Is Sharing Someone’s Mugshot Legal?

Privacy, Defamation, and Cyber Harassment in the Philippines

Short answer: Sharing a mugshot online in the Philippines is legally risky. It can be lawful in narrow situations (e.g., fair and true news reporting on an official arrest, with careful wording and strong public-interest grounds), but it can also violate the Data Privacy Act, constitute libel/cyber-libel, or amount to online harassment—especially where minors or protected victims are involved, or where posts imply guilt.

This is general information, not legal advice. If you’re facing a real dispute or plan to publish, talk to a Philippine lawyer.

1) What counts as a “mugshot” and who “owns” it?

Mugshot/booking photo: an image taken by law-enforcement (PNP/NBI) during arrest or booking.
Ownership & copyright: Government works generally aren’t subject to copyright under the IP Code (Sec. 176), but copyright freedom ≠ permission to publish. Other laws (privacy, criminal statutes, court orders, agency rules) can still restrict release or downstream sharing.
Access to mugshots: Executive-branch FOI (E.O. No. 2) recognizes public access to information subject to exceptions (privacy, law-enforcement, and other protected interests). Even if an agency lawfully releases a mugshot, reposting it may still breach defamation or data-privacy rules depending on how it’s used.

2) The key legal pillars

A. Data protection & privacy

Data Privacy Act of 2012 (DPA; R.A. 10173)
- A mugshot is personal information; when tied to an arrest, it can connect to sensitive personal information (information about offenses and proceedings).
- Processing (collecting, using, sharing, posting) generally requires lawful basis (e.g., consent, legal obligation, legitimate interests balanced against rights, or the journalistic/literary/artistic exemption).
- Unauthorized processing or disclosure can trigger administrative action by the National Privacy Commission (NPC) and criminal penalties (imprisonment and fines).
- Data subject rights include being informed, objecting, accessing data, and erasure/blocking where processing is unlawful or no longer necessary (sometimes called the “right to be forgotten” in local practice). These rights are not absolute; public-interest and legal-obligation grounds can override them.
Civil Code protections
- Art. 19/20/21 (abuse of rights, acts contrary to law/morals) and Art. 26 (respect for privacy and dignity) support civil actions for damages due to intrusive or humiliating publication—even if no separate crime is proven.
- Art. 32 creates civil liability for violations of constitutional rights.

B. Defamation

Revised Penal Code (RPC) arts. 353–362 (libel) and jurisprudence
- Libel: public and malicious imputation of a crime/vice/defect that damages reputation.
- Truth is a defense only if shared with good motives and justifiable ends (Art. 361). A true mugshot shared with snide or vindictive captions can still be libelous.
- Privileged communications (Art. 354 exceptions):
  - A fair and true report of an official (not confidential) proceeding, in good faith and without embellishing comments;
  - Fair comment on matters of public interest (limited by actual malice standards in some contexts).
Cybercrime Prevention Act (R.A. 10175): cyber-libel
- Online libel mirrors RPC libel when committed through ICT.
- The Supreme Court upheld cyber-libel’s constitutionality (while striking down overbroad liability for mere “liking/liking-type aiding” in the abstract).
- Republication risk: If you repost/share with your own statements (or materially amplify defamatory content), you may be treated as a new publisher.
- Prescription: Regular print libel traditionally prescribes in 1 year; cyber-libel has been treated by the Supreme Court as subject to a longer prescriptive period (15 years) under the special law on offenses without specific periods. This massively expands exposure for online posts.

C. Cyber-harassment & related statutes

Safe Spaces Act (R.A. 11313): penalizes gender-based online sexual harassment (e.g., sexist or misogynistic attacks, non-consensual sexualized imagery).
Anti-VAWC (R.A. 9262): psychological violence via online humiliation, stalking, or harassment in intimate/household contexts can be actionable.
Anti-Photo and Video Voyeurism (R.A. 9995): criminalizes distribution of intimate images taken under circumstances involving expectation of privacy; it usually won’t cover ordinary mugshots, but watch for mixed content (e.g., compromising images posted alongside).
Unjust vexation, grave threats, grave coercion (RPC): may apply to coordinated doxxing, threats, or coercive campaigns.

D. Special protections (absolutely critical)

Children: R.A. 9344 (Juvenile Justice & Welfare Act, as amended) prohibits identifying a child in conflict with the law; releasing a minor’s mugshot (or any identifying detail) is unlawful.
Victims of sexual offenses and trafficking: R.A. 8505 (rape victims) and R.A. 9208/10364 (trafficking) prohibit disclosure of identities.
Court orders/sub judice: Courts or agencies can order non-disclosure. Disobeying may lead to contempt or other sanctions.

3) When sharing a mugshot is more likely lawful

With valid consent from the person (express, informed, and specific to posting context).
Fair and true reports about official acts: e.g., a straight news item that accurately states “X was arrested on [date] for [alleged offense], case pending before [office],” without implying guilt, and anchored to reliable official records.
Clear public-interest/safety grounds: e.g., active manhunt, official wanted posters, or agency requests for public assistance.
Official release by the responsible agency, plus your use is narrowly tied to the official purpose (e.g., reproducing an NBI/PNP alert).
Legal claims: using the image as evidence in a proceeding or to defend a claim (still keep filings compliant with confidentiality and court rules).

Even in these situations: use neutral language, avoid editorial captions, and state the presumption of innocence.

4) When sharing is illegal or high-risk

Minors or protected victims are identifiable.
The image was leaked, or shared beyond the purpose for which the agency collected it—triggering unauthorized processing/disclosure under the DPA.
False identification (wrong person) or misleading juxtaposition that implies guilt.
Do-xxing: posting addresses, phone numbers, workplace, or family details to invite harassment.
Harassing captions (sexist, threatening, humiliating), or patterns of targeted abuse (possible Safe Spaces, VAWC, or RPC violations).
Commercial exploitation of a person’s mugshot (e.g., ads, thumbnails designed to “name-and-shame”) without a legal basis—privacy, DPA, and unfair competition/false light-type theories via Civil Code can all come into play.
Ignoring a lawful takedown order or court/NPC directive.

5) Journalism, bloggers, and “citizen posts”: how the rules differ

Journalistic/Artistic/Literary exemption (DPA): Many DPA obligations don’t apply to processing for journalism—but the exemption is not a free pass. Reporting must be in good faith, public-interest–oriented, and ethical.
Bloggers and non-news pages: The exemption is harder to invoke if your content looks like opinion, commentary, or sensational “call-out” posts rather than neutral reporting.
Captions and framing matter: A neutral report can turn libelous/harassing if you add insinuations (“criminal!”, “thief!”) or inflammatory hashtags.
Republication: Adding your own text to a shared mugshot can make you the publisher of any new defamatory or privacy-invasive content.

6) Platform liability & takedowns

Intermediaries (social networks, forums) aren’t automatically liable for user posts, but they can face regulatory pressure if they ignore valid notices involving privacy, protected minors, or court/NPC orders.
Takedown routes:
1. Platform report (choose “privacy,” “harassment,” or “legal” categories).
2. NPC complaint for unlawful processing/disclosure (cite DPA; request immediate take-down and accountability of the original poster).
3. Demand letter threatening civil action (Civil Code) and/or criminal complaint (libel/cyber-libel, special-victim statutes).
4. Court relief (damages, injunctions). Prior restraint in defamation cases is disfavored, but courts and the NPC have ordered targeted removals, especially for privacy or child/victim protection.

7) Practical publishing checklist (use before you post)

Stop if any answer is “Yes”:

Is the person a minor?
Is the person a victim of sexual offense/trafficking?
Is there a court/NPC/agency bar on disclosure?
Did you get the image via a leak or from private chats?

If you still think posting is justified:

Keep the headline/caption neutral: “arrested on suspicion,” not “caught criminal.”
Include date, office, docket/reference, and status (“case pending,” “no plea yet”).
Add presumption of innocence language.
Don’t add addresses, family info, workplace, or phone numbers.
Blur/pixelate identifying details when risk to safety/privacy outweighs public interest (e.g., partial faces, plates, minors near adults).
Limit scope & duration: remove or update posts on acquittal or dismissal; archive responsibly.
Maintain records of sources (to show good faith).

8) If your mugshot (or a relative’s) is posted—what to do

Preserve evidence: screenshots, links, dates, account IDs, and any threats in replies/DMs.
Send a takedown citing:
- DPA (unlawful processing/disclosure; lack of consent/legal basis),
- Civil Code (Arts. 19/20/21/26),
- Any special laws (R.A. 9344, 8505, 10364), and
- Cyber-libel if captions imply guilt or add accusations.
Report to the platform (choose “privacy/legal violation”).
Complain to the NPC (attach screenshots and the takedown letter).
Consider a criminal complaint (PNP/NBI/Prosecutor) and/or civil suit for damages.
For workplace/school repercussions, keep HR informed with your filings and proof of misuse.

Quick takedown note (editable):

I am the data subject in a mugshot you posted on [link]. Your post processes my personal (and sensitive) data without a lawful basis, in breach of the Data Privacy Act. It is defamatory/harassing as it implies guilt; the case status is [dismissed/pending], and I am presumed innocent. You are required to delete the post and all reuploads within 24 hours and to confirm in writing. Failing that, I will seek NPC action and file civil/criminal complaints.

9) Frequently asked questions

Is a government-released mugshot always OK to repost? No. Government copyright rules aren’t the issue—privacy, defamation, and special-victim laws still apply. Reposting out of context or with hostile captions can be unlawful.

What if I only “reshare” without adding text? Liability turns on whether your act is treated as publication and whether the content is defamatory/illegal. Philippine jurisprudence has limited automatic liability for passive reactions, but resharing can still be seen as republication, particularly if you add context or visibility. Risk remains.

If the person was later acquitted, must I delete my post? There’s no automatic erasure duty, but continuing to host a post that implies guilt after an acquittal/dismissal increases defamation and DPA risk. Update or take down.

Does it matter if the person is a public official? Public-interest coverage is broader, and fair comment is protected—but actual malice (knowledge of falsity/reckless disregard for truth) defeats protection. Stick to neutral, verifiable facts.

How long can I be sued for cyber-libel? Courts have treated cyber-libel as having a longer prescriptive period (15 years) than print libel’s 1 year. That dramatically extends exposure for online posts.

10) Bottom line

Default to not posting mugshots unless a clear, defensible public-interest reason exists and you can meet DPA, defamation, and special-protection constraints.
If posting, keep it neutral, narrow, accurate, and brief—and be prepared to update or remove.
If harmed, you have platform, NPC, criminal, and civil remedies.

If you want, I can adapt this into a one-page internal policy or a risk triage flowchart for your team.