NPC Issuance Wiki

NPC Advisory Opinion No. 2025-006 — Disclosure of Condominium Unit Owner Data to the Bureau of Internal Revenue

Issued Advisory Opinion

Official opinion tags

Text

ADVISORY OPINION NO. 2025-0061

13 August 2025

RE: DISCLOSURE OF PERSONAL DATA OF CONDOMINIUM UNIT OWNERS TO THE BUREAU OF INTERNAL REVENUE

We respond to your request for an advisory opinion seeking clarifications on whether Verve Residences Condominium Corporation (VRCC) can disclose to the Bureau of Internal Revenue (BIR) Revenue District Office (RDO) personal and sensitive personal information, (collectively personal data) of VRCC unit owners. You also seek guidance on whether the disclosure requires the consent of the unit owners under the Data Privacy Act of 2012 (DPA) and whether the requested personal data are covered by Special Cases under Section 5 of the Implementing Rules and Regulations (IRR) of the DPA.

You inform that VRCC received an “Access Letter” from BIR RDO No. 44 requesting to provide them the following information:

  • Names of the condominium unit and parking slot owners who are involved in real estate activities such as leasing, sub-leasing, Airbnb, staycations, and similar operations;
  • Tax Identification Numbers (TIN); and
  • Condominium unit and/or parking slot numbers

We understand that the BIR requested the above-enumerated information to identify condominium unit owners involved in the foregoing activities as part of the BIR’s broader initiative to enhance taxpayer knowledge, ensure compliance, and improve tax collection.

You are concerned that a DPA violation may arise if in providing information to BIR RDO No. 44, you disclose information on taxpayers that are not within the jurisdiction of the said RDO since not all unit owners of Verve Residences are registered with BIR RDO No. 44. Thus, you intend to obtain the unit owners’ consent prior to the disclosure of their personal data, hence, this request for clarifications.

Discussion

We wish to clarify that consent is just one criterion for lawful processing of both personal and sensitive personal information. Consent may not always be the most appropriate basis for processing personal data. The lawful basis to be chosen must be one that most closely reflects the true nature of the relationship with the individual and the purpose of the processing.

In the processing of personal data, there must at least be one criterion present set forth under Section 12 (for personal information) and Section 13 (for sensitive personal information and privileged information) of the DPA. In the case at hand, the disclosure of personal data of the unit owners upon the request of BIR RDO No. 44, may find basis under Section 12 (c) and Section 13 (f) of the DPA, which state that:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

xxx

(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;

xxx

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

xxx

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority. (Emphasis supplied)

These provisions provide for the most appropriate lawful criteria for processing of personal data where processing is necessary for compliance with a legal obligation, in this case the BIR which is a public authority. Considering that there exists a lawful criterion for processing, consent may no longer be required from the unit owners, provided that applicable laws, policies, and procedures are duly followed.

Scope of the DPA; Special Cases Under the DPA; BIR Mandate Under the Tax Code, as Amended; Powers of the BIR Commissioner; Regulatory Mandate; Processing of Personal Information by a Public Authority

In relation to the above-cited criteria for lawful processing, the DPA and its IRR recognize certain exceptions in favor of the processing conducted by specific public authorities, to wit:

Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:

xxx

d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);

xxx

Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity. (Emphasis supplied)

Likewise, NPC Advisory Opinion No. 2020-0152 and Advisory Opinion No. 2021-0283 state that the BIR’s processing of personal data pursuant to its mandate falls under the special cases of the DPA.

In the above-cited Advisory Opinions, it was mentioned that the BIR is a public authority tasked with the duty to, among others, ensure compliance with the National Internal Revenue Code (NIRC), as amended, and other relevant tax laws and issuances, and that the DPA recognizes the authority of the BIR Commissioner to obtain information in the evaluation of the tax compliance of any person.

Additionally, NPC Advisory Opinion No. 2024-0164 states that: “xxx information required by a public authority in the exercise of its regulatory function pursuant to its constitutional or statutory mandate falls outside the DPA’s scope. However, as we have previously stated in Advisory Opinion No. 2020-015, this exemption must be interpreted strictly such that:

  1. It applies solely to the minimum necessary collection, access, use, disclosure, or other processing related to the specific purpose, function, or activity. Any processing for regulatory purposes must comply with constitutional or statutory mandates and adhere strictly to all required substantive and procedural processes.

  2. Only the specified information is exempt from the DPA’s provisions. The public authority remains obligated as a personal information controller (PIC) under the DPA to implement security measures for personal data protection, respect data subject rights, and follow data privacy principles.”

The BIR, as the primary agency tasked with the enforcement of national internal revenue laws, derives its authority from the NIRC. In furtherance of this mandate, the BIR is vested with the power to obtain information necessary to ensure taxpayer compliance and proper tax administration. Given that the request for personal data through “Access Letter” falls within the scope of BIR’s statutory mandate and that the information being sought is in fulfillment of that mandate, such processing of personal data in this context is deemed lawful under the DPA. In this regard, Section 12 (c) and Section 13(f) of the DPA, in relation to Section 5 of its IRR provide valid bases for such processing. Hence, you may provide the information requested by BIR RDO No. 44 pursuant to the agency’s mandate sans consent from the unit owners. Nevertheless, while you may have a lawful basis for processing, the same should be done with strict adherence to the general data privacy principles.5

Principle of Proportionality; Privacy Notice

The DPA clarifies that processing, even if pursuant to a legal mandate, must be done lawfully and fairly, with strict adherence to the general data privacy principles of transparency, legitimate purpose, and proportionality.6

In particular, the principle of proportionality requires that personal information for processing must be accurate, relevant, adequate, and not excessive in relation to the specified and declared purpose. In addition, personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means. As such, it is crucial to ensure that the information to be disclosed should be limited only to what is necessary to achieve the objectives of the declared purpose.7

Further, when personal data of third parties such as tenants or property owners are involved, their data privacy rights must be respected. The BIR may also consider providing clear justifications for the relevance of certain information to ensure that only the necessary data is being gathered; thus, maintaining a balance between regulatory mandate and privacy protection.

In this regard, you may utilize your privacy notices to clearly articulate the legal basis for the processing of unit owners’ data, particularly for documents required by the BIR. Such privacy notice serves to inform the data subjects of the lawful basis being relied upon, especially in instances where consent is not the sole or primary basis for the processing.

Having an adequate privacy notice reinforces the principles of transparency and legitimate purpose and may further be supported by customizing privacy clauses to reflect the scope and extent of the documents that are being processed. Thus, in keeping with the data privacy principles, a privacy notice provides details to affected data subjects on what, how and why personal data is being collected from them which can, in this case, address any concerns which may arise in relation to the processing of personal data and BIR’s authority to access the same.

Finally, to address your concern about the personal data of unit owners outside of BIR’s jurisdiction, we recommend consulting directly with the BIR for clarification as questions of jurisdiction of the BIR are no longer within the scope of the Commission. In doing so, it is crucial to consider the principle of proportionality. It must be ensured that each piece of requested information is necessary and proportionate to achieve the intended tax compliance objectives. If any part of the request seems unclear or seems to involve excessive data collection, you may request clarification from the BIR on how each item relates to the fulfillment of the latter’s mandate.8

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) ATTY. VIDA ZORA G. BOCAR OIC-Director IV, Privacy Policy Office

Footnotes

  1. Tags: Disclosure; Personal Data; Condominium Unit Owners; Bureau of Internal Revenue; Tax Compliance; Data Privacy Act. ↩

  2. National Privacy Commission, Re: Collection of Personal Data by the Bureau of Internal Revenue for Tax Compliance Purposes, Advisory Opinion No. 2020-015 (24 February 2020). ↩

  3. National Privacy Commission, Re: Disclosure of Personal Data of Condominium Unit Owners/Tenants to the Bureau of Internal Revenue by Condominium Corporation to the Bureau of Internal Revenue, Advisory Opinion No. 2021-028 (16 July 2021). ↩

  4. National Privacy Commission, NPC Advisory Opinion No. 2024-016 (December 2024). ↩

  5. National Privacy Commission, Re: Request for Access to Taxpayer Information from a Local Government Unit, Advisory Opinion No. 2025-005 (23 June 2025). ↩

  6. Data Privacy Act of 2012 (DPA), § 11. ↩

  7. National Privacy Commission, Re: Disclosure of Personal Data Pursuant to a Department of Agriculture’s Database for Audit Preparation Purposes, Advisory Opinion No. 2025-001 (20 March 2025). ↩

  8. Ibid. ↩

Backlinks

  • No backlinks found