The Personal Data Protection Committee (PDPC) is investigating leaked ID-card photos and personal data from government databases (Department of Land Transport and Department of Provincial Administration) posted online, and says it is treating the case as illegal access under Computer Crime Act section 7. Action covers the people who post or share the data, the database operators, and the networks that sell access. For a small business, the practical point is: do not open or forward such links, and review who can access customer ID copies and records you hold, since PDPC can take complaints from data subjects whose information was exposed.