NPC Issuance Wiki

NPC Advisory Opinion No. 2023-004 — Disclosure of Subscribers' Data Pursuant to Revenue Regulation No. 09-2022

Issued Advisory Opinion

Official opinion tags

Text

02 February 2023

Re: DISCLOSURE OF SUBSCRIBERS’ DATA PURSUANT TO REVENUE REGULATION NO. 09-2022

Dear [Redacted],

We respond to your inquiry on the data privacy implication of the Bureau of Internal Revenue’s (BIR) request for disclosure of the registered addresses and email addresses of Globe Telecom Inc.’s (Globe) subscribers covered by the BIR Revenue Regulation (RR) No. 09-2022.

We understand that the TRAIN Law mandates the e-Invoicing and e-Sales reporting system to be implemented on or before 01 January 2023.1 Under this program, covered taxpayers are required to electronically report its sales data to the BIR through their respective electronic point of sales systems or computerized accounting systems.

By such mandate, the BIR issued RR 09-20222 to implement the Electronic Invoicing/Receipting and Sales Reporting System (EIS). Under the EIS, the BIR will store and process the sales data of covered taxpayers using BIR’s Sales Data Transmission System and issue the corresponding sales documents through its web-based issuance facility. The EIS is primarily intended to ensure the integrity and reliability of the sales and purchases data that will be generated and verified therefrom.

We note further that the implementation of the BIR EIS would require Globe to provide the following details to the BIR:

  1. Buyer Information
  2. Buyer TIN
  3. Branch Code
  4. Registered Name
  5. Business Name/Trade Name
  6. E-mail Address
  7. Registered Address

While the above information is not explicitly enumerated in RR 09-2020, you have clarified in your 20 August 2022 email that such information is being requested in the BIR’s website particularly on the “e-invoice API Guide” page that shows the different e-invoices that will be generated in the EIS.3

You thus seek guidance if the BIR’s request for the submission of the information above, specifically the respective email and registered addresses of Globe’s subscribers, is in accordance with the DPA and its IRR. It is your position that the inclusion of the email and registered addresses may not be consistent with the principle of proportionality under the DPA given that:

a) the requirement under Section 5 (b) of the National Internal Revenue Code (NIRC) for the disclosure to the BIR of addresses refers to the addresses of juridical persons that have a connection with the taxpayer under audit/investigation, but not the address of natural persons identified as “buyers”;4 and

b) Section 113(B)(1)(4) of the NIRC limits the scope of information to be provided to the BIR in any VAT Invoice or VAT Official Receipt, to the following:

(4) In the case of sales in the amount of One thousand pesos (P1,000) or more where the sale or transfer is made to a VAT-registered person, the name, business style, if any, address and Taxpayer Identification Number (TIN) of the purchaser, customer, or client.

Discussion

Under Section 12 (c) of the DPA, there is lawful processing of personal information when it is necessary for “compliance with a legal obligation to which the personal information controller is subject.”

It appears that the BIR’s request for information, including the registered address and email address of Globe’s buyers/subscribers, is necessary to comply with the requirements of RR 09-2022 and, ultimately, the TRAIN Law.

In NPC Advisory No. 2021-045,5 we recognized the authority of the BIR in the conduct of investigation for tax purposes and confirmed that Globe may disclose the personal data requested subject to proportionality.

In the same vein, Globe must provide the personal data requested to comply with RR 09-2022. Requiring the registered address and email address of buyers/subscribers who are natural persons, is not disproportionate per se to the purpose of the tax law and BIR regulation especially since no sensitive personal information is involved.

We note that the registered address is information that is currently being required in existing paper-based documentary submissions. Furthermore, the email address serves as the taxpayer’s contact information that is reasonably necessary since the BIR shifted to a digital platform.

These are information essential for the BIR to fulfill the purpose of the EIS, that is to ensure the integrity and reliability of the sales and purchases. With the appropriate information, the BIR can check whether proper taxes are declared and paid, as well as perform its other regulatory functions.

Given the foregoing, the submission of the subscriber’s registered address and email address is considered permissible under the DPA. We note that submission of said subscriber data are necessary in compliance with the TRAIN law and BIR regulations and does not contravene the data privacy principle of proportionality.

It is worth noting that the DPA itself recognizes the necessity of personal data processing to carry out the functions of public authority. In Advisory Opinion No. 2020-16 where the Commission on Audit’s authority to process personal data in light of its constitutional mandate was duly recognized, we emphasized that the DPA shall not be used to hamper, or interfere with, the performance of the duties and functions of duly constituted public authorities.6 Thus, we take this opportunity to reiterate that the DPA, its IRR and other relevant issuances of the NPC are not meant to impede the regular functions of government agencies based on their mandates.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office

Footnotes

  1. See TRAIN Law, Section 74. A new section designated as Section 237-A under Chapter II, Title IX of the NIRC, as amended, is hereby inserted to read as follows: Sec. 237-A. Electronic Sales Reporting System. — Within five (5) years from the effectivity of this Act and upon the establishment of a system capable of storing and processing the required data, the Bureau shall require taxpayers engaged in the export of goods and services, and taxpayers under the jurisdiction of the Large Taxpayers Service to electronically report their sales data to the Bureau through the use of electronic point of sales systems, subject to rules and regulations to be issued by the Secretary of Finance as recommended by the Commissioner of Internal Revenue: Provided, That the machines, fiscal devices, and fiscal memory devices shall be at the expense of the taxpayers. The data processing of sales and purchase data shall comply with the provisions of Republic Act No. 10173, otherwise known as the “Data Privacy Act” and Section 270 of the NIRC, as amended, on unlawful divulgence of taxpayer information and such other laws relating to the confidentiality of information. The Bureau shall also establish policies, risk management approaches, actions, trainings, and technologies to protect the cyber environment, organization, and data in compliance with Republic Act No. 10175 or the “Cybercrime Prevention Act of 2012.” ↩

  2. BIR Revenue Regulation No. 09-2022, entitled, Prescribing Policies and Guidelines for the Admissibility of Sales Documents in Electronic Format in Relation to the Implementation of Sections 237, Issuance of Receipts or Sales or Commercial Invoices, and 237-A, Electronic Sales Reporting System, of the National Internal Revenue Code of 1997, as amended by R.A. No. 10963, otherwise Known as the Tax Reform for Acceleration and Inclusion or the ‘TRAIN Law. ↩

  3. API Guide, BIR, available at https://eis-cert.bir.gov.ph/#/apiGuide (last accessed 22 August 2022). ↩

  4. See NIRC, as amended, SEC. 5. Power of the Commissioner to Obtain Information, and to Summon, Examine, and Take Testimony of Persons. - In ascertaining the correctness of any return, or in making a return when none has been made, or in determining the liability of any person for any internal revenue tax, or in collecting any such liability, or in evaluating tax compliance, the Commissioner is authorized: xxx (B) To obtain on a regular basis from any person other than the person whose internal revenue tax liability is subject to audit or investigation, or from any office or officer of the national and local governments, government agencies and instrumentalities, including the Bangko Sentral ng Pilipinas and government-owned or -controlled corporations, any information such as, but not limited to, costs and volume of production, receipts or sales and gross incomes of taxpayers, and the names, addresses, and financial statements of corporations, mutual fund companies, insurance companies, regional operating headquarters of multinational companies, joint accounts, associations, joint ventures of consortia and registered partnerships, and their members; Provided, That the Cooperative Development Authority shall submit to the Bureau a tax incentive report, which shall include information on the income tax, value added tax, and other tax incentives availed of by cooperatives registered and enjoying incentives under Republic Act No. 6938, as amended: Provided, further, That the information submitted by the Cooperative Development Authority to the Bureau shall be submitted to the Department of Finance and shall be included in the database created under Republic Act No. 10708, otherwise known as “The Tax Incentives Management and Transparency Act (TIMTA). x x x” ↩

  5. National Privacy Commission, NPC Advisory Opinion No. 2021-045 (29 December 2021). ↩

  6. National Privacy Commission, NPC Advisory Opinion No. 2020-016 (12 March 2020). ↩

Backlinks

  • No backlinks found