Publishing the Full Text of the Memorandum of Agreement between the Bureau of Internal Revenue and the Civil Aviation Authority of the Philippines

January 6, 2021 REVENUE MEMORANDUM CIRCULAR NO. 010-21 SUBJECT : Publishing the Full Text of the Memorandum of Agreement between the Bureau of Internal Revenue and the Civil Aviation Authority of the Philippines TO : All Revenue Officials, Employees and Others Concerned For the information and guidance of all concerned, attached is the full text of the Memorandum of Agreement between the Bureau of Internal Revenue and the Civil Aviation Authority of the Philippines. All concerned are hereby enjoined to be guided accordingly and give this Circular a wide publicity as possible. (SGD.) CAESAR R. DULAY Commissioner of Internal Revenue ATTACHMENT MEMORANDUM OF AGREEMENT between The BUREAU OF INTERNAL REVENUE and The CIVIL AVIATION AUTHORITY OF THE PHILIPPINES KNOW ALL MEN BY THESE PRESENTS: This MEMORANDUM OF AGREEMENT is made and executed this _______ day of ______, in 2020 in Quezon City by and between: The BUREAU OF INTERNAL REVENUE (BIR) an agency of the national government duly created, organized, and existing in accordance with Philippine Law with office address at BIR National Office, BIR Road, Diliman, Quezon City, herein represented by Commissioner CAESAR R. DULAY ; EHaASD The CIVIL AVIATION AUTHORITY OF THE PHILIPPINES an agency of the national government duly created, organized, and existing in accordance with Philippine Law with office address at Old MIA Road, Pasay City, herein represented by Director General CAPTAIN JIM C. SYDIONGCO ; WHEREAS, Section 2 of Republic Act No. 10173, also known as the Data Privacy Act of 2012, provides that it is the policy of the State to protect the fundamental right of privacy of communication while ensuring free flow of information to promote innovation and growth. The State also recognizes its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected; WHEREAS, Section 22 of the Data Privacy Act provides that all sensitive personal information maintained by the government, its agencies and instrumentalities shall be secured, as far as practicable, with the use of the most appropriate standard recognized by the information and communications technology industry, and as recommended by the National Privacy Commission (NPC) and that the head of each government agency or instrumentality shall be responsible for complying with the security requirements mentioned therein; WHEREAS, Section 13 of the Data Privacy Act states that the processing of personal information is allowed if provided for by existing laws and regulations; WHEREAS, Section 5 (B) of Republic Act (R.A.) No. 8424 or the National Internal Revenue Code (NIRC) of 1997, as amended by R.A. No. 10963, otherwise known as the Tax Reform for Acceleration and Inclusion (TRAIN) law, grants the Commissioner of Internal Revenue the power to obtain on a regular basis from any person other than the person whose internal revenue tax liability is subject to investigation, or from any office or officer of the national and local governments, government agencies and instrumentalities, including the Bangko Sentral ng Pilipinas and government-owned or -controlled corporations, any information; WHEREAS, Executive Order (E.O.) No. 53 (dated 22 January 1993) directs all government agencies to provide BIR with the necessary information to help increase tax collection; WHEREAS, Section 270 of the NIRC of 1997 prohibits any officer or employee of the Bureau of Internal Revenue from divulging to any person or making known in any manner other than may be provided by law taxpayer information regarding business, income, estate, secrets operation, style of work, apparatus of any manufacturer or producer, or any confidential information regarding the business of the taxpayer, knowledge of which was acquired during the performance of duties; WHEREAS, Section 21 of the Data Privacy Act and Section 20 of its Implementing Rules and Regulations (IRR) allow on-site and online access as well as off-site access of data in the government as provided in the guidelines of the NPC; WHEREAS, NPC Circular 16-02 provides the rules governing data sharing agreements involving government agencies; DaIAcC WHEREAS, certain records, documents, data and information vital to BIR's program of augmenting the tax revenue base, enforcing tax laws, and increasing tax collections are filed and maintained by CAAP; and WHEREAS, in order to maintain the validity of its records, CAAP requires cross-referencing of its files with BIR database and vice-versa; NOW THEREFORE, for and in consideration of the foregoing premises, BIR and CAAP hereto mutually agree as follows that: 1. CAAP through the undersigned representative hereby consent to share with BIR confidential/personal data or information of their members which it collected in the performance of mandated duties and functions pursuant to Section 5 of the NIRC of 1997, as amended by the TRAIN law, to be utilized by BIR for assessment, its collection, and enforcement of national internal revenue taxes only; 2. BIR through the undersigned representative hereby consent to share with CAAP personal data or information of the taxpayers not otherwise covered by Section 270 of the NIRC of 1997, as amended, which it collected in the performance of its mandated duties and functions, subject to compliance with Section 4 of NPC Circular No. 16-02, to be utilized by CAAP for tax validation purposes only; 3. The type of personal data or information to be shared between CAAP and BIR, mode of data sharing, frequency, and other operational details shall be specified in the Technical Annex of this Memorandum of Agreement (MOA); Provided that, BIR shall not share information regarding business, income, estate, secrets operation, style of work, apparatus of any manufacturer or producer, or any confidential information regarding the business of the taxpayer, knowledge, of which was acquired during the performance of duties pursuant to Section 270 of the NIRC of 1997; 4. The operational details of this data sharing agreement shall be updated in a phased-in approach, once infrastructure is available. Provided, that such updates shall be considered amendments to this MOA. Provided further, that BIR and CAAP shall designate and authorize technical representatives to update the operational details; 5. Access to the personal data or information shall be limited to the list of BIR and CAAP officers/employees specified in the Technical Annex of this MOA. The types of processing to the data shall likewise be limited to those specified in the Technical Annex. Any modification to the access list and the types of processing allowed shall require the approval of the Commissioner of Internal Revenue for BIR and the Secretary for CAAP; 6. BIR and CAAP shall designate a Data Protection Officer prior to the signing of this MOA, who shall also stand as witnesses in the signing of this agreement; 7. BIR and CAAP shall implement appropriate security measures, as specified in the Technical Annex, to ensure protection of the personal information of data subjects, including the policy for retention, destruction and disposal of records; 8. BIR warrants to treat any and/or all information by CAAP pursuant to this MOA with utmost confidentiality, in accordance with the Data Privacy Act, and for tax assessment, collection, and enforcement purposes only. BIR further agrees to hold CAAP and its officials and employees, free and harmless from any liability of whatsoever nature and kind from the misuse of any and/or all personal data or information from CAAP or on account of any breach of confidence committed by any employee and/or authorized representative of BIR; 9. CAAP warrants to treat any and/or all information by BIR pursuant to this MOA with utmost confidentiality, in accordance with the Data Privacy Act, and for tax validation purposes only. CAAP further agrees to hold BIR and its officials and employees, free and harmless from any liability of whatsoever nature and kind from the misuse of any and/or all personal data or information from BIR or on account of any breach of confidence committed by any employee and/or authorized representative of CAAP; DHIcET 10. In case of violation of the rights of the data subject as specified in the Data Privacy Law and its IRR, he/she may file a complaint before the Commissioner of Internal Revenue for BIR and the Director General for CAAP; 11. This MOA shall take effect upon the signing thereof by the parties' authorized representatives and shall remain in full force for five years thereafter or until mutually abrogated by the parties concerned. Provided, that the effectivity of this MOA may not be extended, without prejudice to entering into a new data sharing agreement; and 12. This MOA may be accessed by concerned data subjects in accordance with the process specified in the BIR's People's Freedom of Information Manual and CAAP's People's Freedom of Information Manual. The request for information shall be addressed to the Commissioner of Internal Revenue for BIR and the Director General for CAAP. IN WITNESS WHEREOF, the parties have hereunto affixed their signatures this _______ day of _____________, 2020 in Quezon City, Philippines. HDICSa BUREAU OF INTERNAL REVENUE By: (SGD.) CAESAR R. DULAY Commissioner CIVIL AVIATION AUTHORITY OF THE PHILIPPINES By: (SGD.) CAPTAIN JIM C. SYDIONGCO Director General Signed in the presence of: (SGD.) LANEE CUI-DAVID Data Protection Officer Deputy Commissioner Information Systems Group (SGD.) MARIA NOVELITA DELA CRUZ Data Protection Officer Management Information System Division ACKNOWLEDGEMENT REPUBLIC OF THE PHILIPPINES) QUEZON CITY ) SS. Before me, a Notary Public for and in Quezon City this January 6, 2021 personally appeared: Names ID with ID Nos. Caesar R. Dulay BIR ID 21421 Jim C. Sydiongco CAAP ID No. 0001 issued July 1, 2016 known to me and to me known to be the same persons who executed the foregoing instrument and they acknowledged to me that the same is their own free and voluntary act and deed. This instrument consists of 5 pages including this page whereon the acknowledgement is taken, refers to Memorandum of Agreement Between the Bureau of Internal Revenue and the Civil Aviation Authority of the Philippines and signed by the parties and two (2) witnesses at the bottom and left margin of each and every page. In testimony whereof, I hereto set my hand and affixed my notarial seal at the place and date just above written. IDaEHC NOTARY PUBLIC Doc. No. 13 Page No. 3 Book No. 1 Series of 2021 TECHNICAL ANNEX TO MEMORANDUM OF AGREEMENT BETWEEN BUREAU OF INTERNAL REVENUE AND CIVIL AVIATION AUTHORITY OF THE PHILIPPINES This document provides the operational and technical details of the agreement between Bureau of Internal Revenue (BIR) and Civil Aviation Authority of the Philippines (CAAP) . The data specified under Paragraph I of this document shall be used primarily to validate the integrity and clean up the BIR Taxpayers' database and will be used as third-party information for tax assessment and tax audit purposes. The method, time, and frequency of transfer, as well as the security provisions, storage, retention, and disposal of data shall be specified in the succeeding paragraphs. I. DESCRIPTION OF DATA The following data, further described in Annex "A", attached to this agreement shall be shared by CAAP to BIR . II. METHOD OF DATA ACCESS OR TRANSFER Data to be transmitted by CAAP to BIR will be through the following channels whichever is applicable: Web Service with dedicated URL through internet via SFTP Hand Delivery/Collection using Removable Storage Device ( e.g. , CD, DVD, USB drive and memory stick) All data must be encrypted and must conform to AES 256 standards before transmitting the same to BIR. Transmission shall be done quarterly every 20th of the month. Note : Refer to Section 31 of the IRR of Data Privacy Act , which provides conditions for On-site and Online Access and Off-site Access. Please consider that for off-site access, only 1,000 records are allowed per transfer according to the IRR. III. ACCESS LIST The data may only be accessed by the following officers: Officer Role vis--vis Data Sharing Access Level/Processing Type Commissioner of Internal Revenue Personal Data Controller Read/Store/Dispose Deputy Commissioner, Operations Group Personal Data Processor Read/Store Deputy Commissioner, Information Systems Group Data Protection Officer Read/Store Assistant Commissioner, Assessment Service Personal Data Processor Read HREA, Assessment Service Personal Data Processor Read Division Chief, AITEID and BID Personal Data Processor Read Any modification to the above list shall require the approval of the Personal Information Controller. IV. DATA STORAGE AND RETENTION Data will be stored in a secured storage server of BIR and will be retained for ten (10) years subject to BIR's house keeping rules on electronic data/information. V. DATA DISPOSITION The BIR strictly implements measures on the disposal of data in compliance with the National Privacy Commission (NPC) Circular 16-01, Rule V, Sections 30 to 32 on Disposal of Personal Data. Data disposition shall be guided by the archiving procedure per RMO 23-2004. DTCSHA VI. SECURITY MEASURES Only authorized personnel can access the data based on the approved Security Access Matrix (SAM) by concerned BIR office/process owner. Strict compliance to all security policies and measures as defined in various BIR existing issuances such as RMO 50-2004, RMO 3-2014, RMO 12-2014 and RMO 15-2014. ANNEX A