NPC Issuance Wiki

NPC Advisory Opinion No. 2024-016 — Disclosure of Personal Data Pursuant to a Mission Order by the Bureau of Internal Revenue

Issued Advisory Opinion

Official opinion tags

Text

ADVISORY OPINION NO. 2024-0161

11 December 2024

RE: DISCLOSURE OF PERSONAL DATA PURSUANT TO A MISSION ORDER BY THE BUREAU OF INTERNAL REVENUE

Dear [Redacted],

We respond to your inquiry on whether the disclosure of documents and information pursuant to a Bureau of Internal Revenue Mission Order (MO) violates the Data Privacy Act of 2012 (DPA).2

You inform that the [Redacted] is the subject of the BIR’s Tax Compliance Verification Drive (TCVD). Armed with an MO, the BIR revenue officers stated that the TCVD is aimed at determining whether taxes are being properly remitted for the lease of residential units at the [Redacted]. Hence, they verbally requested the [Redacted]‘s Property Management Office (PMO) for the following information:

  • A list of residential units currently being leased out;
  • Name of unit owner/s whose unit/s is/are being leased out;
  • Contact number of unit owner/s whose unit/s is/are being leased out;
  • Copies of notarized lease contracts.

You are concerned about the general nature of the MO and the request of the revenue officers, specifically on the fact that:

  1. The MO is directed only to the [Redacted] and does not list any other taxpayer/s.
  2. The request was merely made verbally despite the sensitivity of the information being requested which includes the personal information of unit owners.
  3. The ambiguity surrounding the specific transactions subject of the TCVD which the MO also failed to identify.

Hence, you inquire whether providing the requested information to the BIR would violate the DPA. In addition, you also seek guidance on the following:

  1. The types of information and documents you are permitted to provide pursuant to the MO without violating the DPA; and
  2. The specific form or documentation from the BIR that should outline the requested information and documents, as well as the activity or transaction for which the TCVD will be conducted.

Discussion

Regulatory Mandate; Processing of Personal Information by a Public Authority

The DPA and its Implementing Rules and Regulations (IRR) excludes certain types of information that are being processed by a public authority, viz.:

SECTION 5. Special Cases: The Act and these Rules do not apply to the following specified information, limited to the minimum required for collection, access, use, disclosure, or other processing necessary for the relevant purpose, function, or activity:

x x x

d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);

Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.

Hence, information required by a public authority in the exercise of its regulatory function pursuant to its constitutional or statutory mandate falls outside the DPA’s scope. However, as we have previously stated in Advisory Opinion No. 2020-015,3 this exemption must be interpreted strictly such that:

  1. It applies solely to the minimum necessary collection, access, use, disclosure, or other processing related to the specific purpose, function, or activity. Any processing for regulatory purposes must comply with constitutional or statutory mandates and adhere strictly to all required substantive and procedural processes.

  2. Only the specified information is exempt from the DPA’s provisions. The public authority remains obligated as a personal information controller (PIC) under the DPA to implement security measures for personal data protection, respect data subject rights, and follow data privacy principles.

The BIR is a public authority primarily tasked to ensure compliance with the NIRC, as amended, and other relevant tax laws and issuances. The MO itself cites Section 6(c) of the NIRC, which provides:

SECTION 6. Power of the Commissioner to Make Assessments and Prescribe Additional Requirements for Tax Administration and Enforcement.

(C) Authority to Conduct Inventory-taking, Surveillance and to Prescribe Presumptive Gross Sales and Receipts. - The Commissioner may, at any time during the taxable year, order inventory-taking of goods of any taxpayer as a basis for determining his internal revenue tax liabilities, or may place the business operations of any person, natural or juridical, under observation or surveillance if there is reason to believe that such person is not declaring his correct income, sales or receipts for internal revenue tax purposes. The findings may be used as the basis for assessing the taxes for the other months or quarters of the same or different taxable years and such assessment shall be deemed prima facie correct.

When it is found that a person has failed to issue receipts and invoices in violation of the requirements of Sections 113 and 237 of this Code, or when there is reason to believe that the books of accounts or other records do not correctly reflect the declarations made or to be made in a return required to be filed under the provisions of this Code, the Commissioner, after taking into account the sales, receipts, income or other taxable base of other persons engaged in similar businesses under similar situations or circumstances or after considering other relevant information, may prescribe a minimum amount of such gross receipts, sales and taxable base, and such amount so prescribed shall be prima facie correct for purposes of determining the internal revenue tax liabilities of such person.

It is clear that the BIR Commissioner has the legal authority to examine the business activities of any individual or entity. Moreover, the DPA itself limits the rights of data subjects where the processing of personal data is for the purpose of investigations in relation to any tax liabilities.4

We note that Section V. 1.2 of Revenue Memorandum Order (RMO) 9-2006 prescribes the guidelines and procedures in the conduct of a TCVD. Under Section V. 1.2, the Revenue District Office shall:

  1. Gather data/information for evaluation of all taxable persons/entities from the following:

    a. List of registered taxpayers from RDO records; b. List of persons who have secured Mayor’s Permit for the current year from the Office of the Mayor; c. List of big landowners of the town from the Assessor’s Office/Registry of Deeds; d. List of professionals who have secure Professional Tax Receipts (PTRs) from the Municipal Treasurer; e. List of persons engaged in business in the barangays from the Barangay Captains; f. List of stores/tenants and location map of each stores/tenants from building owners/administrators; and g. Such other data as may be gathered thru the MOA between the BIR and Bureau of Local Government Finance (BLGF) dated May 25, 1995

In line with the above RMO, the BIR is thus authorized to request related taxpayers’ information in connection with the conduct of a TCVD.

General Data Privacy Principles; Proportionality

While the DPA does not prohibit the BIR from processing personal data pursuant to its mandate, it must nevertheless comply with the general data privacy principles under the DPA. In this regard, the verbal request of the BIR for data relative to the TCVD appear to lack specificity as to their relevance and necessity for the stated tax compliance objectives. This absence of a clear, well-defined purpose raises concerns about whether the BIR is acting within the bounds of proportionality.

Considering that the MO did not indicate that there is a need to examine the tenants or unit owners’ information as part of the TCVD, these broad requests for information risk being excessive and potentially intrusive, as they may go beyond what is reasonably necessary to achieve the intended tax compliance objectives. In this case, the BIR should have stated the need to obtain the contact numbers of unit owners whose units are being leased out and copies of notarized lease contracts. These pieces of information pertain specifically to the data subjects and not to the [Redacted], which was the only listed taxpayer in the MO. Therefore, their data privacy rights must be respected and safeguarded.

Non-compliance with these principles could not only compromise individual privacy but also expose the BIR to potential violations of the DPA. Therefore, while the BIR’s TCVD aims to enhance tax compliance, it is imperative that its implementation conform to the principles of legitimate purpose and proportionality. To support the objectives of the TCVD while upholding data privacy principles, the BIR may consider reevaluating its data collection practices to ensure that each piece of requested information is necessary and proportionate to achieve its tax compliance objectives. For instance, the BIR could provide a clear justification for specific data requests, such as contact numbers of unit owners and copies of notarized lease contracts, to establish their relevance to the TCVD’s objectives. This approach would help balance regulatory requirements vis-a-vis the data privacy rights of the individuals concerned.

To determine the type of information and documents you may disclose pursuant to the MO, we suggest that if any part of the request is unclear or seems unjustified, you should seek clarification from the BIR. This can be done by requesting for clarification not as a challenge to the investigation but as a means to ensure accurate and complete compliance with the BIR’s request. This could include asking for guidance on specific document requirements or the scope of the data being sought.

To address your inquiry about the specific form or document that the BIR should provide to outline the requested information and documents, as well as the activity or transaction for which the TCVD will be conducted, it is important to note that NPC does not have the authority or jurisdiction to impose what documents or requests the BIR should provide in response to such inquiries. The BIR is responsible for establishing the regulations, formats, and templates concerning tax compliance and information requests. Therefore, consulting directly with the BIR will ensure compliance with the requirements of a TCVD and the DPA. In doing so, it is crucial to consider the principle of proportionality. The BIR should ensure that each piece of requested information is necessary and proportionate to achieve the intended tax compliance objectives. If any part of the request seems unclear or seems to involve excessive data collection, you may request clarification from the BIR on how each item relates to the tax compliance verification process. Moreover, when personal data of third parties such as tenants or property owners is involved, their data privacy rights must be respected. The BIR may also consider providing clear justifications for the relevance of certain information to ensure that only the necessary data is being gathered; thus, maintaining a balance between regulatory mandate and privacy protection.

Please be advised that the foregoing was rendered based solely on the information you provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

Please be guided accordingly.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office

Footnotes

  1. Tags: Disclosure; Personal Data; Mission Order; Bureau of Internal Revenue; Tax Compliance Verification Drive; Data Privacy Act ↩

  2. Republic Act No. 10173 (2012). ↩

  3. National Privacy Commission, NPC Advisory Opinion No. 2020-015 (Feb. 24, 2020). ↩

  4. Id., § 19. ↩

Backlinks