In the digital age, the "right to be let alone" is frequently challenged by the ease of sharing information online. The unauthorized posting of private photos and government-issued IDs—often referred to as "doxing" or "revenge porn"—not only violates personal dignity but also triggers a suite of criminal and civil liabilities under Philippine law.

I. The Statutory Framework

Several specialized laws provide protection and penalties for the unauthorized disclosure of private information and media.

1. The Data Privacy Act of 2012 (Republic Act No. 10173)

This is the primary legislation governing the processing of personal information. Government-issued IDs and private photos that identify an individual are classified as Sensitive Personal Information.

Unauthorized Processing: Under Section 25, processing (which includes uploading or sharing) sensitive personal information without the consent of the data subject or without statutory authority is a criminal offense.
Malicious Disclosure: Section 31 penalizes any person who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or sensitive personal information.
Penalties: Violations can lead to imprisonment ranging from three to seven years and fines between ₱500,000 to ₱2,000,000.

2. Anti-Photo and Video Voyeurism Act of 2009 (Republic Act No. 9995)

This law specifically addresses the unauthorized recording and distribution of photos or videos of a person performing "private acts."

Prohibited Acts: It is illegal to copy, distribute, or broadcast photos or videos of a person's private areas or private acts (such as sexual activities or those performed in privacy) without their written consent, even if the victim originally consented to the recording.
Penalties: Violators face imprisonment of seven to twelve years and a fine of ₱100,000 to ₱500,000.

3. Safe Spaces Act (Republic Act No. 11313)

Also known as the "Bawal Bastos Law," this act covers Gender-Based Online Sexual Harassment (GBOSH).

Scope: It penalizes acts such as uploading or sharing without consent any photos or videos with sexual content, or any information (like IDs or addresses) intended to victimize, humiliate, or harass the target.
Penalties: For online harassment, the penalty is prision correccional in its medium period or a fine of ₱100,000 to ₱500,000.

4. Cybercrime Prevention Act of 2012 (Republic Act No. 10175)

This law provides an umbrella of protection for crimes committed through computer systems.

Computer-related Identity Theft: If a person's ID is used to assume their identity or commit further crimes, it falls under Section 4(b)(3).
Cyber Libel: If the posting of a photo or ID is done to malign the reputation of the victim, the perpetrator can be charged with Libel under the Revised Penal Code, with the penalty increased by one degree because it was committed through an Information and Communications Technology (ICT) system.

II. Civil Remedies and Damages

Beyond criminal prosecution, victims can sue for damages under the Civil Code of the Philippines.

Article 26: Expressly mandates that every person shall respect the dignity, personality, privacy, and peace of mind of their neighbors and other persons. It specifically mentions "prying into the privacy of another's residence" and "intruding upon another's personal liberty."
Article 19 (Abuse of Right): Every person must, in the exercise of his rights and in the performance of his duties, act with justice, give everyone his due, and observe honesty and good faith.
Types of Damages: Victims may pray for:
- Moral Damages: For physical suffering, mental anguish, and besmirched reputation.
- Exemplary Damages: Imposed by way of example or correction for the public good.
- Attorney’s Fees and Litigation Costs.

III. Administrative Remedies

The National Privacy Commission (NPC) serves as the regulatory body for the Data Privacy Act.

Cease and Desist Orders: A victim can file a formal complaint with the NPC to compel the perpetrator or the platform (if applicable) to take down the offending material.
Administrative Fines: The NPC has the power to impose significant administrative fines on entities or individuals found to be in violation of data privacy principles.

IV. Procedural Steps for Victims

To successfully pursue these remedies, the following steps are generally recommended:

Preservation of Evidence: Take screenshots of the post, including the URL, the timestamp, the profile of the uploader, and any comments. Do not delete the original messages or links until they are authenticated.
Report to Platforms: Use the internal reporting mechanisms of social media sites (Facebook, X, Instagram, etc.). They are legally obligated to act on reports involving non-consensual explicit imagery or sensitive personal data under international standards and local regulations.
Affidavit of Complaint: Seek assistance from the National Bureau of Investigation (NBI) Cybercrime Division or the Philippine National Police (PNP) Anti-Cybercrime Group. They can assist in "preserving the data" from the Service Provider.
Cease and Desist: A formal demand letter may be sent to the perpetrator to immediately remove the content, though this is often bypassed in favor of direct criminal filing if there is a risk of the evidence being deleted.

V. Summary of Liabilities

Law	Primary Focus	Key Penalty
RA 10173 (DPA)	Unauthorized use of IDs/Photos	3–7 years imprisonment; heavy fines
RA 9995 (Voyeurism)	Private acts/sexual photos	7–12 years imprisonment
RA 11313 (Safe Spaces)	Online harassment/humiliation	Fines and prision correccional
RA 10175 (Cybercrime)	Libel and Identity Theft	Increased penalties for ICT use
Civil Code	Violation of privacy/dignity	Monetary damages