Committed by The Personal Information Controller, Personal Information Processor or Any of Its Officials
Committed by The Personal Information Controller, Personal Information Processor or Any of Its Officials
Committed by The Personal Information Controller, Personal Information Processor or Any of Its Officials
1. those who process personal information without the consent of the data subject or without being
authorized under such law
2. those who, due to negligence, provided acces to personal information without being authorized under
such law
- those who knowingly or negligently dispose, discard or abandon the personal information of a data
subject in an area accessible to the public, or otherwise placed the personal information of the data
subject in its container or trash collection.
4. those who process personal information for purposes not authorized by the data subject
5. those who knowingly and unlawfully breaks in any way into any system where personal and sensitive
perosnal information is stored.
6. failure of a personal information controller, after knowledge of a security breach that would harm
affected data subjects, to report the breach to the commission intentionally or by concealing facts of
such breach.
7. malicious disclosure
- committed by the personal information controller, personal information processor or any of its officials,
agents or employees, who, with malice or bad faith, discloses unwarranted or false personal information
or sensitive personal information of any data subject obtained by them.
8. unauthorized disclosure
- any personal information controller or personal information processor or their officials, agents or
employees, who discloses personal information or sensitive personal information without the consent of
the data subject.
note: if the personal information including sensitive ones are disclosed with consent but unwarranted or
false, then they are still liable for malicious disclosure. If although the disclosed information is true but
made without the consent of the data subject, then they are liable for unauthorized disclosure.
9. If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon
the responsible officers, as the case may be, who participated in, or by their gross negligence, allowed
the commission of the crime.
If the offender is an alien, he or she shall, in addition to the penalties herein prescribed, be deported
without further proceedings after serving the penalties prescribed.
Large-Scale. – The maximum penalty in the scale of penalties respectively provided for the preceding
offenses shall be imposed when the personal information of at least one hundred (100) persons is
harmed, affected or involved as the result of the above mentioned actions.