Text
24 February 2020
Re: COLLECTION OF PERSONAL DATA BY THE BUREAU OF INTERNAL REVENUE FOR TAX COMPLIANCE PURPOSES
Dear [Redacted],
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) which sought to clarify whether the Bureau of Internal Revenue (BIR) may process personal and sensitive personal information (collectively, personal data) such as the list of names and Taxpayer Identification Numbers (TINs) pursuant to its mandate, specifically Section 5 of the National Internal Revenue Code (NIRC) of 1997, as amended.
In your letter, you stated that the BIR issued Revenue Memorandum Circular (RMC) No. 31-2013 to resolve and correct the wrong impression that Filipinos employed by resident foreign missions, such as embassies and consulate offices, in the Philippines are exempt from tax on salaries and emoluments received from their foreign mission employers. For years, the local hires of foreign missions did not file and pay their income tax. RMC No. 31-2013 reiterated the obligation of such Filipino employees to file and pay the corresponding income taxes.
You further stated in your letter that the BIR requested for assistance from the Department of Foreign Affairs (DFA) in the course of its investigation and verification of the Filipino employees’ compliance with the RMC. In particular, the BIR asked the DFA to obtain the list of names and the corresponding TINs of the locally hired employees of the foreign missions, citing Sections 4 and 19 of the Data Privacy Act of 20121 (DPA) as legal bases for the request. Despite the foregoing, some of the embassies still refused to cooperate and claimed that the information being requested is sensitive and protected.
Discussion
Scope of the DPA; special cases; general data privacy principles; security measures
The DPA and its Implementing Rules and Regulations (IRR) provide for a list of specified information that are not covered by the law, which includes information necessary to carry out functions of a public authority, to wit:
“SECTION 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:
xxx xxx xxx
d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);
xxx xx xxx
Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.”2 (Underscoring supplied)
Based on the above, information necessary to carry out regulatory functions of a public authority, in accordance with a constitutional or statutory mandate, are outside the scope of the DPA. This exemption, however, is to be strictly construed:
-
Applies only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned. The processing for a regulatory function must be in accordance with a constitutional or statutory mandate, and strictly adheres to all required substantive and procedural processes; and
-
Only the specified information is outside the scope of the DPA. The public authority remains subject to its obligations as a personal information controller (PIC) under the DPA of implementing security measures to protect personal data, upholding the rights of data subjects, and adhering to data privacy principles.3
Public Authority; Regulatory Mandate; Limitations on Data Subjects’ Rights
The BIR is a public authority tasked with the duty to, among others, ensure compliance with the NIRC, as amended, and other relevant tax laws and issuances. Under Section 5 of the NIRC, as amended, the BIR Commissioner has the following powers:
“SEC. 5. Power of the Commissioner to Obtain Information, and to Summon, Examine, and Take Testimony of Persons. - In ascertaining the correctness of any return, or in making a return when none has been made, or in determining the liability of any person for any internal revenue tax, or in collecting any such liability, or in evaluating tax compliance, the Commissioner is authorized:
(A) To examine any book, paper, record, or other data which may be relevant or material to such inquiry;
(B) To obtain on a regular basis from any person other that the person whose internal revenue tax liability is subject to audit or investigation, … any information such as, but not limited to costs and volume of production, receipts or sales and gross income of taxpayers,…
xxx xxx xxx
(C) To summon the person liable for tax or required to file a return, or any officer or employee of such person, or any person having possession, custody, or care of the books of accounts and other accounting records containing entries relating to the business of the person liable for tax, or any other person, to appear before the Commissioner or his duly authorized representative at a time and place specified in the summons and to produce such books, papers, records, or other data, and to give testimony; xxx xxx xxx.”
From the foregoing, the BIR Commissioner is authorized by law to obtain information in the evaluation of the tax compliance of any person, specifically in this case where the BIR has already identified an issue with respect to compliance of local hires of foreign diplomatic missions in the Philippines with the NIRC and specifically, RMC No. 31-2013.
While the BIR may have a lawful basis for processing, the same should be done in a secure manner and with strict adherence to all existing rules and regulations, which may include the issuance of tax verification notices, letter notices, letter of authority, subpoena duces tecum, etc., where appropriate in the circumstances and as may be determined by the BIR.
We note that there may be some limitations with respect to the rights of the data subjects where the processing of personal data is for the purpose of investigations in relation to any tax liabilities of the data subject.4
Nonetheless, in all other cases, the BIR is expected to uphold and have mechanisms in place for the exercise of these rights.
We reiterate that the DPA is not meant to prevent government agencies from processing personal data when necessary to fulfill their mandates. Rather, the law aims to protect the right to data privacy while ensuring free flow of information. It promotes fair, secure, and lawful processing of such information.5
This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (d) (2016). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2019-022 (May 7, 2019). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2018-083 (Oct. 29, 2018). ↩