VPNs with servers in the Philippines

A service provider is any entity giving users the ability to communicate by a computer system, or processing or storing data on their behalf (s. 3(n)). Whether a VPN operator is one is not established.

Republic Act 11930 (2022) requires internet intermediaries to preserve subscriber, registration and traffic data for six months, extendable by six months or until a case ends, and content data for one year; internet service providers must log each subscriber and the IP address assigned at a given time (s. 9). Under the SIM Registration Act (Republic Act 11934, 2022), public telecommunications entities keep registration data for ten years after a number is deactivated.

Republic Act 11930 requires internet intermediaries, and internet service providers separately, to block, remove or take down child sexual abuse or exploitation material within 24 hours of a notice from a competent authority, defined to include law enforcement, prosecutors, courts and regulators (s. 9).

Under section 15 of Republic Act 10175, authorities executing a properly issued search and seizure warrant may secure systems, copy data and remove or disable access to it.

Online libel is a cybercrime under section 4(c)(4) of Republic Act 10175, punished one degree higher than libel under article 355 of the Revised Penal Code (s. 6). The Supreme Court held the provision valid as to the original author of a post and void as to others who merely receive it and react.

Disclosure of subscriber information or traffic data requires a court warrant; the order must be met within 72 hours and relate to a valid complaint (s. 14). Mobile numbers link to a registered identity, released on a subpoena or court order (RA 11934, ss. 9, 10).

In Disini v. Secretary of Justice (G.R. No. 203335, 11 February 2014) the Supreme Court declared void section 12, real-time collection of traffic data on “due cause”, finding the power too sweeping and without restraint, and section 19, which let the Department of Justice restrict or block access. It upheld section 14, since disclosure follows judicial intervention, and section 15.

The Anti-Wiretapping Act (Republic Act 4200, 1965) punishes secret recording of a private communication without every party’s authorisation with six months to six years; peace officers may act only on a written court order and for listed offences. The order of the rows is the security score, and a server’s location is not a recommendation.