Identity theft and the unauthorized use of personal photos (often referred to as "photo grabbing") are serious offenses in the Philippines. Victims have several legal avenues to seek justice, ranging from criminal prosecution to civil damages. The Philippine legal framework has evolved to address these digital-age crimes through specific statutes.

1. Key Governing Laws

In the Philippines, these acts are primarily governed by two landmark pieces of legislation:

Republic Act No. 10175 (Cybercrime Prevention Act of 2012): This is the primary law used to prosecute identity theft committed through a computer system.
Republic Act No. 10173 (Data Privacy Act of 2012): This law protects the fundamental human right to privacy of communication while ensuring free flow of information. It penalizes the processing of personal information without the data subject's consent.

2. Legal Grounds for Action

A. Computer-Related Identity Theft

Under Section 4(b)(3) of R.A. 10175, identity theft is defined as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another, whether natural or juridical, without right.

Penalty: Imprisonment of prision mayor (6 years and 1 day to 12 years) or a fine of at least ₱200,000.00, or both.

B. Unauthorized Processing of Personal Information

Under Section 25 of R.A. 10173, processing personal information (which includes photos that can identify a person) without the consent of the data subject or without being permitted under the law is a criminal offense.

Penalty: Imprisonment ranging from 1 to 3 years and a fine of ₱500,000.00 to ₱2,000,000.00.

C. Civil Damages (The Civil Code)

Aside from criminal charges, a victim can file a separate civil action for damages under the Civil Code of the Philippines:

Article 26: Penalizes "prying into the privacy of another's residence," "meddling with or disturbing the private life or family relations of another," and "intriguing to cause another to be alienated from his friends."
Article 33: Allows for a civil action for damages in cases of defamation, fraud, and physical injuries, which can be independent of criminal prosecution.

3. Step-by-Step Process for Filing a Lawsuit

Step 1: Evidence Gathering and Preservation

Before the perpetrator deletes the evidence, you must secure "digital footprints."

Screenshots: Capture the fake profile, the unauthorized photos used, the URLs (links), and any timestamps.
Preservation of Metadata: If possible, save the source files or original photos to prove ownership.
Notarization: For stronger evidence, have the screenshots notarized or perform a "Web-to-PDF" capture in the presence of a lawyer.

Step 2: Reporting to Law Enforcement

You should report the incident to specialized cybercrime units:

PNP-ACG: Philippine National Police - Anti-Cybercrime Group.
NBI-CCD: National Bureau of Investigation - Cybercrime Division. These agencies have the technical capability to track IP addresses and coordinate with social media platforms (like Facebook or Instagram) to identify the perpetrator.

Step 3: Filing a Complaint with the National Privacy Commission (NPC)

If the issue specifically involves the misuse of personal data and photos by a company or an individual, a formal complaint can be lodged with the NPC for violations of the Data Privacy Act.

Step 4: The Preliminary Investigation

Once a complaint-affidavit is prepared (usually with the help of a lawyer or the NBI/PNP), it is filed before the Office of the City Prosecutor.

The Prosecutor will determine if there is probable cause to bring the case to court.
The respondent (the accused) will be given a chance to submit a counter-affidavit.

Step 5: Trial in Court

If the Prosecutor finds probable cause, an "Information" (criminal charge) is filed in the Regional Trial Court (RTC) designated as a Cybercrime Court. The trial will then proceed to determine guilt beyond reasonable doubt.

4. Summary of Penalties and Remedies

Action	Primary Law	Possible Penalty
Identity Theft	R.A. 10175	6-12 years imprisonment; Fine (min. ₱200k)
Data Privacy Violation	R.A. 10173	1-3 years imprisonment; Fine (₱500k-₱2M)
Libel/Cyber-Libel	Revised Penal Code / R.A. 10175	Imprisonment or fine if the post defames you
Civil Damages	Civil Code	Monetary compensation for moral and exemplary damages

5. Important Considerations

Jurisdiction: Cybercrimes are generally triable in the RTC of the city where the complainant resides or where the computer system used is situated.
Anonymity: Even if the perpetrator uses a "dummy account," law enforcement can often trace the account through its digital footprint, though this process can be lengthy.
Consent: In many cases, the defense will argue "implied consent" (e.g., the photo was set to 'Public'). However, under Philippine law, making a photo public does not grant others the right to misrepresent themselves as you or use your likeness for fraudulent purposes.