In an era where personal data is often referred to as the "new oil," the unauthorized disclosure of contact information—commonly known as "doxing" or data leaking—poses significant risks to individual security, reputation, and peace of mind. Under Philippine law, personal contact information is protected, and those who leak such data without consent face a battery of administrative, civil, and criminal consequences.

I. The Data Privacy Act of 2012 (Republic Act No. 10173)

The Data Privacy Act (DPA) is the primary legislation governing the processing and protection of personal information. Personal contact information (mobile numbers, home addresses, personal email addresses) is classified as "Personal Information" under the law.

Key Offenses under the DPA

When someone leaks your contact information, they may be liable for the following:

Unauthorized Processing (Section 25): This occurs when personal information is processed (which includes disclosure or sharing) without the consent of the data subject or without being authorized by law.
- Penalty: Imprisonment ranging from 1 to 3 years and a fine of up to ₱2,000,000.
Accessing Personal Information Due to Negligence (Section 26): If a company or person holding your data fails to secure it, leading to a leak.
- Penalty: Imprisonment ranging from 1 to 3 years and a fine of up to ₱2,000,000.
Malicious Disclosure (Section 31): This is the most applicable to intentional "leaking." It occurs when a person, with malice or in bad faith, discloses unwarranted or false information relative to any personal information.
- Penalty: Imprisonment ranging from 1 to 3 years and a fine of up to ₱1,000,000.
Unauthorized Disclosure (Section 32): If the disclosure is made without malice but still without consent by a person who has access to the data through their professional duties.
- Penalty: Imprisonment ranging from 1 to 3 years and a fine of up to ₱1,000,000.

II. Administrative Remedies: The National Privacy Commission (NPC)

The NPC is the regulatory body tasked with enforcing the DPA. A victim of a data leak can file a formal complaint with the NPC.

Cease and Desist Orders: The NPC can order the perpetrator to stop the unauthorized processing or remove the leaked information from public platforms.
Indemnity: The NPC can award nominal damages to the victim if their rights as a data subject were violated, regardless of whether financial loss was proven.
Administrative Fines: Under NPC Circular 2022-01, the commission can impose heavy fines on businesses or entities that fail to protect data or comply with privacy standards.

III. Civil Remedies under the Civil Code

Beyond the DPA, the Civil Code of the Philippines provides a basis for claiming damages.

Article 26: This article explicitly mandates respect for the privacy of others. It grants a cause of action for "prying into the privacy of another's residence" or "meddling with or disturbing the private life or family relations of another."
Article 2219: This allows for the recovery of moral damages in cases of willful injury to property or violations of liberty and privacy.
Quasi-Delict (Article 2176): If the leak occurred due to someone's fault or negligence, the victim can sue for actual damages (e.g., if the leak resulted in a job loss or the need to relocate).

IV. The Cybercrime Prevention Act (Republic Act No. 10175)

If the contact information was leaked via the internet, the Cybercrime Prevention Act may apply.

System Interference: If the leak was the result of a "hack" or unauthorized access to a computer system.
Cyber Libel: If the leak was accompanied by defamatory statements intended to ruin the victim's reputation, the perpetrator can be charged with Cyber Libel, which carries higher penalties than traditional libel.

V. The Safe Spaces Act (Republic Act No. 11313)

Also known as the "Bawal Bastos" Law, this act addresses gender-based online sexual harassment. If the leaking of contact information is done to harass, threaten, or intimidate the victim—especially in a sexualized context or via "cyberstalking"—it falls under this law.

Cyberstalking: Includes the unauthorized recording and sharing of any information (including contact info) that has a tendency to terrorize the victim.

VI. Steps for Victims to Take

For those whose information has been leaked, the following steps are legally recommended:

Document the Leak: Take screenshots of the post, the URL, the timestamp, and the identity/username of the person who leaked the info.
Issue a Notice to Take Down: Contact the platform (Facebook, X, Telegram, etc.) to report a privacy violation. Under the DPA, you have the Right to Erasure or Blocking.
File a Complaint with the NPC: Use the NPC’s online complaints portal to initiate an investigation.
Blotter and Police Report: For criminal prosecution, report the incident to the PNP Anti-Cybercrime Group (ACG) or the NBI Cybercrime Division.
Civil Suit: Consult with legal counsel to file a complaint for damages in a Regional Trial Court.

Note on Consent: In the Philippines, the burden of proving that consent was given for the disclosure of information lies with the person who shared it, not the victim. Silence or lack of an objection does not constitute valid legal consent.