The BIR’s power to obtain information
By Nica Marsha Gasapo January 26, 2023
The Bureau of Internal Revenue (BIR) recently issued Revenue Memorandum Circular (RMC) 6-2023 dated January 16, 2023. It circularized certain advisory opinions of the National Privacy Commission (NPC) that upheld the BIR’s power to obtain personal information/sensitive personal information from any person, national/local government office or officer, government agencies and instrumentalities, and government-owned or controlled corporations for tax enforcement, assessment, and collection purposes.
Personal information refers to that from which the identity of an individual is apparent or can be reasonably and directly ascertained by whoever holds the information or when put together with other information will directly and certainly identify an individual. Sensitive personal information, meanwhile, involves that about an individual’s race, ethnic origin, marital status, age, color, religious, philosophical, or political affiliations, health, education, social security numbers, tax returns, etc.
RMC 6-2023 further relies on Section 4(e) of the Republic Act 10173 or the Data Privacy Act (DPA) of 2012, which provides that the DPA does not apply to “information necessary in order to carry out the functions of public authority which includes the processing of personal data for the performance by the independent, central monetary authority and law enforcement and regulatory agencies of their constitutionally and statutorily mandated functions.”
The RMC also cites Section 5(B) of the National Internal Revenue Code of 1997, as amended, which states that the Commissioner of Internal Revenue has the authority “to obtain on a regular basis from any person other than the person whose internal revenue tax liability is subject to audit or investigation, or from any office or officer of the national and local governments, government agencies and instrumentalities, including the Bangko Sentral ng Pilipinas and government-owned or -controlled corporations, any information such as, but not limited to, costs and volume of production, receipts or sales and gross incomes of taxpayers, and the names, addresses, and financial statements of corporations, mutual fund companies, insurance companies, regional operating headquarters of multinational companies, joint accounts, associations, joint ventures of consortia and registered partnerships, and their members.”
In NPC Advisory Opinion 2021-045 dated December 29, 2021, the commission said that the BIR had the authority to investigate social media influencers to determine their tax liabilities and compliance with tax laws and regulations.
The NPC explained that the DPA provides for specific kinds of information deemed as special cases that do not fall within the scope of the law. Section 5 of the DPA’s Implementing Rules and Regulations (IRR) states that the law and the IRR do not apply to information necessary to carry out the functions of public authority in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function. This exemption, however, must be strictly construed, the NPC said.
For the exemption to apply, the following must be remembered: the information is necessary to carry out the law enforcement or regulatory function of a public authority; the processing of the information is for the fulfillment of a constitutional or statutory mandate; there is strict adherence to due process requirements; it applies only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned; and only the special information falls outside the scope of the DPA.
The public authority, considered as a personal information controller under the DPA must still comply with the requirements of the law (e.g., implementation of reasonable and appropriate physical, organizational, and technical security measures; uphold the rights of the data subjects; and adhere to the data privacy principles of transparency, legitimate purpose, and proportionality).
Further, the NPC noted that the Tax Code empowered the BIR to obtain information, and to summon, examine, and take testimony of persons in connection with its responsibility of ascertaining the correctness of any return, making a return when none has been made, determining the liability of any person for any internal revenue tax, collecting any such liability, or evaluating tax compliance.
Similarly, in Advisory Opinion 2021-028, the NPC said that the BIR’s processing of personal data pursuant to its mandate under the Tax Code falls under the special cases of the DPA.
The NPC advised a condominium corporation that it may provide the information and/or documents requested by the BIR such as list of tenants, contracts to sell, statements of account/schedule of amortization, official receipts issued by the developer/seller for payments made, and deeds of sale. This was because such request had lawful basis and was in connection with the BIR’s Tax Verification Drive.
In Advisory Opinion 2020-015, the NPC said the BIR could process personal and sensitive information such as the list of names and tax identification numbers of Filipinos employed by resident foreign missions such as embassies and consulate offices in the Philippines. Again, the NPC justified that the BIR was authorized by law to obtain information in the evaluation of tax compliance of any person. This is especially true in cases where the BIR has identified issues of compliance with tax laws and regulations.
In sum, it must be noted that, while the BIR may have legal basis to obtain and process personal information and sensitive personal information, the obtaining and processing must be done in a secure manner and in strict adherence to and compliance with all rules and regulations.
#nationalprivacycommission #npc #birinformation #birprivacy #dataprivacyactbir #dpa #dataprivacyact #birdataprivacyact #birdataprivacy #sensitiveinformation