Text
18 January 2023
Re: DISCLOSURE OF TAX DECLARATIONS OF REAL PROPERTIES AND OTHER RELATED DOCUMENTS
Dear [Redacted],
We respond to your request for an Advisory Opinion on whether the Municipal Assessor’s Office may release copies of tax declarations to persons other than the registered owner, or his/her authorized representative, without the need for the registered owner’s consent.
Discussion
You state in your letter that the Office of the Municipal Assessor of Oton, Iloilo (Municipal Assessor) received a request from the Department of Science and Technology (DOST) to be furnished copies of tax declarations, statements of account of real property taxes, and location maps of real properties allegedly owned or mortgaged to the now defunct Technology Resource Center (TRC). The request involves thirteen (13) pieces of real property, twelve of which are allegedly registered under Polyshell Industries Philippines, Inc. (Polyshell) and one (1) registered to certain individuals.
DOST’s request stems from the issuance of Governance Commission on Government-Owned and Controlled Corporations (GCG) Memorandum Order (MO) No. 2015-11 dated 27 October 2015, which states that the subject properties are now allegedly under the administration of DOST.
You also state that the counsel of Premier Islands Management Corporation (Premier), the alleged current owner of eleven (11) of the subject properties, is preventing the Municipal Assessor from releasing to the DOST copies of the requested documents. The counsel of Premier is claiming that disclosure of the requested documents to DOST would violate the Data Privacy Act of 2012 (DPA) and its Implementing Rules and Regulations (IRR) since it contains personal data.
You thus ask if the position of Premier’s counsel is legally proper.
Scope of the DPA
For perspective, the DPA applies to the processing of all types of personal information and sensitive personal information (collectively, personal data) and to any natural or juridical persons involved in the processing of personal data.1
The concept of processing of personal data under the DPA is limited only to natural persons or individuals. Data pertaining to juridical entities (e.g., corporation name, address, financial information) fall outside the scope of the DPA and are not considered as personal data.
The owner of the subject real properties in this case (i.e., Premier) is a juridical entity. As such, it is not considered as a data subject entitled to protection under the DPA and its IRR. Hence, the processing of information such as tax declarations, statements of account and location maps relating to Premier, a juridical entity, does not fall within the scope of the DPA.
Lawful Processing; Functions of Public Authority; Statutory Mandate
For the property registered to natural persons, however, the tax declaration and the other requested documents contain personal data. In which case, the DPA is applicable and the processing of personal data must find lawful basis under the DPA.
The DPA allows the processing of personal data subject to compliance with the law and strict adherence to the principles of transparency, legitimate purpose, and proportionality. For the processing of personal information, Section 12 (e) of the DPA provides:
“ SEC. 12 Criteria for Lawful Processing of Personal Information. The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following condition exists:
xxx
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; xxx” (Emphasis supplied).”2
In the same vein, Section 13(b) of the DPA allows for the processing of sensitive personal information, to wit:
“SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
xxx
(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided further, That the consent of the data subjects are not required
by law or regulation permitting the processing of the sensitive personal information or the privileged information;”3
GCG MO 2015-11 provides that all remaining functions of TRC shall be transferred to the DOST as its supervising agency. It further provides that the custody of assets of TRC shall be turned over to DOST to prevent their dissipation and shall take all proper and necessary steps to protect the interests of the government in the winding down of its operations including the preservation of its assets.
Taking these into consideration, the requested documents such as the tax declarations, statements of account and location maps are necessary for DOST to implement its mandate to preserve the assets of TRC. This means that a government agency, such as DOST, may process personal data pursuant to its statutory mandate, even without the consent of the data subject, in the exercise of its regulatory function. Hence, the requested documents may be released to DOST subject to the principles of proportionality or processing only such personal data necessary for the stated purpose, and the concomitant responsibility of the implementation of the appropriate and reasonable physical, organizational, and technical security measures to protect data.
We note that under the current scenario, consent may not be the appropriate lawful basis in the processing of data considering that the processing is necessary for the fulfillment of DOST’s statutory mandate.
Nature of tax declarations and Tax Identification Number (TIN); processing of sensitive personal information
We note that while a tax declaration, in itself, is not automatically considered sensitive personal information, the Tax Identification Number (TIN) issued to an individual is classified as sensitive personal information. Thus, the processing of tax declaration of properties belonging to natural persons fall within the ambit of the DPA and may only be processed under the circumstances provided under Section 13 of the DPA.
On the other hand, a TIN issued to a juridical entity such as the TRC or DOST is not considered as sensitive personal information under the DPA. The scope of the DPA only extends to natural persons, considered as data subjects, whose personal data are sought to be protected.
As such, the classification of TIN as sensitive personal information under the DPA is not applicable in this instance since the subject properties are allegedly owned by a corporation. Consequently, the tax declarations of the subject properties will contain the name and address of the owner-corporation, including its TIN, which are not treated as personal data under the DPA. In this case, the only personal data contained in the tax declarations would be the name and signature of the government employees who prepared and approved the same.
We emphasize that the processing of sensitive personal information is allowed under the DPA, subject to compliance with the criteria provided by law. As stated earlier, Section 13(b) of the DPA recognizes the processing of sensitive personal information when it is provided for by existing laws and regulations.4
Under Section 4(a)(4) of the DPA, any information about any individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual, such as the name of the individual on a document prepared by the individual in the course of employment with the government, falls outside the scope of the DPA. In this instance, the name and signature of the government employees who prepared and approved the tax declarations would fall squarely under this provision, and as such, outside the scope of the DPA.
We also emphasize that although tax declarations contain government-issued identifiers, such identifiers pertain to the lot itself and not to the registered owner/s. Since the scope of the DPA pertains to personal data, the data and its unique identifiers, if any, should be peculiar to an individual. In this case, since the identifiers refer to the lot and not to the individual, it does not fall under the ambit of personal data, as defined under the DPA. Further, the claim that since the statement of account of real property and location map emanate from the tax declaration and thus, must also be treated as sensitive personal information, is erroneous. To reiterate, tax declarations are not considered sensitive personal information in and of itself. The determination of whether the contents of a document is personal information or sensitive personal information depends on what is actually contained in a document and not where such document emanates from.
In the case of BGM vs. IPP5, the Commission was able to clarify that the term “processing as necessary for the establishment of legal claims” does not require an existing court proceeding.
“In the case of NPC 17-018 dated 15 July 2019, this Commission held that “processing as necessary for the establishment of legal claims” does not require an existing court proceeding. To require a court proceeding for the application of Section 13(f) to this instance would not only be to disregard the distinction provided in the law but the clear letter of the law as well. After all, the very idea of “establishment … of legal claims” presupposes that there is still no pending case since a case will only be filed once the required legal claims have already been established.”
This Commission in the same case went on further and held that: The DPA should not be seen as curtailing the practice of law in litigation. Considering that it is almost impossible for Congress to determine beforehand what specific data is “necessary” or may or may not be collected by lawyers for purposes of building a case, applying the qualifier “necessary” to the second instance in Section 13(f) therefore, serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general principles of legitimate purpose and proportionality. As regards legitimate purpose, the Implementing Rules and Regulations (IRR) of the Data Privacy Act provides that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. This means that the processing done for the establishment of a legal claim should not in any manner be outside the limitations provided by law. The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.” (underscoring supplied)
Given the above citation and assuming for the sake of argument that the tax declarations and requested documents do contain personal data, DOST’s request for copies of the tax declarations and other related documents, pursuant to its mandate to preserve the real
https://www.privacy.gov.ph/wp-content/uploads/2021/02/NPC-19-653-BGM-vs-IPP-Decision-FINAL-Pseudonymized-21Dec2020.pdf (last accessed 9 July 2021).
properties mortgaged to TRC, may be considered as an establishment or exercise of a legal claim. Hence, such processing may rely on Section 13(b) of the DPA as lawful basis.
We note that although there may be lawful basis in the processing or disclosure of documents containing personal data, personal information controllers such as the DOST must still comply with the other requirements of the DPA. In particular, the DOST must ensure that any disclosure of documents containing personal data should be limited strictly to fulfilling its mandate, which is to preserve the remaining assets of the TRC. Further, personal information controllers must also be mindful of the manner of disclosure of the requested documents through the implementation of reasonable and appropriate physical, organizational and technical security measures to ensure the protection of personal data, which are also stated in the DPA.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 4 (2012). ↩
-
Id. § 12 (e). ↩
-
Id. § 13 (b). ↩
-
Data Privacy Act of 2012, § 13 (b) (2012). ↩
-
National Privacy Commission, BGM v. IPP NPC 19-653 (Dec. 17, 2020), available at https://www.privacy.gov.ph/wp-content/uploads/2021/02/NPC-19-653-BGM-vs-IPP-Decision-FINAL-Pseudonymized-21Dec2020.pdf (last accessed 9 July 2021). ↩