Policy, purpose, and core aims
- The State’s policy is to establish a single national identification system called the “Philippine Identification System” or “PhylSys” for all citizens and resident aliens to enable seamless delivery of services and improve efficiency, transparency, and targeted delivery of public and social services (Section 2).
- The system must enhance administrative governance, reduce corruption, curtail bureaucratic red tape, avert fraudulent transactions and misrepresentations, strengthen financial inclusion, and promote ease of doing business (Section 2).
- A resilient digital system must be deployed to secure data collected and uphold the people’s right to privacy, confidentiality, and other basic rights at all times (Section 2).
- The PhilSys primarily provides a valid proof of identity for all citizens and resident aliens by simplifying public and private transactions and using biometric identification system authentication (Section 3).
- The PhilSys also serves as a social and economic platform linking transactions for public and private services and improving seamless service delivery, governance, corruption reduction, financial inclusion, and ease of doing business (Section 3).
Coverage and legal reach
- The Act applies to all natural persons in all transactions where the PhilSys Number (PSN), Philippine Identification (PhilID), or biometric information is required, presented, or used, whether legally or illegally, within or outside the Republic of the Philippines (Section 4).
- The Act establishes that an individual’s record in the PhilSys is an official and sufficient proof of identity (Section 6).
- The Act governs how the PSN and PhilID are used for proof of identity and authentication in transactions with government agencies and private entities (Sections 12–13).
- The Act covers registration of citizens and resident aliens through designated registration centers and special arrangements (Section 9).
Definitions established by law
- “Authentication” is the process of verifying, online or offline, an individual’s identity against registry information in the PhilSys or PhilID (Section 5(a)).
- “Biometric exceptions” are instances where a citizen or resident alien cannot give a complete set of biometrics required by PhilSys but is still admitted into the PhilSys (Section 5(b)).
- “Biometric information” includes front facing photograph, fingerprint, iris scan, and/or other identifiable features (Section 5(c)).
- “Cardholder” is a citizen or resident alien registered under the PhilSys who has been issued and is in possession of the Philippine Identification Card (Section 5(d)).
- “Citizen” is a Filipino citizen as defined in the Constitution, including dual or multiple citizens in accordance with Republic Act No. 9225 (Section 5(e)).
- “Mobile Registration” refers to transportable registration centers (Section 5(f)).
- “Personal information” is any information recorded or not, from which identity is apparent or reasonably and directly ascertained, or that can identify an individual when combined with other information, as defined in Republic Act No. 10173 (Section 5(g)).
- “Philippine Embassy or Philippine Foreign Service post” includes diplomatic missions or consular offices, including economic and cultural offices, and similar missions in foreign territories (Section 5(h)).
- “Record history” includes specific entries in the PhilSys such as filing dates and particulars, modifications and reasons for omission, PhilID issuance/reissuance/cancellation details and reasons, details of authentication requests processed by PSA, disclosure/transfer/use by third parties, and other relevant registration, modification, and authentication information (Section 5(i)).
- “Registered information” covers personal information about registered persons recorded in the PhilSys, including biometric information and information required to be recorded (Section 5(j)).
- “Registered person” is a person registered under the PhilSys (Section 5(k)).
- “Registration” is the process of entering demographic and biometric information of citizens or resident aliens in the Philippines into the system (Section 5(l)).
- “Registration centers” are facilities to capture required demographic and biometric information enumerated under Section 9 (Section 5(m)).
- “Resident alien” is a non-citizen who has established residence in the Philippines for an aggregate period of more than one hundred eighty (180) days (Section 5(n)).
PhilSys structure and PhilID features
- The PhilSys is the government’s central identification platform for citizens and resident aliens, and a person’s record in the PhilSys is official and sufficient proof of identity (Section 6).
- The PhilSys has key components: PhilSys Number (PSN), the PhilSys Registry, and the PhilID (Section 7).
PhilSys Number (PSN)
- The PSN is randomly generated, unique, and permanent and is assigned to every citizen or resident alien upon birth or registration by the PSA (Section 7(a)).
- Government agencies, including GOCCs, must incorporate the PSN into their identification systems and databases and must treat it as the standard number across all agencies for covered individuals (Section 7(a)).
- The PSN, in print, electronic, or any other form, subject to authentication, is accepted as sufficient proof of identity (Section 7(a)).
PhilSys Registry
- The PSA creates and maintains a PhilSys Registry as repository and custodian containing the PSN, registered records, and information of all persons registered under the PhilSys (Section 7(b)).
- Registry information must be classified to enable safeguards for data privacy and security, access controls, and change management (Section 7(b)).
PhilID card and optional mobile PhilID
- A nontransferable card (PhilID) is preferably issued to all citizens and resident aliens registered under the PhilSys, subject to PSA guidelines (Section 7(c)).
- The PhilID contains, on its face, the PSN, full name, sex, blood type, marital status (optional), place of birth, front facing photograph, date of birth, and address of the individual (Section 7(c)(1)).
- The information on the PhilID must match the registered information in the PhilSys (Section 7(c)(1)).
- The PhilID must contain a QR Code containing some fingerprint information and must include other security features as safeguards for data privacy and security and to prevent proliferation of fraudulent or falsified identification cards (Section 7(c)(1)).
- The PSA may provide citizens or resident aliens with a mobile PhilID, considering advances in technology, utility, security, and confidentiality, subject to PSA guidelines (Section 7(c)(1)).
- The PhilID serves as the official government-issued identification document of cardholders in dealings with national government agencies, LGUs, GOCCs, GFIs, and all private sector entities, subject to PSA guidelines and authentication (Section 7(c)(2)).
PhilID fees
- The initial application and issuance, and renewal of the PhilID for citizens, must be free of charge (Section 7(c)(3)).
- A standard fee is collected by the issuing agency from resident aliens and on reissuance of a replacement card, with PSA authority to identify instances where fees for replacement cards may be waived (Section 7(c)(3)).
Data to be collected and stored
- The PhilSys Registry data is limited to specified demographic data and biometrics information (Section 8).
Demographic data
- The demographic data includes: full name, sex, date of birth, place of birth, blood type, address, whether Filipino or Resident Alien, marital status (optional), mobile number (optional), and e-mail address (optional) (Section 8(a)).
Biometrics
- The biometrics information includes: front facing photograph, full set of fingerprints, iris scan, and if necessary other identifiable features as determined in the implementing rules and regulation (IRR) (Section 8(b)).
- When physical or visual impairment makes capturing required biometrics impossible, biometric exceptions must be employed and allowed by the PSA (Section 8).
- The PSA must issue guidelines for the appropriate age for capturing biometrics of minors (Section 8).
Registration procedures and documentation
- Registration must be conducted one (1) year after the effectivity of the Act (Section 9).
- Every citizen or resident alien must register personally with registration centers having necessary facilities to capture information required for the Registry (Section 9).
- Registration centers include: PSA Regional and Provincial Offices, Local Civil Registry Offices (LCROs), GSIS, SSS, PhilHealth, HDMF, COMELEC, PHLPost, and other agencies and GOCCs assigned by the PSA (Section 9(a)-(i)).
- Filipino citizens residing abroad must register in the nearest Philippine Embassy or Philippine Foreign Service post, or in other designated registration centers by the Department of Foreign Affairs (DFA) in coordination with the PSA (Section 9).
- Special arrangements must be made for registration of minors, senior citizens, persons with disability, indigenous persons, and persons in institutional households (Section 9).
- The PSA must initiate mobile registrations for citizens and resident aliens in remote areas (Section 9).
- Registration is deemed successful and complete upon issuance of the PSN and confirmation of registration by the PSA (Section 9).
Basic documentary requirements
- Registration centers must require presentation of the applicant’s birth certificate as a basic documentary requirement for citizens seeking to register (Section 10).
- For resident aliens, proof of residence in the Philippines must be required (Section 10).
- Citizens and resident aliens may submit an alternative or additional documents to prove identity to ensure easier verification (Section 10).
- PSA must issue guidelines ensuring registration is not prohibitive or restrictive in a way that unduly defeats the Act’s purpose (Section 10).
Updating changed entries
- Citizens and resident aliens must update their registration information when any entries in the information collected and stored under the PhilSys change, using the manner specified by the PSA (Section 11).
Authentication and lawful use
- For proof of identity in transacting business with government agencies, presentation of the PhilID or PSN constitutes sufficient proof of identity subject to proper authentication (Section 12).
- Private entities must accept the PhilID or PSN as valid proof of identity under the same terms and conditions applicable to government transactions (Section 12).
- When authentication cannot be performed without fault on the part of the cardholder/PSN holder, the PSA must ensure the person is not disadvantaged or prejudiced (Section 12).
- The PSA performs authentication of the PSN submitted by requesting entities, in relation to the individual’s biometric or demographic information (Section 12).
- Any requesting entity must obtain the individual’s consent before collecting identity information for purposes of authentication (Section 12).
- The requesting entity must inform the individual of: (a) the nature of information that may be shared upon authentication, and (b) the uses to which the information received during authentication may be put by the requesting entity (Section 12).
- Information gathered for authentication must only be used for the purpose for which it was required (Section 12).
Use in transactions
- The PhilID must be honored and accepted, subject to authentication, in transactions requiring proof or verification of identity, including:
- applications for eligibility and access to social welfare and benefits granted by government;
- applications for services and benefits offered by GSIS, SSS, PhilHealth, HDMF, and other government agencies;
- applications for passports and driver’s license;
- tax-related transactions;
- registration and voting identification purposes;
- admission to any government hospital, health center, or similar institution;
- all other government transactions;
- applications for admission in schools, colleges, learning institutions, and universities (public or private);
- employment applications and transactions;
- opening of bank accounts and other transactions with banks and other financial institutions;
- verification of cardholder criminal records and clearances;
- other transactions, uses, or purposes defined in the IRR (Section 13).
- The PSN and biometrics authenticated through the PhilSys must be honored and accepted even without absence or non-presentation of the PhilID (Section 13).
Limitations on “proof of identity”
- Proof of identity does not constitute proof of eligibility to avail of benefits or services, which remain subject to applicable rules and regulations of the concerned government authorities/agencies (Section 14).
- Issuance of the PSN and/or PhilID does not constitute incontrovertible proof of citizenship (Section 14).
Implementing agencies and coordination
- The PSA is the primary implementing agency to carry out the Act’s provisions, including planning, management, and administration of the PhilSys, covering registration, authentication, and data governance (Section 15).
- The PSA must ensure integrity and security of the PhilSys in accordance with the Act and other applicable laws and policies (Section 15).
- The PSA must issue guidelines and undertake measures to ensure secure, reliable, and efficient authentication of PhilSys records upon request of authorized government and private entities (Section 15).
- The State must provide for installation of state-of-the-art biometric machines in relevant agencies for authentication of data and identity holders (Section 15).
- The PSA must collaborate with LGUs, other government agencies, and GOCCs to ensure registration and enrolment of all citizens and resident aliens, including ICC/IPs and those in remote localities (Section 15).
- The PhilSys is managed, maintained, and administered by the PSA with technical assistance of the Department of Information and Communications Technology (DICT) (Section 15).
- The PSA may adopt new but more effective technology for registration, authentication, and data security, taking into account the declared principles and objectives of the Act (Section 15).
- Within the PSA and directly under the Office of the National Statistician, there is a separate office headed by a Deputy National Statistician to perform functions under the Act (Section 15).
PhilSys Policy and Coordination Council (PSPCC)
- The PhilSys Policy and Coordination Council (PSPCC) formulates policies and guidelines for effective coordination and implementation of the PhilSys (Section 16).
- The PSPCC is chaired by the Secretary, NEDA, with the National Statistician and Civil Registrar General, PSA as Co-Chairperson (Section 16).
- The PSPCC includes the following members: Vice Chairperson Undersecretary, DBM, and members Undersecretary, DFA; Undersecretary, DICT; Undersecretary, DOF; Undersecretary, DSWD; Undersecretary, DILG; Chairman, National Privacy Commission; Deputy Governor, BSP; President and General Manager, GSIS; President and Chief Executive Officer, PhilHealth; President and Chief Executive Officer, SSS; Postmaster General, PHLPost (Section 16).
- The PSPCC must ensure compatibility of the technology infrastructure of different government agencies to comply with PhilSys requirements (Section 16).
Confidentiality, statistical use, and record access
- No person may disclose, collect, record, convey, disseminate, publish, or use information of registered persons in the PhilSys, give access to it, or provide copies to third parties or entities, including law enforcement agencies and the AFP, except in authorized circumstances (Section 17).
- Disclosures are allowed when the registered person has given consent specific to the authorized purpose, and the information must not be divulged by any person to any third party other than the authorized person (Section 17(a)).
- PSA must ensure PhilSys information is used only for the intended purposes under the Act (Section 17).
- Information obtained as a result of unlawful disclosure under the Act is inadmissible in any judicial, quasi-judicial, or administrative proceedings (Section 17).
- Registered persons may request PSA to provide access to their registered information and record history, subject to PSA guidelines and regulations (Section 17).
Security safeguards and aggregate statistics
- The PSA, with DICT technical assistance, must implement reasonable and appropriate organizational, technical, and physical security measures to protect PhilSys information from unauthorized access and use, disclosure, accidental or intentional loss, destruction, or damage (Section 18).
- The PSA must ensure individuals are adequately informed upon registration about how data will be used and how they can access registered information and record history (Section 18).
- Data collated by PSA may be used to generate aggregate data or statistical summaries without reference to or identification of any specific individual, while upholding confidentiality provisions under Republic Act No. 10625 (Section 18).
- The Act does not prohibit or limit sharing or transfer of personal data already authorized or required by law (Section 18).
Penal liability and sanctions
- A person or entity who, without just and sufficient cause, refuses to accept, acknowledge, and/or recognize the PhilID or PSN as the only official identification of the holder/possessor subject to authentication is fined PHP 500,000 (Section 19).
- A person who uses the PhilID or PSN unlawfully, or to commit fraudulent acts or other unlawful purposes, is punished by imprisonment of not less than six (6) months and not more than two (2) years, or a fine of not less than PHP 50,000 and not more than PHP 500,000, or both, at the discretion of the court (Section 19).
- The penalty of three (3) years to six (6) years imprisonment and a fine of PHP 1,000,000 to PHP 3,000,000 applies to offenders guilty of any of the following acts or omissions:
- willfully submitting or causing to be submitted a fictitious name or false information in the application, renewal, or updating in the PhilSys;
- unauthorized printing, preparation, or issuance of a PhilID;
- willful falsification, mutilation, alteration, or tampering of the PhilID;
- use of the PhilID/PSN or unauthorized possession of a PhilID without reasonable excuse by any person other than the one to whom it was issued, or possession of a fake, falsified, or altered PhilID; or
- willful transfer of the PhilID or PSN to any other person (Section 19).
- The penalty of six (6) years to ten (10) years imprisonment and a fine of PHP 3,000,000 to PHP 5,000,000 applies to offenders guilty of:
- collecting or using personal data in violation of Section 12;
- willfully using or disclosing data or information in violation of Section 17; or
- accessing the PhilSys or processing data or information contained therein without authority for persons not covered by the prior paragraphs (Section 19).
- If financial profit resulted from accessing, disclosing, or using data or information, the guilty person must additionally pay twice the amount gained from such act (Section 19).
- Malicious disclosure of data or information by officials, employees, or agents who have custody or responsibility of maintaining the PhilSys is punished by ten (10) years to fifteen (15) years imprisonment and a fine of PHP 5,000,000 to PHP 10,000,000; if financial profit resulted, the guilty person must additionally pay twice the amount gained (Section 19).
- Officials, employees, or agents with custody or responsibility of managing or maintaining the PhilSys are punished with three (3) years to six (6) years imprisonment and a fine of PHP 1,000,000 to PHP 3,000,000 if, through their negligence, the PhilSys is accessed by unauthorized persons or data is processed without authority under the Act or any existing law (Section 19).
- If the violation is committed by a government official or employee, the penalty includes perpetual absolute disqualification from holding any public office or employment in the government, including in GOCCs and their subsidiaries (Section 19).
- All penalties under the Act are imposed in addition to those imposed on acts or omissions punishable by existing penal and other laws (Section 19).
Implementation timeline, funding, and IRR
- The PSA must implement the PhilSys in a manner that does not impede card-issuing government agencies’ operations so as not to unduly delay delivery of public service (Section 20).
- The PSA must gradually synchronize and consolidate existing government-initiated identification systems into one integrated and interconnected identification system to ensure easier, faster, more reliable, and more secure access to information and services (Section 20).
- Within three (3) months from effectivity, the PSA, together with the DFA and other government agencies, must undertake an extensive information campaign to promote the PhilSys to all citizens and resident aliens (Section 21).
- Funding for the implementation of the Act is included in the General Appropriations Act (Section 22).
- Within sixty (60) days upon approval, the PSA, in coordination with PSPCC, must promulgate the IRR, exchange existing technologies and best practices on issuance of the PhilID/PSN, authentication, and data security to effectively implement the Act (Section 23).
Final clauses and legal housekeeping
- If any provision, section, or part of the Act is declared unconstitutional or invalid, the remaining provisions, sections, or parts remain effective (Section 24).
- All laws, decrees, orders, rules, and regulations inconsistent with the Act are repealed or modified accordingly, except Republic Act No. 10173 (Section 25).