Section 9Sec./Art. 9

Duties and Responsibilities of Private Sectors.

(a)Duties of Internet Intermediaries. Internet intermediaries shall:

(1)Adopt in their terms of service or service agreements with third-party users or creators of contents, products and services the prohibition of any form or any conduct of streaming or live-streaming of OSAEC and CSAEM in the use of their website, platform, server or facility

(2)Preserve within six (6) months from the date of the transaction extendible for another six (6) months or during the pendency of the case, all subscriber's or registration information and traffic data in its control and possession:Provided, That in the case of content data, the same shall be preserved within one (1) year, and upon notice by the competent authority, the preservation shall be extendible for another six (6) months:Provided, however, That the competent authority shall expressly identify and specify such relevant evidence that needs preservation:Provided, further, That the integrity of all computer data such as subscriber's information, traffic data and content data relating to communication services provided by a service provider shall be protected for the purpose of investigation and prosecution of cases under thisAct:Provided, finally, That the preservation period provided under the law governing foreign corporations doing business in the Philippines or the period provided under thisAct, whichever is longer, shall prevail;

(3)Immediately block access to, remove or take down the internet address, uniform resource locator (URL), websites or any content thereof containing CSAEM or involving streaming or live-streaming of OSAEC, within twenty-four (24) hours from receipt of notice from a competent authority or notice containing sufficient information to identify the content and its source:Provided, That this period may be extended to another twenty-four (24) hours upon submission of a written justification if the notice was made by any private citizen or by a competent authority without sufficient information to identify the content and its source:Provided, however, That the period provided in the preceding paragraph on the period of preservation of subscriber's or registration information, traffic or content data shall apply:Provided, further, That the competent authority shall, as far as practicable, expressly identify and specify such relevant evidence that needs preservation

(4)Report to the Department of Justice (DOJ), within three (3) days, the internet address or websites blocked, removed or taken down, or any form of unusual data activity using its server or facility:Provided, That in cases when a foreign internet intermediary is prohibited by its country to share data, the reports filed by such foreign internet intermediary to the corresponding entity tasked by its government to receive cybercrime reports shall be deemed in compliance with this provision:Provided, however, That the said foreign internet intermediary shall inform the DOJ of such reporting:Provided, further, That whatever relevant evidence otherwise not prohibited by law to be shared shall nevertheless be reported to the DOJ;

(5)Provide, pursuant to a subpoena issued by the Philippine National Police (PNP) in accordance with Republic Act No. 6975,as amended, otherwise known as the "Department of the Interior and Local Government Code of 1990"or by the National Bureau of Investigation (NBI) in accordance with Republic Act No. 10867, otherwise known as the "National Bureau of Investigation Reorganization and Modernization Act or by the prosecutor in accordance with theRules of Court; and notwithstanding the provisions of Republic Act No. 10175,otherwise known as the "Cybercrime Prevention Act of 2012"and in accordance with Republic Act No. 10173,otherwise known as the "Data Privacy Act of 2012,"the subscriber's or registration information and/or traffic data of any person who:

(i)Gained or attempted to gain access to an internet site, internet asset or internet application which contains any form of CSAEM; or

(ii)Facilitated the violations of thisAct; or

(iii)Conducted the streaming or live-streaming of child sexual exploitation.

The subpoena must particularly describe the information asked for and indicate the relevancy of such information to the sexual abuse and exploitation of children (SAEC) case.

The subpoena must particularly describe the information asked for and indicate the relevancy of such information on violations of thisAct.

(6)Develop, establish and install mechanisms or measures designed to prevent, detect, respond or report violations of thisActwithin their websites, platforms, applications, servers or facilities, compatible with the products and services they offer that may be in accordance with the global best practices and guidelines to counter violations of thisActwhich may include the installation of available technology, program, or software to ensure that access to or streaming of violations of thisActwill be removed, blocked or filtered;

(7)Coordinate with the Department of Justice-Office of Cybercrime (DOJ-OOC) to define the standard upon which an internet intermediary is measured, in order to fairly assess if an internet intermediary has reasonably complied with its duties under thisAct; and

(8)Have a policy on notifying their community to ensure that their policy has a provision on delaying or dispensing with notification to an account holder, subscriber or customer of the internet intermediary who is stated to be a suspected offender of anactof OSAEC in an ongoing criminal investigation, of the existence of a subpoena, warrant, court order, or other governmental request directing the internet intermediary to disclose information about the said account holder, subscriber or customer for the purposes of the criminal investigation.

(b)Duties of Internet Service Providers (ISPs). In addition to the above duties and responsibilities, all ISPs shall:

(1)Notify the PNP or the NBI within forty-eight (48) hours from receipt of information that any form of child sexual abuse or exploitation is being committed using its server or facility, or is likely being committed using its server or facility based on, among others, traffic analysis and observed sudden surges in usage;

(2)Block CSAEM or the streaming or live-streaming of a child sexually abused or exploited within twenty-four (24) hours from receipt of notice containing sufficient information to identify the content and its source:Provided, That if the information contained in the notice points to a legitimate website where the blocking thereof may result to blocking of legitimate contents therein, the ISPs shall have the obligation to inform the PNP or NBI within the same period of such fact:Provided, further, That failure of the ISPs to block any form of CSAEM or the streaming and/or live-streaming of child sexual exploitation within twenty-four (24) hours from receipt of notice as described above, shall beprima facieevidence of knowledge, as punished under Section 4 (d) of thisAct;

(3)Maintain logs of each and every subscriber and the IP address assigned to each and every subscriber at a given date and time

(4)Develop and adopt a set of systems and procedures for preventing, blocking, detecting, and reporting of OSAEC and CSAEM committed within their platforms, which are compatible with the services and products they offer, including the maintenance and management of an updated list of URLs containing CSAEM by partnering with organizations that maintain the most comprehensive list of URLs with CSAEM, and those with hashes of the same;

(5)Adopt and integrate child protection standards in their corporate governance practice and processes; a

(6)Establish high privacy setting as default safety and privacy settings for children, and where practicable and necessary, adopt age-verification controls and protocols to restrict their access to materials within the purview of Section 3 (c) (iv) of Presidential Decree No. 1986, entitled as "Creating the Movie and Television Review and Classification Board."

(c)Duties of PSPs. In addition to the duties specified for internet intermediaries as applicable to internet PSPs, any person who has direct knowledge of any OSAEC and CSAEM financial activity shall have the duty to report any suspected OSAEC and CSAEM-related activity or suspicious transaction to the DOJ-OOC within twenty-four (24) hours and they shall also have the duty to report to the Anti-Money Laundering Council (AMLC), within five (5) days from discovery thereof.

Law enforcement agencies investigating violations of thisActmay require financial intermediaries, internet PSPs, and other financial facilitators to provide financial documents and information upon order of any competent court when it has been established that there is reasonable ground to believe that the transactions to be examined involve prohibited activities under thisAct.

Notwithstanding the provisions of Republic Act No. 1405,entitled "An Act Prohibitng Disclosure of or Inquiry into Deposits with any Banking Institution and Providing Penalty Therefor,"as amended,RepublicActNo. 6426, otherwise known as the "Foreign Currency Deposit Act of the Philippines,"as amended,Republic Act No. 8791,otherwise known as "The General Banking Law of 2000,"as amended, and other pertinent laws, the law enforcement agencies investigating cases under thisActmay inquire into or examine any particular deposit or investment, including related accounts, with any banking institution or any non-bank financial institution upon order of any competent court when it has been established that there is reasonable ground to believe that the deposit or investments, including related accounts involved, are related to violations of thisAct.

Violations under Sections 4 and 5 of thisActshall be considered as "unlawful activity" under Section 3 (i) of Republic Act No. 9160,otherwise known as the "Anti-Money Laundering Act of 2001,"as amended, and shall be punishable under the saidAct.

Money transfer and remittance centers shall require individuals transacting with them to present valid government identification cards.

The Department of the Interior and Local Government (DILG) and the AMLC shall promulgate, within ninety (90) days from the effectivity of thisAct, the necessary rules and regulations for the implementation of this provision.

(d)Responsibility of All Internet Hotspots, Cafs or Kiosks. Internet hotspots, cafs or kiosks shall:

(1)Notify the NCC-OSAEC-CSAEM, within twenty-four (24) hours from obtaining facts and circumstances, of any violation of thisActthat are being committed within their premises:Provided, That there is aprima facieknowledge that a violation of thisActis being committed if suchactsor omission has been committed within the premises of such internet hotspot, caf or kiosk;

(2)Install and update programs and software designed to detect sexually explicit activities involving children and ensure that access to or transmittal of such materials will be blocked or filtered; and

(3)Promote awareness against OSAEC and CSAEM through clear and visible signages in both English and the local dialect, with local and national hotlines posted within their facilities.