Section 3);
- enhance the integrity and reliability of government-issued ID cards (Section 3); and
- facilitate access to and delivery of quality and effective government service (Section 3).
Coverage and participating institutions
- The Rules cover all government agencies and government-owned or controlled corporations issuing, or to be issuing, ID cards to members or constituents (Section 4).
- The Director-General of NEDA is responsible for coordinating and facilitating implementation of the Rules (Section 4).
- The Unified Multi-Purpose ID System primarily covers all government employees and program members, and may also include other individuals who voluntarily register (Section 6).
- Participating agencies include all government agencies and GOCCs covered by Executive Order No. 420, and other government institutions or instrumentalities (including LGUs) may register and participate at their option (Section 5t).
- Participating agencies are categorized as Registration Agencies/Centers, Card Issuing Agencies, CVEA (Central Verification and Enrollment Agency), and BDMCs (Biometrics Data Matching Centers) (Section 5t(1)-(4)).
Key definitions and system elements
- The Unified Multi-Purpose Identification System uses a Common Reference Number (CRN) as the unique lifetime identifier for an individual (Section 7, Section 10).
- The CRN Registry is the database containing records of individuals enrolled and assigned a CRN (Section 7).
- The unified multi-purpose ID card is the secure medium that contains the CRN and can be presented to prove identity (Section 7).
- Biometrics refers to verifying a person’s identity based on unique physiological and/or behavioral characteristics, covering fingerprints and the handwritten signature (Section 5b).
- AFIS (Automated Fingerprint Identification System) is a biometric methodology that uses digital technology to obtain, store, and analyze fingerprint data (Section 5a).
- Data is the set of 15 data items enumerated in Executive Order No. 420; under the Rules, these are categorized as:
- Basic data (5 items): name, place of birth, date of birth, name of parents, and sex (Section 5g(1));
- Biometrics Data (3 items): photograph, signature, and two index fingerprints (Section 5g(2)); and
- Other Data (7 items): home address, marital status, height, weight, two thumb marks, any prominent distinguishing features, and Tax Identification Number (TIN) (Section 5g(3)).
- CRN Registry is maintained by the CVEA and contains identification records of all individuals successfully enrolled (Section 5f, Section 5t(3)).
- Enrollee means an individual whose data is stored in the CRN Registry (Section 5i).
- Enrollment is the process of verifying registration data (personal data and biometrics) and storing such data into the CRN Registry (Section 5j).
System governance, task forces, and responsibilities
- The National Task Force (NTF) coordinates and ensures effective implementation of Executive Order No. 420 and the Rules (Section 9).
- The National Technical Working Group (N-TWG) provides technical advice and assistance to the NTF and is chaired by the National Statistics Office (NSO) (Section 9).
- A Special Working Group (SWG) for Back-End Operations is created and is chaired by the Commissioner and Director-General of the National Computer Center (Section 9).
- A Special Working Group (SWG) for Communications is created and is chaired by the Vice President for Public Relations of the Social Security System, with an alternate member to the SSS President as NTF member (Section 9).
- Overall secretariat support is provided by NEDA and the NSO, with assistance from participating agencies (Section 9).
- The NEDA Director-General may create other special working groups as needed (Section 9).
Unified ID card rules and identifiers
- The Unified Multi-Purpose ID System includes:
- the CRN,
- the CRN Registry, and
- the unified multi-purpose ID card (Section 7).
- Absence of the unified multi-purpose ID card and/or the CRN is never a ground for denying any government service to an individual (Section 8).
- The CRN is generated and assigned by the CVEA upon successful enrollment into the CRN Registry (Section 10).
- The CRN is a person’s unique identifier during his or her lifetime (Section 10).
- The CRN is permanent and shall not be reused or reassigned to another individual (Section 11).
Card design, contents, and exemptions
- The unified multi-purpose ID card follows ISO 7810 dimensions of approximately 86 mm x 54 mm (Section 12a).
- The card has a functional card life of at least 10 years (Section 12b).
- A card owner may request a new or replacement card after proper justification, such as a change of address (Section 12b).
- The NTF, upon recommendation of the N-TWG, prescribes the card design 60 days after effectivity (Section 13).
- The card carries the CRN, basic data, and control information (Section 14).
- The basic data on the card is limited to:
- name,
- sex,
- photograph,
- signature,
- date of birth,
- images of the two index fingers, and
- home address (Section 14).
- Control information may include:
- card serial number,
- issuing agency name and official logo,
- date of issuance,
- expiration date, and
- instructions for return of the card in case it is lost (Section 14).
- Certain ID cards do not need replacement with the unified multi-purpose ID card, specifically:
- professional ID cards issued by PRC and other regulatory bodies, and
- drivers’ licenses issued by the LTO; and
- ID cards issued in conformity with international statutes or treaties where the Philippines is a signatory (including Philippine passport issued by the DFA and seafarer’s ID) (Section 15).
- Holders of exempt licenses/ID cards must still undergo enrollment; if qualified and not yet issued a CRN, they are issued one, and their CRN becomes part of their ID records and is incorporated in their licenses or ID cards (Section 15).
Registration, verification, enrollment, and issuance
- Registration data collection occurs through either:
- Track 1: use of existing records stored with participating and/or registration agencies, subject to validation/verification of biometrics and the individual’s consent through an expressed or signed written waiver or consent; or
- Track 2: new registration, where individuals with no existing records file required forms and have biometrics captured at a Registration Agency or Center, with the registration record validated/verified and supported by an executed waiver or consent forming part of the enrollment form (Section 16).
- Prior to enrollment, an applicant’s biometrics are verified and validated with the BDMC, and basic data (including birth records) are verified/validated with the CVEA, and these validation/verification occur only with the applicant’s written or expressed consent through a waiver statement forming part of the enrollment form (Section 17).
- Successful validation/verification causes:
- generation and assignment of the CRN and
- inclusion of the person’s registration data into the CRN Registry (Section 17).
- Unsuccessful enrollment is handled as exception cases under Rule X (Section 17).
- After verification results are obtained, they are forwarded to the Registration Agency and then to the Card Issuing Agency, which produces unified multi-purpose ID cards and issues them to the owners (Section 18).
- Fees for ID cards (new or replacement) are governed by the card-issuing agency’s pertinent issuance policies (Section 19).
Implementation phases and timing
- Implementation proceeds in three (3) phases:
- Phase 1: laying the groundwork,
- Phase 2: start of issuing Transition ID Cards and unified multi-purpose ID cards, and
- Phase 3: full implementation (Section 20).
- Phase 1 runs within the first 60 days after effectivity; participating agencies adopt CRN into their systems and registration forms and card formats/content, while the CVEA sets up the CRN Registry and defines electronic linkages (Section 21).
- In Phase 1, the NTF finalizes unified multi-purpose ID card design and prescribes specific procedures for registration, validation/verification of data, and generation/assignment of CRN to successfully enrolled individuals (Section 21).
- Phase 2 runs from the 61st day up to within one year after effectivity; participating agencies issue Transition ID Cards and unified multi-purpose ID cards for new/replacement cards (Section 22).
- During Phase 2, participating agencies adopt the CRN as a secondary or primary number in agency transactions, adopt the multi-purpose ID card as a valid ID for establishing identity, and—if the owner consents—use the CRN for online verification and online cross-checking/validation with the CRN Registry (Section 22).
- Phase 3 commences one year after effectivity; card issuing agencies issue unified multi-purpose ID cards only for new or replacement cards, and the CRN becomes the primary identifier in transactions with government or private businesses and in availing services from government agencies (Section 23).
CRN Registry rules, custody, access, retention
- The CRN Registry stores only the 15 data items in Executive Order No. 420 for each enrolled individual, plus the CRN and integrity-control fields needed to ensure record integrity and detect intrusions or modifications (Section 24).
- Integrity-control fields include:
- the date the record was first created, and
- records of modification/update dates/times and the specific modifications/changes made (Section 24).
- Control fields must not include other data or cross references to records or data of the individual in other agencies (Section 24).
- The NSO is custodian of the CRN Registry and must protect all records from unauthorized access, modification, destruction, or disclosure, except in cases of force majeure (Section 25).
- The NSO must maintain both on-site and off-site backup copies of all CRN Registry records (Section 25).
- As CVEA, the NSO is responsible for establishing, operating, and managing the CRN Registry, including setting up a data center and providing physical security (Section 26).
- The CVEA defines, in consultation with participating agencies, the access and control mechanisms including updating protocols and procedures to ensure security and integrity (Section 27).
- Data for an enrollee is archived and removed from the active CRN Registry five years after sufficient evidence of death is presented.
- If death is not reported, removal occurs after a number of years equivalent to the maximum expected lifespan of an individual plus a margin of 30 years has elapsed (Section 28).
Exceptions, security breaches, and fraud response
- The NTF prescribes measures to address failure to assign a CRN due to:
- absence of a birth certificate or multiple birth documents,
- discrepancies between registration and birth certificate data,
- fingerprints already in the database,
- multiple registration attempts,
- inability to capture required biometric samples (index finger sample, signature, or both), and
- identity thefts (Section 29).
- The NTF also prescribes procedures for handling security breaches, tampered/lost/malfunctioning cards, and attempts to misrepresent or willfully use the CRN or the unified multi-purpose ID card for fraudulent or illegal purposes (Section 30).
Confidentiality, privacy safeguards, and access limits
- Personnel of participating agencies are strictly prohibited from unauthorized disclosure or sharing of any information or data of persons applying for or enrolled under the system, unless required by law or by a Court order (Section 31).
- Authorization from the owner is required for access to and disclosure of any CRN Registry data or information about the individual (Section 32).
- Access levels limiting disclosure to participating agencies and security procedures for the CRN Facility are defined by the NTF (Section 32).
- Data inquiries from the CRN Registry must be responded to in the affirmative or negative only, without specific data about the individual, without additional consent of the owner (Section 33).
- Only queries with the owner’s consent result in release or disclosure of CRN Registry information (Section 33).
- The NTF may define additional confidentiality and security standards and procedures for participating agencies upon recommendation of the N-TWG (Section 34).
Information, education, and communications (IEC)
- A continuing IEC program is formulated and implemented to inform and educate the public on the benefits of the unified multi-purpose ID system, especially in availing government services (Section 35).
- The IEC program covers all government agencies, GOCCs, and other government institutions and instrumentalities, including LGUs, to ensure support and cooperation (Section 35).
- The IEC program encourages the private sector to adopt and recognize the unified multi-purpose ID card and/or the CRN (Section 35).
- The SWG for Communications oversees implementation of the IEC program (Section 35).
Funding and allocation
- Funds may be recommended by the DBM to carry out the objectives of the Rules (Section 36).
- Participating agencies are enjoined, to the extent they are able, to allocate from existing appropriations or funds the amounts necessary to help defray implementation costs, subject to internal policies and accounting rules and regulations (Section 36).
Transitory and validity rules
- Participating card-issuing agencies may issue either Transition ID cards or unified multi-purpose ID cards for new and replacement cards.
- After one (1) year from effectivity, only unified multi-purpose ID cards may be issued (Section 37).
- Agency ID Cards and Transition ID Cards already issued remain valid and honored in transactions with government agencies until their expiry dates as prescribed by the card-issuing agencies (Section 38).
Amendments, reporting, repeal, separability
- Amendments to the Rules may be issued from time to time or as required or necessary (Section 39).
- The NTF monitors implementation status and compliance and submits periodic reports to the President through the Office of the Executive Secretary (Section 40).
- Any order, circular, memorandum, rule, or regulation, or parts thereof, inconsistent with the Rules is repealed or amended accordingly (Section 41).
- If any section or its application is declared invalid or unconstitutional, unaffected sections remain valid and in effect (Section 42).