Publishing the Full Text of the Memorandum of Agreement between the Bureau of Internal Revenue and the Land Registration Authority

March 3, 2020 REVENUE MEMORANDUM CIRCULAR NO. 123-20 SUBJECT : Publishing the Full Text of the Memorandum of Agreement between the Bureau of Internal Revenue and the Land Registration Authority TO : All Revenue Officials, Employees and Others Concerned For the information and guidance of all concerned, attached is the full text of the Memorandum of Agreement between the Bureau of Internal Revenue and the Land Registration Authority. HTcADC All concerned are hereby enjoined to be guided accordingly and give this Circular a wide publicity as possible. (SGD.) CAESAR R. DULAY Commissioner of Internal Revenue ATTACHMENTS Memorandum of Agreement between the Bureau of Internal Revenue and the Land Registration Authority KNOW ALL MEN BY THESE PRESENTS: This MEMORANDUM OF AGREEMENT is made and executed this 3rd day of March, in 2020 in Quezon City by and between: The BUREAU OF INTERNAL REVENUE (BIR) an agency of the national government duly created, organized, and existing in accordance with Philippine Law, with office address at BIR National Office, BIR Road, Diliman, Quezon City, herein represented by Commissioner CAESAR R. DULAY; The LAND REGISTRATION AUTHORITY (LRA) an agency of the national government duly created, organized, and existing in accordance with Philippine Law, with office address at LRA Compound, East Avenue, Diliman, Quezon City, herein represented by Administrator RENATO D. BERMEJO. WHEREAS, Section 2 of Republic Act No. 10173, also known as the Data Privacy Act of 2012, provides that it is the policy of the State to protect the fundamental right of privacy of communication while ensuring free flow of information to promote innovation and growth. The State also recognizes its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected; WHEREAS, Section 22 of the Data Privacy Act provides that all sensitive personal information maintained by the government, its agencies and instrumentalities shall be secured, as far as practicable, with the use of the most appropriate standard recognized by the information and communications technology industry, and as recommended by the National Privacy Commission (NPC) and that the head of each government agency or instrumentality shall be responsible for complying with the security requirements mentioned therein; WHEREAS, Section 12 of the Data Privacy Act states that the processing of personal information is allowed if not otherwise prohibited by law and the processing is necessary in order to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; WHEREAS, Section 13 of the Data Privacy Act states that the processing of sensitive personal information and privileged information is prohibited except if the processing of the same is provided for by existing laws and regulations, provided that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information and provided further that consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; WHEREAS, Section 5 (B) of Republic Act (R.A.) No. 8424 or the National Internal Revenue Code (NIRC) of 1997, as amended by R.A. No. 10963, otherwise known as the Tax Reform for Acceleration and Inclusion (TRAIN) law, grants the Commissioner of Internal Revenue the power to obtain on a regular basis from any person other than the person whose internal revenue tax liability is subject to investigation, or from any office or officer of the national and local governments, government agencies and instrumentalities, including the Bangko Sentral ng Pilipinas and government-owned or -controlled corporations, any information such as, but not limited to, costs and volume of production, receipt or sales and gross incomes of taxpayers, and the names, addresses, and financial statements of corporations, mutual fund companies, insurance companies, regional operating headquarters of multinational companies, joint accounts, associations, joint ventures of consortia and registered partnerships, and their members; WHEREAS, Executive Order (E.O.) No. 53 dated 22 January 1993 directs all government agencies to provide BIR with the necessary information to help increase tax collection; WHEREAS, Section 270 of the NIRC of 1997 prohibits any officer or employee of the Bureau of Internal Revenue from divulging to any person or making known in any manner other than may be provided by law taxpayer information regarding business, income, estate, secrets operation, style of work, apparatus of any manufacturer or producer, or any confidential information regarding the business of the taxpayer, knowledge of which was acquired during the performance of duties; WHEREAS, Section 23 of the Data Privacy Act and Section 31 of its Implementing Rules and Regulations (IRR) allow on-site and online access as well as off-site access of data in the government as provided in the guidelines of the NPC; WHEREAS, NPC Circular 16-02 provides the rules governing data sharing agreements involving government agencies; WHEREAS, certain records, documents, data and information vital to BIR's program of augmenting the tax revenue base, enforcing tax laws, and increasing tax collections are filed and maintained by LRA; and WHEREAS, in order to maintain the validity of its records, LRA requires cross-referencing of its files with BIR database and vice-versa. aScITE NOW THEREFORE, for and in consideration of the foregoing premises, BIR and LRA hereto mutually agree as follows that: 1. LRA, through the undersigned representative, hereby consents to share with BIR personal data or information of the registered property owners relevant to land titles which it registered in the performance of its mandated duties and functions, to be utilized by BIR for assessment, collection, and enforcement of national internal revenue taxes only, subject to compliance with Section 4 of NPC Circular No. 16-02; 2. BIR, through the undersigned representative, hereby consents to share with LRA personal data of taxpayers not otherwise covered by Section 270 of the NIRC of 1997, as amended, which it collected in the performance of its mandated duties and functions, subject to compliance with Section 4 of NPC Circular No. 16-02, to be utilized by LRA for tax validation purposes only; 3. The type of personal data to be shared between LRA and BIR, mode of data sharing, frequency, and other operational details shall be specified in the Technical Annex of this Memorandum of Agreement (MOA); Provided that , BIR shall not share information regarding business, income, estate, secrets operation, style of work, apparatus of any manufacturer or producer, or any confidential information regarding the business of the taxpayer, knowledge of which was acquired during the performance of duties pursuant to Section 270 of the NIRC of 1997; 4. The operational details of this data sharing agreement shall be updated in a phased-in approach, using the available infrastructure of each agency: Provided , that such updates shall be considered amendments to this MOA and shall conform with Section 15 of NPC Circular 16-02: Provided further , that BIR and LRA shall designate and authorize technical representatives to update the operational details; 5. Access to the shared personal data shall be limited to the list of BIR and LRA officers/employees specified in the Technical Annex of this MOA. The types of processing to the shared data shall likewise be limited to those specified in the Technical Annex. Any modification to the access list and the types of processing allowed shall require the approval of the Commissioner of Internal Revenue for BIR and the Administrator for LRA; Provided , that personal data shared between the LRA and the BIR shall not be divulged by each party to third parties; 6. BIR and LRA shall designate their respective Data Protection Officers prior to the signing of this MOA, who shall stand as witnesses in the signing of this Agreement; 7. BIR and LRA shall implement appropriate security measures, as specified in the Technical Annex, to ensure protection of the personal information of data subjects, including the policy for retention, destruction and disposal of records; 8. BIR warrants to treat any and/or all information shared to it by LRA pursuant to this MOA with utmost confidentiality, in accordance with the Data Privacy Act, and for tax assessment, collection, and enforcement purposes only. BIR further agrees to hold LRA and its officials and employees, free and harmless from any liability of whatsoever nature and kind from the misuse of any and/or all personal data or information from LRA or on account of any breach of confidence committed by any employee and/or authorized representative of BIR; 9. LRA warrants to treat any and/or all information shared to it by BIR pursuant to this MOA with utmost confidentiality, in accordance with the Data Privacy Act. LRA further agrees to hold BIR and its officials and employees, free and harmless from any liability of whatsoever nature and kind from the misuse of any and/or all personal data or information from BIR or on account of any breach of confidence committed by any employee and/or authorized representative of LRA; 10. In case of violation of the rights of the data subject as specified in the Data Privacy Law and its IRR, he/she may file a complaint before the Commissioner of Internal Revenue for BIR and the Administrator for LRA; 11. This MOA shall take effect upon the signing thereof by all parties and will remain in full force for five (5) years from date thereof, unless sooner terminated by both parties concerned, without prejudice to entering into a new data sharing agreement; and 12. This MOA may be accessed by concerned data subjects in accordance with the process specified in the BIR's People's Freedom of Information Manual and LRA's People's Freedom of Information Manual. The request for information shall be addressed to the Commissioner of Internal Revenue for BIR and the Administrator for LRA. IN WITNESS WHEREOF, the parties have hereunto affixed their signatures this ILLEGIBLE PORTION 3rd day of March, 2020 in Quezon City, Philippines. BUREAU OF INTERNAL REVENUE By: (SGD.) CAESAR R. DULAY Commissioner LAND REGISTRATION AUTHORITY By: Authority of the Administrator (SGD.) RONALD A. ORTILE, CESO II Deputy Administrator (By virtue of A.O. No. 2020-23 dated January 21, 2020) Signed in the presence of: (SGD.) LANEE CUI-DAVID Data Protection Officer Deputy Commissioner Information Systems Group (SGD.) NESTOR I. MISALUCHA Data Protection Officer Acting Chief of Information and Communications Technology Division Acknowledgment REPUBLIC OF THE PHILIPPINES ) ) SS. Before me, a Notary Public for and in Quezon City this March 3, 2020 personally appeared: HEITAD Names ID with ID Nos. Caesar R. Dulay BIR ID 21421 Ronald A. Ortile LRA ID 2008011 known to me and to me known to be the same persons who executed the foregoing instrument and they acknowledged to me that the same is their own free and voluntary act and deed. This instrument consists of 6 pages including this page whereon the acknowledgment is taken, refers to Memorandum of Agreement between the Bureau of Internal Revenue and the Land Registration Authority and signed by the parties and two (2) witnesses at the bottom and the left margin of each and every page. In testimony whereof, I hereunto set my hand and affixed my notarial seal at the place and date just above written. Doc. No. 7; Page No. 2; Book No. 3; Series of 2020 Technical Annex to Memorandum of Agreement between Bureau of Internal Revenue and Land Registration Authority This document provides the operational and technical details of the agreement between Bureau of Internal Revenue (BIR) and Land Registration Authority (LRA) . The data specified under Paragraph I of this document shall be used primarily to validate the integrity and clean up the BIR Taxpayers' database and will be used as third-party information for tax assessment and tax audit purposes. The method, time, and frequency of transfer, as well as the security provisions, storage, retention, and disposal of data shall be specified in the succeeding paragraphs. I. DESCRIPTION OF DATA The following data, further described in Annex "A", attached to this agreement shall be shared by LRA to BIR . II. METHOD OF DATA ACCESS OR TRANSFER Data to be transmitted by LRA to BIR will be through the following channels whichever is applicable: For the initial bulk submission, data will be transferred via Secure File Transfer Protocol (SFTP) For succeeding transmissions, data will be extracted by BIR from the existing eCAR Web Service All data must be encrypted and must conform to AES 256 standards before transmitting the same to BIR. Transmission shall be done quarterly every 20th of the month. Note : Refer to Section 31 of the IRR of Data Privacy Act , which provides conditions for On-site and Online Access and Off-site Access. Please consider that for off-site access, only 1,000 records are allowed per transfer according to the IRR. III. ACCESS LIST The data may only be accessed by the following officers: Officer Role vis--vis Data Sharing Access Level/Processing Type Commissioner of Internal Revenue Personal Data Controller Read/Store/Dispose Deputy Commissioner, Operations Group Personal Data Processor Read/Store Deputy Commissioner, Information Systems Group Data Protection Officer Read/Store Assistant Commissioner, Assessment Service Personal Data Processor Read HREA, Assessment Service Personal Data Processor Read Division Chief, AITEID and BID Personal Data Processor Read Any modification to the above list shall require the approval of the Personal Information Controller. IV. DATA STORAGE AND RETENTION Data will be stored in a secured storage server of BIR and will be retained for ten (10) years subject to BIR's house keeping rules on electronic data/information. V. DATA DISPOSITION The BIR strictly implements measures on the disposal of data in compliance with the National Privacy Commission (NPC) Circular 16-01, Rule V, Sections 30 to 32 on Disposal of Personal Data. Data disposition shall be guided by the archiving procedure per RMO 23-2004. ATICcS VI. SECURITY MEASURES Only authorized personnel can access the data based on the approved Security Access Matrix (SAM) by concerned BIR office/process owner. Strict compliance to all security policies and measures as defined in various BIR existing issuances such as RMO 50-2004, RMO 3-2014, RMO 12-2014 and RMO 15-2014. ANNEX A Description of Data