THE National Telecommunications Commission has released the detailed rules for the implementation of the SIM Card Registration Act, which will become effective December 27.
The law requires all users to register their subscriber identity module (SIM) cards with their telecommunications service provider.
Existing subscribers who fail to register until June 25, 2023 — or 180 days after December 27 — would have their SIMs deactivated automatically, and these could only be reactivated after registration.
Those who fail to comply with the requirements for registration would be unable to activate the SIM.
Why the need to register?
The law was passed to serve as a deterrent to the exploitation of the anonymity provided by prepaid SIM cards for scams and criminal activities.
Who are covered?
All existing and future SIM card users are required to register their SIM card.
In the case of minors who would use SIM cards, the registration of the SIM must be under the name of the minor’s parent or guardian.
All SIMs, including eSIMS, that provide SMS voice, or data services must be registered. These include SIMs intended for data-only or used for fixed wireless broadband modem
The IRR laid down the steps that must be followed to register the SIM card.
How to register the SIM card
Read all about how to register here.
Data privacy
The implementing rules and regulations lay down procedures that seek to ensure that the data of the subscribers would be protected after registration.
The rules state that telcos must treat the privacy of the SIM users’ data as absolutely confidential and must not disclose to any person any information and data obtained in the registration process.
The telcos must ensure that the data are secured, encrypted, and protected at all times, and comply with the minimum information security standards prescribed by the Department of Information and Communications Technology.
Any cyber-attack on the SIM register must be reported to the DICT within 24 hours.
The telcos must also allow the DICT to perform an annual audit on their compliance with information security standards.
They are also required to submit to the NCT, DICT, House of Representatives, and the Senate an annual report on their implementation of the provisions of the law.
Exemptions to confidentiality
The implementing rules allow the disclosure of the full name and address of the SIM car user in certain instances.
These could be disclosed in compliance with any law requiring them to share these information in accordance with the Data Privacy Act of 2012.
They may also disclose the data in compliance with a court order or legal process upon finding of probable cause.
Another criteria for disclosure it the written consent of the subscriber.
The confidentiality clause in the SIM registration would take effect at the point of activation ad shall continue even after deactivation of the SIM and for as long as the telcos retain the end-user’s data.
The rules also state that notwithstanding the provisions on confidentiality, the telcos would be required to provide information obtained in the registration process only upon the issuance of a subpoena by a competent authority pursuant to an investigation.
The investigation must be based on a sworn written complaint that a specific mobile number is being used in the commission of a crime.
Telcos that disclose information in compliance with the law would not be held liable.
Penalties for violators
A breach of confidentiality will carry a hefty fine ranging from P500,000 to P4 million.
Providing false or fictitious information to register a SIM card will be penalized with a prison term of six months to 2 years or a fine ranging from P100,000 to P300,000, or both.
Selling or transferring a registered SIM card without complying with the registration requirements will have a penalty of six months to six years in jail, or a fine of P100,000 to P300,000, or both.
Spoofing a registered SIM will net a penalty of no less than six years in jail, or a P200,000 fine, or both.
Telcos that fail or refuse to register a SIM without a valid reason, even if the end-user has complied with the requirements, will also face penalties.
For the first offense, the penalty is a fine ranging from P100,000 to P300,000, and for the second offense, a fine ranging from P300,000 to P500,000. The third and subsequent offenses would result in a fine ranging from P500,000 to P1 million.
Selling a stolen SIM will be punished with six months to 2 years’ imprisonment, or a P100,000 to P300,000 fine, or both.
Telcos’ other duties
The implementing rules also lay down other tasks that public telecommunication entities are required to undertake in the implementation of the law.
They must establish their own secure online SIM registration platform that must be “user-friendly and easy to use.” They are required to help persons with disabilities, senior citizens, pregnant women, and people with special needs.
They must have procedures to verify the data and information submitted to them during registration.
The telcos are also required to maintain a register of SIMs of their end-users and include the data of existing post-paid subscribers in the register.
They must also deactivate the SIM within 24 hours from receipt of information on the death of the end-user, the loss or theft of the SIM, or a request for deactivation.
Any SIM card reported lost or stolen must be barred from having text, call or data services immediately, and must be permanently deactivated upon the issuance of a new SIM to the end-user or within 24 hours, whichever comes earlier.
Moreover, the telcos must deactivate SIMs used for fraudulent texts or calls upon due investigation.
Relevant data and information from deactivated SIMs must be retained for 10 years from the date of deactivation.
Expectations
With the implementation of the new law, Malacañang expects it to provide accountability in the use of SIM cards and to help authorities run after those who commit crimes using phones.
It also said the new law would help the government to put a stop to scams committed through text and online messages.
