NPC Issuance Wiki

NPC Advisory Opinion No. 2020-002 — Publication of the Full Content of Bureau of Internal Revenue Rulings in the BIR Website

Issued Advisory Opinion

Official opinion tags

Text

06 February 2020

Re: PUBLICATION OF THE FULL CONTENT OF BUREAU OF INTERNAL REVENUE (BIR) RULINGS IN THE BIR WEBSITE

Dear [Redacted],

We write in response to your request for an advisory opinion seeking to clarify the following matters regarding the Data Privacy Act of 20121 (DPA) and the Unlawful Divulgence Rule under Section 270 of the National Internal Revenue Code of 19972 (NIRC), as amended, in relation ease of doing business and the State’s policy of public disclosure of all its transactions involving public interest embodied in Executive Order (EO) No. 02, s. 2016.3

Specifically, you request for clarification on the following:

  1. Whether the publication of the full content of BIR Rulings may be done without violating the provisions of the DPA, as well as Section 270 of the NIRC; and
  2. If publication of the full content will violate the aforementioned laws, may publication be done through redacting and masking personal or sensitive personal information as defined under the DPA and the information covered by Section 270 of the NIRC, as amended.

Discussion

Scope of the DPA; Subject of Advisory Opinions

We wish to clarify that information of corporate taxpayers, i.e. corporate name, address, tax identification numbers, business transactions, etc. are not covered by the DPA since these pertain to information of juridical persons and does not identify an individual. As such, processing of information pertaining to such juridical entities, including publication thereof, is not governed by the DPA.

Note also that the subject of advisory opinions of the National Privacy Commission (NPC) revolves around the interpretation of the provisions of the DPA, its Implementing Rules and Regulations (IRR) and NPC issuances, compliance requirements under the DPA, enforcement of data privacy laws, and other related matters on personal data privacy, security, and protection.4

Thus, the interpretation of the provisions of the NIRC, particularly Section 270, are not within the purview of our mandate. For purposes of this advisory opinion, the discussion shall be limited to the application of the DPA, its IRR and NPC issuances on the publication of the full content of BIR Rulings.

Transparency; Public Authority; Mandate

The DPA has the twin task of protecting the fundamental human right to privacy whilst ensuring the free flow of information to promote innovation and growth.5 For this very reason, the DPA shall not operate to hinder the BIR from adopting measures that it may deem necessary and crucial to promote transparency in its transactions involving public interest, to bolster the Constitutional right of every citizen to information on matters of public concern, and to comply with EO No. 2. The DPA is not meant to prevent government institutions from processing personal data when necessary to fulfill their mandates.6

The above must be harmonized with the protection of the fundamental human right to privacy. The DPA dictates that any person or entity who processes personal and/or sensitive personal information (collectively, personal data) shall still be subject to its provisions.

Under the DPA, processing is defined as any operation or any set of operations performed upon personal information. Processing, therefore, includes publication of rulings. Sections 12 and 13 of the DPA provides for the instances wherein processing of personal and sensitive personal information, respectively, may be allowed, to wit:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: xxx (e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate. xxx

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: xxx (b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information. (Underscoring supplied)

We acknowledge the fact that BIR is a public authority tasked with the duty, among others, to ensure compliance with the NIRC and other tax laws, rules, and regulations. We also understand that BIR Rulings are official positions of the BIR on inquiries of taxpayers who request clarification on certain provisions of the NIRC, other tax laws or other implementing regulations, usually for the purpose of seeking tax exemption.7

The publication of BIR rulings is a matter of public concern as it aims to apprise taxpayers of essential information on how the BIR treats various transactions and the corresponding tax implications. This may help uninformed taxpayers on how to avail of the benefits provided under the NIRC, such compromise and abatement of tax liabilities, tax credits and refunds, among others.

Broader dissemination of BIR rulings through the BIR website may even possibly prevent tax evasion as such rulings will give taxpayers a better understanding of the tax laws and regulations and their concomitant responsibility filing the proper tax returns and paying the correct amount of taxes.

General Data Privacy Principles; Proportionality

While there may be a lawful basis for the publication of BIR rulings, the BIR, as a personal information controller, must still adhere to the general data privacy principles, particularly the principle of proportionality. This principle dictates that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.8 Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.9

We understand that the BIR collects various personal data for a better understanding of the materials facts surrounding a transaction for which a BIR ruling has been requested. These may include names, addresses, tax identification numbers, among others.

As these rulings will be published in the BIR website, it is recommended that the same be formulated in such a manner whereby only the factual circumstances of the transaction and how the BIR interprets and applies the NIRC in relation to such circumstances shall be included in the ruling, without necessarily disclosing personal data, especially sensitive personal information.

If a particular ruling cannot otherwise be crafted in the above manner, the BIR may opt to redact the ruling to be posted on the BIR website. This is similar to our previous pronouncement in Advisory Opinion No. 2018-01810 regarding the online publication of PhilHealth decisions, where we advised PhilHealth to consider posting a redacted or pseudonymized version of the decision or case digests which may be sufficient for public information.

From the foregoing, the publication of the full content of BIR Rulings may be done without violating the provisions of the DPA, considering the discussions above on the BIR’s mandate. However, bearing in mind the principle of proportionality, it is recommended that as a best practice, the BIR should endeavor to formulate these rulings without necessarily disclosing personal data, especially sensitive personal information, if feasible. In all cases, the BIR always has the option to redact the rulings to be posted on the BIR website.

This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. AN ACT AMENDING THE NATIONAL INTERNAL REVENUE CODE, AS AMENDED, AND FOR OTHER PURPOSES [“Tax Reform Act of 1997”], Republic Act No. 8424 (1997). ↩

  3. Operationalizing in the Executive Branch the People’s Constitutional Right to Information and the State Policies to Full Public Disclosure and Transparency in the Public Service and Providing Guidelines Therefor, Executive Order No. 02, s. 2016. ↩

  4. National Privacy Commission, Rules of Procedure on Requests for Advisory Opinions, Circular No. 18-01 [NPC Circular 18-01] (September 10, 2018). ↩

  5. Data Privacy Act of 2012, § 2. ↩

  6. National Privacy Commission, NPC Advisory Opinion No. 2018-083 (Nov. 26, 2018). ↩

  7. Bureau of Internal Revenue, Revenue Memorandum Order No. 9-2014 [RMO No. 9-2014] (February 6, 2014). ↩

  8. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩

  9. Ibid. ↩

  10. National Privacy Commission, NPC Advisory Opinion No. 2018-018 (12 April 2018). ↩

Backlinks