Text
Dear ATTY. SALANDANAN-ALMEIDA,
We respond to your request for an Advisory Opinion on whether the compliance with the Bureau of Internal Revenue’s (BIR) Request for documents which may contain personal data is consistent with the Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).
On 07 March 2025, [Redacted] received an Updated Letter of Authority (LOA) from the BIR to examine their books and accounts and other accounting records for all internal revenue taxes except Value Added Tax (VAT) for the year 2022, pursuant to Sections 6(a) and 10(c) of the National Internal Revenue Code of 1997.
The BIR thereafter transmitted a First Notice dated 18 June 2025, containing a request for Globe to submit the following additional documents, among others: (1) Billing Summary File; (2) Subscriber Masterfile; (3) Billing Transaction File; and (4) Call detail record. This has raised concerns on your end as these contain the personal data of [Redacted] subscribers, such as their name, address, birthdate, mobile numbers, and call logs.
On 03 July 2025, [Redacted] wrote to BIR a request-reply to clarify or discuss the purpose of their requested documents. However, BIR issued a Second and Final Notice dated 17 July 2025, citing Section 20 of Revenue Regulation No. V-1, which stated that:
Section 20 – Inspection of Books Registered and Records – All books, registers and other records, and vouchers and other supporting papers required by these regulations shall be kept at all times at the place of business of the taxpayer, subject to inspection by any internal revenue officer, and upon demand, the same must be immediately be produced and submitted for inspection.
Thus, you now seek guidance on the proper manner of compliance that would address the BIR’s request while upholding your obligation with respect to data protection and lawful processing of personal data, citing NPC Advisory Opinion No. 2024-016 on the principle of proportionality during investigations, specifically:
While the DPA does not prohibit the BIR from processing personal data pursuant to its mandate, it must nevertheless comply with the general data privacy principles under the DPA. In this regard, the verbal request of the BIR for data relative to the TCVD appear to lack specificity as to their relevance and necessity for the stated tax compliance objectives. This absence of a clear, well-defined purpose raises concerns about whether the BIR is acting within the bounds of proportionality.
Discussion
Special cases; Processing of Personal Information by a Public Authority; Regulatory Mandate; Proportionality
Section 5 of the DPA’s Implementing Rules and Regulations provide for special cases to which it does not apply, to wit:
Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:
x x x
d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);
x x x
Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.
We have affirmed through Advisory Opinion No. 2020-015 and Advisory Opinion No. 2021-028 that the BIR’s processing of personal data pursuant to its mandate falls under the special cases of the DPA. They are the primary agency tasked with the enforcement of national internal revenue laws, deriving its authority from the NIRC. Thus, the DPA recognizes the authority of the BIR Commissioner to obtain information in the evaluation of the tax compliance of any person.
However, we have opined in Advisory Opinion No 2024-016 that:
[I]nformation required by a public authority in the exercise of its regulatory function pursuant to its constitutional or statutory mandate falls outside the DPA’s scope. However, as we have previously stated in Advisory Opinion No. 2020-015, this exemption must be interpreted strictly such that:
It applies solely to the minimum necessary collection, access, use, disclosure, or other processing related to the specific purpose, function, or activity. Any processing for regulatory purposes must comply with constitutional or statutory mandates and adhere strictly to all required substantive and procedural processes.
Only the specified information is exempt from the DPA’s provisions. The public authority remains obligated as a personal information controller (PIC) under the DPA to implement security measures for personal data protection, respect data subject rights, and follow data privacy principles.
As the primary agency tasked with the enforcement of national internal revenue laws, the BIR, through its Commissioner, is vested with the power to obtain information necessary to ensure taxpayer compliance and proper tax administration. The determination of what information is necessary for such purpose falls within the sound discretion of the BIR.
Specifically, Section 5(B) of the National Internal Revenue Code (NIRC) provides:
Section 5. Power of the Commissioner to Obtain Information, and to Summon, Examine, and Take Testimony of Persons. – In ascertaining the correctness of any return, or in making a return when none has been made, or in determining the liability of any person for any internal revenue tax, or in collecting any such liability, or in evaluating tax compliance, the Commissioner is authorized:
X X X
(B) To obtain on a regular basis from any person other than the person whose internal revenue tax liability is subject to audit or investigation, or from any office or officer of the national and local governments, government agencies and instrumentalities, including the Bangko Sentral ng Pilipinas and government-owned or-controlled corporations, any information such as, but not limited to, costs and volume of production, receipts or sales and gross incomes of taxpayers, and the names, addresses, and financial statements of corporations, mutual fund companies, insurance companies, regional operating headquarters of multinational companies, joint accounts, associations, joint ventures or consortia and registered partnerships, and their members: Provided, That the Cooperative Development Authority shall submit to the Bureau a tax incentive report, which shall include information on the income tax, value-added tax, and other tax incentives availed of by cooperatives registered and enjoying incentives under Republic Act No. 6938, as amended: Provided, further, That the information submitted by the Cooperative Development Authority to the Bureau shall be submitted to the Department of Finance and shall be included in the database created under Republic Act No. 10708, otherwise known as The Tax Incentives Management and Transparency Act (TIMTA); (Emphasis ours)
Additionally, Section 6(A) of the NIRC further empowers the Commissioner to:
Section 6. Power of the Commissioner to Make Assessments and Prescribe Additional Requirements for Tax Administration and Enforcement. –
(A) Examination of Return and Determination of Tax Due. – After a return has been filed as required under the provisions of this Code, the Commissioner or his duly authorized representative may authorize the examination of any taxpayer and the assessment of the correct amount of tax, notwithstanding any law requiring the prior authorization of any government agency or instrumentality: Provided, however, That failure to file a return shall not prevent the Commissioner from authorizing the examination of any taxpayer.
The tax or any deficiency tax so assessed shall be paid upon notice and demand from the Commissioner or from his duly authorized representative.
While the disclosure of information relating to individual taxpayers may be lawfully undertaken by the BIR, such actions are presumed to be carried out in the regular performance of its official duties. This includes the issuance of an LOA and the corresponding request for documents and information relevant to a tax investigation or audit.
We recognize [Redacted] concern regarding the disclosure of documents containing the personal data of its subscribers. However, it is important to emphasize that the BIR is acting within its statutory mandate. The issuance of its LOA and the subsequent requests for specific documents fall within its power. Notably, in NPC Advisory Opinion No. 2024-016, the BIR merely made a verbal request, as compared to the present request, which was made through an LOA.
Nonetheless, both [Redacted] and the BIR, as Personal Information Controllers (PICs), are expected to maintain appropriate safeguards in handling such data. Where it involves the personal data of subscribers, both must ensure that data sharing is clearly documented to ensure accountability. PICs, as vested by law with the safekeeping of personal information, must guard it not only based on obligation, but as a solemn trust – never swayed by whim, but based on duty and care.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) ATTY. VIDA ZORA G. BOCAR OIC-Director IV, Privacy Policy Office