NPC Issuance Wiki

NPC Advisory Opinion No. 2025-005 — Request for Access to Taxpayer Information from Local Government Unit

Issued Advisory Opinion

Official opinion tags

Text

23 June 2025

Re: REQUEST FOR ACCESS TO TAXPAYER INFORMATION FROM A LOCAL GOVERNMENT UNIT.

Dear [Redacted], We respond to your request for an Advisory Opinion concerning the authority of the Bureau of Internal Revenue, through its District Offices, to access the list of registered businesses and individual taxpayers maintained by a local government unit.

Discussion

As stated in your letter, the BIR Revenue District Officer of Revenue District Office No. 47- East Makati (BIR) sent a letter dated 11 July 2023 to the Business Permits & Licensing Office (BPLO) of the City Government of Makati involving an access to records request. Particularly, the request pertained to the list of registered corporate and individual taxpayers in Barangay San Lorenzo, Makati City, including their corresponding gross receipts for the calendar year ending 31 December 2022.

In its reply, the BPLO denied the said request on the following grounds:

(1) The disclosure of the requested data cannot be made without the express consent of the data subjects; (2) There exists no Data Sharing Agreement (DSA) between the BIR and the City Government of Makati which authorizes the sharing of such information; and (3) The BPLO is not mandated to disclose such information in the absence of legal bases.

Thus, the BIR now seeks guidance as to whether such request and any subsequent disclosure would constitute a violation of the Data Privacy Act of 2012 (DPA)1 and its Implementing Rules and Regulations (IRR), notwithstanding the powers vested in the BIR under the National Internal Revenue Code of 1997, as amended (NIRC).2

Special cases; Processing of Personal Information by a Public Authority; Regulatory Mandate.

The DPA recognizes certain exceptions in favor of the processing conducted by specific public authorities, to wit:

Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:

xxx

d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);

xxx

Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.

In NPC Advisory Opinion No. 2024-016,3 we opined that:

Hence, information required by a public authority in the exercise of its regulatory function pursuant to its constitutional or statutory mandate falls outside the DPA’s scope. However, as we have previously stated in Advisory Opinion No. 2020-015,4 this exemption must be interpreted strictly such that:

  1. It applies solely to the minimum necessary collection, access, use, disclosure, or other processing related to the specific purpose, function, or activity. Any processing for regulatory purposes must comply with constitutional or statutory mandates and adhere strictly to all required substantive and procedural processes.

  2. Only the specified information is exempt from the DPA’s provisions. The public authority remains obligated as a personal information controller (PIC) under the DPA to implement security measures for personal data protection, respect data subject rights, and follow data privacy principles.

The BIR, as the primary agency tasked with the enforcement of national internal revenue laws, derives its authority from the NIRC. In furtherance of this mandate, the BIR is vested with the power to obtain information necessary to ensure taxpayer compliance and proper tax administration. Specifically, Section 5(B) of the NIRC provides:

Section 5. Power of the Commissioner to Obtain Information, and to Summon, Examine, and Take Testimony of Persons. – In ascertaining the correctness of any return, or in making a return when none has been made, or in determining the liability of any person for any internal revenue tax, or in collecting any such liability, or in evaluating tax compliance, the Commissioner is authorized:

xxx

  1. To obtain on a regular basis from any person other than the person whose internal revenue tax liability is subject to audit or investigation, or from any office or officer of the national and local governments, government agencies and instrumentalities, including the Bangko Sentral ng Pilipinas and government- owned or-controlled corporations, any information such as, but not limited to, costs and volume of production, receipts or sales and gross incomes of taxpayers, and the names, addresses, and financial statements of corporations, mutual fund companies, insurance companies, regional operating headquarters of multinational companies, joint accounts, associations, joint ventures or consortia and registered partnerships, and their members: Provided, That the Cooperative Development Authority shall submit to the Bureau a tax incentive report, which shall include information on the income tax, value-added tax, and other tax incentives availed of by cooperatives registered and enjoying incentives under Republic Act No. 6938, as amended: Provided, further, That the information submitted by the Cooperative Development Authority to the Bureau shall be submitted to the Department of Finance and shall be included in the database created under Republic Act No. 10708, otherwise known as ‘The Tax Incentives Management and Transparency Act (TIMTA); (Emphasis supplied).

Additionally, Section 6(C) of the NIRC further empowers the BIR to:

Section 6. Power of the Commissioner to Make Assessments and Prescribe Additional Requirements for Tax Administration and Enforcement. –

xxx

  1. Authority to Conduct Inventory-taking, Surveillance and to Prescribe Presumptive Gross Sales and Receipts. – The Commissioner may, at any time during the taxable year, order inventory-taking of goods of any taxpayer as a basis for determining his internal revenue tax liabilities, or may place the business operations of any person, natural or juridical, under observation or surveillance if there is reason to believe that such person is not declaring his correct income, sales or receipts for internal revenue tax purposes. The findings may be used as the basis for assessing the taxes for the other months or quarters of the same or different taxable years and such assessment shall be deemed prima facie correct. When it is found that a person has failed to issue receipts and invoices in violation of the requirements of Sections 113 and 237 of this Code, or when there is reason to believe that the books of accounts or other records do not correctly reflect the declarations made or to be made in a return required to be filed under the provisions of this Code, the Commissioner, after taking into account the sales, receipts, income or

other taxable base of other persons engaged in similar businesses under similar situations or circumstances or after considering other relevant information may prescribe a minimum amount of such gross receipts, sales and taxable base, and such amount so prescribed shall be prima facie correct for purposes of determining the internal revenue tax liabilities of such person. (Emphasis supplied).

xxx

These provisions, read together, affirm the BIR’s authority to compel access to information that are necessary to determine the tax liabilities of taxpayers. It must be emphasized that this power is not limited to direct investigation of taxpayers but extends to other entities, including local government offices such as the BPLO, which may be in possession of the requested data.

Given that this request falls within the scope of BIR’s statutory mandate and that the information being sought is in fulfillment of that mandate, such processing of personal data in this context is deemed lawful under the DPA. In this regard, Section 4 of the DPA, in relation to Section 5 of its IRR provides for a valid basis for such processing. As such, the BPLO cannot resort to invoking the absence of consent to refuse disclosure of the requested information as consent is not the only lawful criterion for processing personal data under the DPA.

Data Sharing Agreements (DSA)

The BPLO also invoked the absence of a DSA with the BIR as a ground for its refusal to disclose the requested personal data.

Under NPC Circular No. 2020-03,5 data sharing is defined as the sharing, disclosure, or transfer to a third party of personal data under the custody of a personal information controller to one or more other personal information controller/s.

A Data Sharing Agreement refers to a contract, joint issuance, or any similar document which sets out the obligations, responsibilities, and liabilities of the personal information controllers involved in the transfer of personal data between or among them, including the implementation of adequate safeguards for data privacy and security, and upholding the rights of the data subjects.

In Advisory Opinion No. 2021-043,6 the NPC clarified that the execution of a DSA is not mandatory under existing regulations:

“SECTION 8. Data sharing agreement; key considerations. — Data sharing may be covered by a data sharing agreement (DSA) or a similar document containing the terms and conditions of the sharing arrangement, including obligations to protect the personal data shared, the responsibilities of the parties, mechanisms through which data subjects may exercise their rights, among others.

The execution of a DSA is a sound recourse and demonstrates accountable personal data processing, as well as good faith in complying with the requirements of the DPA, its IRR, and issuances of the NPC. The Commission shall take this into account in case a complaint is filed pertaining to such data sharing and/or in the course of any investigation relating thereto, as well as in the conduct of compliance checks.

While the execution of a DSA is not mandatory, it is still advisable to execute one as it is a best practice and a demonstration of accountability amongst the parties to the data sharing. It is best to consult the respective data protection officers (DPOs) of the local government unit (LGU) and the PNP for a better understanding of the data sharing arrangement and whether the agencies should pursue the execution of a DSA.””

Accordingly, the mere absence of a DSA is not a valid ground for the denial of access to personal data where such access is otherwise authorized under the DPA and related regulations.

Procedural Requirements; Application of Sec. 4(e) of the DPA

While the BIR may have the statutory mandate, it is incumbent upon the agency to comply with its own procedures, as well as the internal procedures of where the data will be sourced from, which in this case, refers to the BPLO.

In NPC Advisory Opinion 2023-015,7 we discussed that for Section 4(e) of the DPA and Section 5(d) of the Implementing Rules and Regulations of the DPA to apply, the following should be considered:

 The information is necessary in order to carry out the law enforcement or regulatory function of a public authority;  The processing is for the fulfillment of a constitutional or statutory mandate;  There is strict adherence to all due process requirements;  Applies only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned; and  Only the specified information falls outside the scope of the DPA.

The public authority, considered as a personal information controller under the DPA, must still comply with the other requirements of the DPA such as the implementation of reasonable and appropriate physical, organizational and technical security measures, uphold the rights of data subjects and adhere to the data privacy principles of transparency, legitimate purpose and proportionality.”

Applying the foregoing, Section 5 of R.A. No. 108678 provides for the general investigative jurisdiction of the NBI. Meanwhile, Executive Order No. 153, Series of 2002,9 as amended by Executive Order No. 231, listed the NBI as one of the relevant agencies called to give their support, assistance, and cooperation in the identification of professional squatters and squatting syndicates, monitor and launch operations, through the proper agency or body, to curtail their activities.10

Thus, there is no doubt that the NBI’s request for information is within its investigative mandate. However, Section 4 (b) of RA 10867 itself requires the NBI to issue a subpoena when it conducts its investigation.

Hence, the officials of the Barangay may provide the personal information requested by the NBI provided that a formal subpoena has been issued to ensure that the request is authorized, proper, and lawful under existing rules and regulations.

Accordingly, while the BIR’s request for data from the BPLO falls within the scope of its lawful mandate under the NIRC, this exemption under the DPA and its IRR does not relieve the BIR from complying with applicable procedural requirements, including their internal rules and those of the BPLO. Processing based on statutory mandate does not dispense with the requirements of the DPA. Consequently, non-compliance thereto may deem the processing unlawful notwithstanding the invocation of a government mandate.

General Data Privacy Principles; Proportionality

While the processing of the taxpayers’ personal data is justified, we nonetheless remind the BIR to adhere to the general data privacy principles of transparency, legitimate purpose and proportionality.

Section 11 of the DPA mandates that personal information obtained must be:

(a) Collected for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after collection, and later processed in a way compatible with such declared, specified and legitimate purposes only; (b) Processed fairly and lawfully; (c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted; (d) Adequate and not excessive in relation to the purposes for which they are collected and processed; (e) Retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law; and (f) Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected and processed: Provided, That personal information collected for other purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in law may be stored for longer periods: Provided, further, That adequate safeguards are guaranteed by said laws authorizing their processing.

The personal information controller must ensure implementation of personal information processing principles set out herein.

Given the denial by the BPLO of your request, we recommend that the BIR formally reiterate its request for access to relevant data. The request should include a specific list of data needed, state the legal bases for the request and its compliance with procedural requirements, and affirm that all data will be processed solely for the stated purpose, in compliance with the proportionality principle under the DPA.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes (Data Privacy Act of 2012), Republic Act No. 10173 (2012) ↩

  2. National Internal Revenue Code of 1997, as amended by Republic Act No. 10963 ↩

  3. National Privacy Commission, Re: Disclosure of Personal Data Pursuant to a Mission Order by the Bureau of Internal Revenue, NPC Advisory Opinion No. 2024-016 (11 December 2024) ↩

  4. National Privacy Commission, Collection of Personal Data by the Bureau of Internal Revenue for Tax Compliance Purposes, NPC Advisory Opinion No. 2020-015 (Feb. 24, 2020) ↩

  5. National Privacy Commission, Data Sharing Agreements, NPC Circular No. 2020-03 (23 December 2020) ↩

  6. National Privacy Commission, Re: Data Sharing with the Philippine National Police, Advisory Opinion No. 2021-043 (16 December 2021) ↩

  7. National Privacy Commission, Re: Disclosure to the National Bureau of Investigation of the Record of Barangay Inhabitants, NPC Advisory Opinion No. 2023-015 (24 August 2023) ↩

  8. NBI Reorganization and Modernization Act ↩

  9. Instituting the National Drive to Suppress and Eradicate Professional Squatting and Squatting Syndicates, Amending Executive Order Nos. 178, s. 1999 and 129, s. 1993, and for Other Purposes, Executive Order No. 153 (December 10, 2002) ↩

  10. Id. § 3 ↩

Backlinks