Cybercrime Liability in the Philippines: Offenses, Penalties, and Defenses

Cybercrime liability in the Philippines arises under Republic Act No. 10175, the Cybercrime Prevention Act of 2012, as implemented by the DOJ Rules and Regulations of 12 August 2015. Liability attaches to anyone who commits defined offenses "without right" — meaning without authority or any legal defense, excuse, or justification. Penalties range from prision mayor and fines of at least P200,000 to reclusion temporal and fines of at least P500,000 for attacks on critical infrastructure. Corporations may also be fined up to P10,000,000. Below is how the law defines the offenses, who may be held liable, and what defenses exist.

What counts as a cybercrime offense in the Philippines

The Rules classify core cybercrimes into three groups.

Offenses against the confidentiality, integrity, and availability of computer data and systems. These are illegal access (accessing any part of a computer system without right); illegal interception of non-public data transmissions; data interference (intentional or reckless alteration, damaging, deletion, or deterioration of computer data, including introducing viruses); and system interference (hindering or interfering with a computer or network without right). Misuse of devices — producing, selling, distributing, or possessing tools or passwords intended for cybercrimes — is also punishable, with a fine of not more than P500,000. No liability attaches when such devices are used for the authorized testing of a computer system.

Computer-related offenses. These cover computer-related forgery, computer-related fraud, and computer-related identity theft — the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another's identifying information without right.

Content-related offenses. Child pornography committed through a computer system carries the penalty under Republic Act No. 9775, increased by one degree. Cybersex — willful engagement in lascivious exhibition of sexual organs or sexual activity with a computer system for favor or consideration — is punishable by prision mayor or a fine of at least P200,000 but not exceeding P1,000,000.

Online libel and other cybercrimes

Online libel is libel as defined in Article 355 of the Revised Penal Code, committed through a computer system. It carries prision correccional in its maximum period to prision mayor in its minimum period, or a fine from P6,000 up to the maximum amount determined by the Court, or both. Importantly, the Rules state this provision applies only to the original author of the post or online libel — not to those who simply receive the post and react to it.

Other punishable acts include cyber-squatting (acquiring a domain name in bad faith that is similar or identical to an existing trademark or another person's name) and aiding or abetting or attempting to commit a cybercrime, which carry a penalty one degree lower. Aiding, abetting, and attempt do not apply to child pornography or online libel.

Who can be held liable — individuals and corporations

Any natural person who commits the acts above may be criminally liable. A juridical person may also be held liable for a fine of at least double the imposable fine, up to P10,000,000, when the act is knowingly committed on its behalf by a person with a leading position — such as one with power of representation, authority to decide, or authority to exercise control. Where the offense was made possible by a lack of supervision or control, the corporation may be fined up to P5,000,000. Corporate liability does not remove the criminal liability of the individual.

Service providers enjoy limited protection: a provider that merely provides access is generally not civilly or criminally liable where it lacks actual knowledge of the unlawful material, does not knowingly receive a direct financial benefit, and does not itself commit the unlawful act.

Penalties and the one-degree rule

Crimes under the Revised Penal Code and special laws committed through information and communications technology are covered by the Act, with the penalty one degree higher than that provided by the Revised Penal Code or special law. When committed against critical infrastructure, offenses against data confidentiality, integrity, and availability carry reclusion temporal or a fine of at least P500,000.

Defenses and limits on liability

The Rules define "without right" as conduct undertaken without or in excess of authority, or conduct not covered by established legal defenses, excuses, court orders, justifications, or relevant principles under the law. This means lawful authority, consent, or a valid court order negates liability. The authorized testing of a computer system is expressly exempt. The exclusionary rule applies: evidence obtained without a valid warrant or beyond its authority is inadmissible before any court or tribunal. A prosecution under RA 10175 is also without prejudice to liability under the Revised Penal Code or special laws, subject to stated exceptions for online libel and child pornography.

Where cases are filed

The Regional Trial Court has jurisdiction over violations of the Act, including those committed by a Filipino national regardless of place of commission. Jurisdiction lies if any element was committed in the Philippines, if a computer system wholly or partly situated in the country was used, or if damage was caused to a person in the Philippines at the time of the offense. Venue lies where the cybercrime or any element was committed, where part of the computer system is situated, or where the damage occurred — and the court first taking the case acquires jurisdiction to the exclusion of others.

Frequently asked questions

Is sharing a libelous post on social media a crime? Under the Rules, the online libel provision applies only to the original author of the post, not to others who simply receive and react to it.

Can a company be criminally liable for a cybercrime? A juridical person may be held liable for a fine of up to P10,000,000 when an offense is knowingly committed on its behalf by a person in a leading position.

What makes an act "without right"? Conduct done without or in excess of authority, or conduct not covered by legal defenses, excuses, court orders, or justifications.

Practical takeaways

• Liability under RA 10175 covers illegal access, interception, data and system interference, forgery, fraud, identity theft, cybersex, online libel, and cyber-squatting.
• Penalties include prision mayor and fines of at least P200,000, or reclusion temporal and at least P500,000 for critical infrastructure.
• Online libel applies only to the original author, not to those who merely react to a post.
• Corporations face fines of up to P10,000,000, without prejudice to the individual's criminal liability.
• Evidence obtained without a valid warrant is inadmissible.

Primary sources

The rules discussed above are drawn from the following primary sources, as published in the Official Gazette and the national statute book.

• DOJ RULES AND REGULATIONS IMPLEMENTING REPUBLIC ACT NO. 10175, OTHERWISE KNOWN AS THE "CYBERCRIME PREVENTION ACT OF 2012", August 12, 2015

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.