Text
20 July 2018
RE: BUREAU OF INTERNAL REVENUE REQUEST FOR INFORMATION
Dear [Redacted],
We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) on 13 July 2018 for a clarification on whether the Philippine Medical Association (PMA) may disclose information to the Bureau of Internal Revenue (BIR).
Specifically, the BIR Collection Service through an Access Letter dated 11 July 2018, attached as Annex “A”, requested from the PMA a Certification indicating the status of the membership in the PMA of a certain individual. The BIR provided the name and registered address of the said person. In addition, the BIR further requested for the name/s of any entity affiliated to the said person in the conduct of his medical practice to be included in the Certification.
The BIR cited Section 5(B) of the National Internal Revenue Code (Tax Code) as basis for its request for information. Said section provides as follows:
SEC. 5. Power of the Commissioner to Obtain Information, and to Summon, Examine, and Take Testimony of Persons. – In ascertaining, the correctness of any return, or in making a return when none has been made, or in determining the liability of any person for any internal revenue tax, or in collecting any such liability, or in evaluating tax compliance the Commissioner is authorized:
xxx xxx xxx
(B) To obtain on a regular basis from any person other than the person whose internal revenue tax liability is subject to audit or investigation, or from any office or officer of the national and local governments, government agencies and instrumentalities, including the Bangko Sentral ng Pilipinas and government-owned or -controlled corporations, any information such as, but not limited to, costs and volume of production, receipts or sales and gross incomes of taxpayers, and the names, addresses, and financial statements of corporations, mutual fund companies, insurance companies, regional operating headquarters of multinational companies, joint accounts, associations, joint ventures or consortia and registered partnerships, and their members: Provided, That the Cooperative Development Authority shall submit to the Bureau a tax incentive report, which shall include information on the income tax, value-added tax, and other tax incentives availed of by cooperatives registered and enjoying incentives under Republic Act No. 6938, as amended: Provided, further, That the information submitted by the Cooperative Development Authority to the Bureau shall be submitted to the Department of Finance and shall be included in the database created under Republic Act No. 10708, otherwise known as ‘The Tax Incentives Management and Transparency Act (TIMTA).”
Discussion
Republic Act No. 10173,1 known as the Data Privacy Act of 2012 (DPA), provides the criterion for lawful processing of personal information under Section 12(e), i.e. that the processing is necessary in order to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate.
The Implementing Rules and Regulations (IRR) of the DPA defines a public authority as any government entity created by the Constitution or law and vested with law enforcement or regulatory authority and functions.2
The BIR is a public authority. Its powers and duties shall comprehend the assessment and collection of all national internal revenue taxes, fees, and charges, and the enforcement of all forfeitures, penalties, and fines connected therewith, including the execution of judgments in all cases decided in its favor by the Court of Tax Appeals and the ordinary courts.3 The BIR shall give effect to and administer the supervisory and police powers conferred to it by the Tax Code or other laws.4
Be that as it may, it is incumbent upon the BIR to demonstrate that the information being requested from the PMA is necessary in order to fulfill its function of determining the liability of any person for any internal revenue tax, or in collecting any such liability, or in evaluating tax compliance.5
Prior to disclosing the requested information, it is advisable for the PMA to ask and clarify from the BIR the relation of the PMA Certification indicating the status of the membership of a person vis-à-vis the BIR audit or investigation of the tax liabilities, if any, of the said person following the general data privacy principles of legitimate purpose and proportionality. The BIR Access Letter provided the contact details of the Chief of its Accounts Receivable Monitoring Division (ARMD) for any clarifications on the request.
This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 3(r) (2016). ↩
-
An Act Amending the National Internal Revenue Code, as Amended, and for Other Purposes [TAX REFORM ACT OF 1997], Republic Act No. 8424 (1997) ↩
-
Id., § 2 ↩
-
Id., § 5 ↩