Publishing the Full Text of the Data Sharing Agreement between the Bureau of Internal Revenue and the Securities and Exchange Commission

March 17, 2023 REVENUE MEMORANDUM CIRCULAR NO. 34-2023 SUBJECT : Publishing the Full Text of the Data Sharing Agreement between the Bureau of Internal Revenue and the Securities and Exchange Commission TO : All Revenue Officials, Employees and Others Concerned For the information and guidance of all concerned, attached is the full text of the Data Sharing Agreement between the Bureau of Internal Revenue and the Securities and Exchange Commission, which ensures a secure and efficient data sharing pursuant to Republic Act No. 10173 and the National Privacy Commission Circular No. 16-02. All internal revenue officers, employees and other concerned are enjoined to give this Circular the widest dissemination and publicity possible. (SGD.) ROMEO D. LUMAGUI, JR. Commissioner of Internal Revenue ATTACHMENT Data Sharing Agreement This Data Sharing Agreement (DSA) is made and entered into this _______ day of __________ 2022 by, between, and among: SECURITIES AND EXCHANGE COMMISSION , a government agency duly organized and existing under and by virtue of Commonwealth Act No. 83, otherwise known as the Securities Act, as amended, and reorganized under Republic Act No. 8799, otherwise known as the Securities Regulation Code, with principal office at the 7907 Makati Ave., Salcedo Village, Brgy. Bel-Air, Makati City represented by its Chairperson, EMILIO B. AQUINO , hereinafter referred to as "SEC"; and BUREAU OF INTERNAL REVENUE , an agency of the National Government attached to the Department of Finance (DOF), with office address at the BIR National Office Bldg., Agham Road, Diliman, Quezon City, represented herein by its Commissioner, ROMEO D. LUMAGUI, JR. , hereinafter referred to as "BIR"; (each, a "Party" and collectively the "Parties." ) WITNESSETH: WHEREAS , the SEC, as regulator of the corporate sector and the securities market under the Revised Corporation Code (RCC) and the Securities Regulation Code (SRC), and as Supervising Authority under the Anti-Money Laundering Act (AMLA), and its Implementing Rules and Regulations (IRR), collects and processes information on incorporators, stockholders, directors, trustees, members, officers, and beneficial owners of corporations, their agents and/or authorized representatives, including those of external auditors, notaries public, partners and other persons registered with or licensed by the SEC, for regulatory purposes pursuant to the SEC's statutory functions; WHEREAS , under the National Internal Revenue Code (NIRC) of 1997, as amended, the powers and duties of the BIR shall comprehend the assessment and collection of all national internal revenue taxes, fees and charges, and the enforcement of all forfeitures, penalties and fines connected therewith, including the execution of judgments in all cases decided in its favor by the Court of Tax Appeals and the ordinary courts; WHEREAS , pursuant to its lawful mandate, the SEC agrees to share the data it collects from its registered entities subject to the condition that the BIR shall implement and maintain reasonable and appropriate organizational, physical, and technical security measures for the protection and lawful use of the said data; 1 WHEREAS , the BIR agrees to treat the personal and sensitive data shared by the SEC with the utmost confidentiality, collect, process, and use the same solely for the furtherance of its lawful mandate; and comply with the provisions of this Agreement; NOW, THEREFORE , for and in consideration of the foregoing premises, the Parties mutually agree as follows that: ARTICLE I PURPOSE 1. This Data Sharing Agreement (herein referred to as "DSA") is entered into to enhance and streamline the access of BIR to corporate information including beneficial ownership information by allowing on-site and online access as well as off-site access to relevant reportorial documents by corporations in the custody of the Securities and Exchange Commission (SEC). On the other hand, the SEC may request intelligence information necessary for the performance of its function from the BIR provided that the request for information does not violate any applicable laws, rules, and regulations. ARTICLE II PERSONAL DATA DESCRIPTION AND PERSONNEL INVOLVED Personal Information Controllers . The SEC and the BIR are hereby identified as the Personal Information Controllers in this DSA. Data to be Shared . The SEC shall share to the BIR its data on corporations and other registered/licensed entities including beneficial ownership information. These data may contain Personal Information and Sensitive Personal Information such as but not limited to the complete name, specific residential address, date of birth, nationality, tax identification number; and percentage of ownership, if applicable, of the incorporators, stockholders, directors, trustees, members, officers, and beneficial owners of registered corporations, partners in a partnership and other persons licensed by the SEC. On the other hand, the SEC may request intelligence information necessary for the performance of its function from the BIR , provided that the request for information does not violate any applicable laws, rules, and regulations. 3. n Data Protection Officers . a. For the SEC , the Commission Secretary, the Director of the Enforcement and Investor Protection Department, and the Assistant Director of the Anti-Money Laundering Division of the Enforcement and Investor Protection Department are hereby designated as Data Protection Officers to carry out this Data Sharing Agreement. b. For the BIR , the Deputy Commissioner for Information Systems Group (ISG) is hereby designated as Data Protection Officer to carry out this Data Sharing Agreement. 4. The BIR shall treat the personal data shared by the SEC with the utmost confidentiality and solely for the furtherance of its lawful mandate. Unless otherwise exempted from the coverage of the Data Privacy Act, the BIR shall also inform the SEC of the following information (1) one week upon the signing of this agreement: a. Any personal information processor that will have access to or process the personal data, including the types of processing it shall be allowed to perform; b. How the party may use or process the personal data, including, but not limited to, online access; c. The remedies available to a data subject, in case the processing of personal data violates his or her rights, and how these may be exercised; d. The names and designations of personnel who will be involved in the handling of personal data, upon request OR the designated Data Protection Officer. ARTICLE III DURATION OF AGREEMENT This DSA shall remain valid and binding for five (5) years from the date of signing, unless pre-terminated by either party for reasonable ground, without prejudice to entering into a new data-sharing agreement before or upon the expiration thereof. Pre-termination shall be in writing upon the agreement by both parties. Upon the termination of the DSA, the personal data shall remain with the BIR unless otherwise instructed and agreed upon by the agencies involved in this DSA. The confidentiality obligations contained herein shall remain in force even after the termination of this Agreement. ARTICLE IV METHOD OF DISCLOSURE, TRANSFER AND PROCESSING 1. Either party will provide the relevant data and/or document to the other party either through electronic upload, electronic mail (e-mail), or personal service. The Parties undertake to ensure the security of the Personal Information, Sensitive Personal Information and other confidential information while in transit or while being transmitted through the channels or media authorized under this Agreement. Each Party shall process Personal Information, Sensitive Personal Information and other confidential information disclosed or transferred to it pursuant to this Agreement in accordance with the methods and other terms and conditions of its privacy notice, statement, or policy that apply to its processing of such personal and sensitive information. ARTICLE V SAFEGUARDS FOR DATA PRIVACY AND SECURITY 1. The parties shall establish reasonable and appropriate safeguards and security measures to ensure the confidentiality, integrity, and security of the Personal Information, Sensitive Personal Information and other classified information shared or disclosed by either party to the other party pursuant to this Agreement. The parties shall be responsible for preventing the unauthorized access and use of such Personal Information, Sensitive Personal Information and other classified information in their respective custody. Unless otherwise exempted under existing law, the parties are likewise prohibited from further sharing or disclosing such Personal Information, Sensitive Personal Information and other classified information to any unauthorized party without the prior written consent of the originating party or the Data Subjects, as appropriate. ARTICLE VI DATA BREACH MANAGEMENT 1. The parties shall regularly monitor its compliance with the security measures provided in this Agreement. If there is a breach in data security affecting Personal Information, Sensitive Personal Information, and other classified information, the party shall notify the Data Protection Officer or any other appropriate officer of the other party in writing, immediately after discovery of such data breach or upon reasonable belief that such data breach has occurred. ARTICLE VII RETENTION, DESTRUCTION OR DISPOSAL OF PERSONAL INFORMATION 1. Unless applicable laws or regulations allow or require a longer period for retention, the Personal Information, Sensitive Personal Information and other classified information subject of this Agreement shall be kept and retained by the parties so long as may be necessary for the pursuit of their lawful mandate. Upon termination of this Agreement, the parties shall, upon instruction of the other party, destroy, delete or return to the latter all Personal Information, Sensitive Personal Information and other classified information that the former received from the latter within thirty (30) days from the effective date of termination, unless the former is mandated or permitted by the applicable law to maintain a copy thereof for a longer period and subject to the internal policy of the BIR on destruction and deletion. Personal Information, Sensitive Personal Information and other classified information in the custody of a Party that requires disposal shall be disposed of and/or discarded by such Party in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other person or entity. ARTICLE VIII GOVERNING LAW; DISPUTE RESOLUTION 1. The laws of the Philippines shall govern all matters arising out of relating to this DSA. 2. Any dispute arising in the course of the execution and performance of this DSA shall be settled amicably through negotiations by the parties and/or shall make every effort to amicably resolve such dispute of difference by mutual consultation. If after thirty (30) days, no amicable settlement is reached, the parties undertake to submit their respective claims in accordance with Rules on Alternative Dispute Resolution (ADR) for Disputes between National Government Agencies. ARTICLE IX OTHER PROVISIONS 1. Each Party shall comply with the Data Privacy Act of 2012 and all other applicable data protection laws and issuances. 2. The Personal data subject whose right is violated and/or affected may exercise his/her rights provided for by the Data Privacy Act, its IRR, and other NPC issuances. 3. A copy of this Agreement may be obtained by a Personal data subject from the Office of the Data Protection Officer (DPO) of the Parties subject to processes and policies by the Parties governing such request, and prior information to the party. The Parties may redact or prevent the disclosure of any detail or information that could endanger its computer network or system, or expose to harm the integrity, availability, or confidentiality of personal data under its control or custody. Such information may include the program, web services, and encryption method in use. 4. This DSA is without prejudice to the applicability of Section 4 of the Data Privacy Act in relation to Section 5 on Special Cases particularly Sec. 5 (d), (e) and (f) of its Implementing Rules and Regulations. IN WITNESS WHEREOF , the Parties affixed their signatures this ___ day of _________, 2022 at _______________, Philippines. (SGD.) EMILIO B. AQUINO Chairperson Securities and Exchange Commission (SGD.) ROMEO D. LUMAGUI, JR. Commissioner of Internal Revenue Bureau of Internal Revenue Signed in the presence of: (SGD.) ARMANDO A. PAN, JR. Commission Secretary/Data Protection Officer Securities and Exchange Commission (SGD.) MA. ROSARIO CHARO G. ENRIQUEZ-CURIBA Deputy Commissioner/Data Protection Officer Bureau of Internal Revenue ACKNOWLEDGMENT REPUBLIC OF THE PHILIPPINES) CITY OF MAKATI) S.S. BEFORE ME , a Notary Public for and in the above-stated locality, personally this 12th day of December 2022, appeared: Name Competent Evidence of Identity Date/Place Issued Emilio B. Aquino Passport ID No. P8848594B 05 February 2022 known to me and to me known to be the very same person who executed the foregoing instrument entitled "Data-Sharing Agreement on Beneficial Ownership Information," and he/she acknowledged to me that the same is his/her own free and voluntary act and deed, and that of the entity he/she represents. This instrument refers to an Agreement consisting of 8 pages, including the page wherein this Acknowledgment is written, signed on each and every page thereof by the parties and their instrumental witnesses. WITNESS MY HAND & NOTARIAL SEAL at the place and date first above-written. (Sgd.) Atty. Jenny Lou F. Decano Administering Officer SEC, Securities Counsel II Securities and Exchange Commission Republic of the Philippines Doc. No. ____: Page No. ____: Book No. ____: Series of 2022 ACKNOWLEDGMENT REPUBLIC OF THE PHILIPPINES) CITY OF QUEZON ) S.S. BEFORE ME , a Notary Public for and in the above-stated locality, personally this ILLEGIBLE PORTION day of ____________ 2022, appeared: Name Competent Evidence of Identity Date/Place Issued ROMEO D. LUMAGUI, JR. N02-96-318966 APRIL 2, 2018/ QUEZON CITY known to me and to me known to be the very same person who executed the foregoing instrument entitled "Data-Sharing Agreement on Beneficial Ownership Information," and he/she acknowledged to me that the same is his/her own free and voluntary act and deed, and that of the entity he/she represents. This instrument refers to an Agreement consisting of 8 pages, including the page wherein this Acknowledgment is written, signed on each and every page thereof by the parties and their instrumental witnesses. WITNESS MY HAND & NOTARIAL SEAL at the place and date first above-written. (SGD.) ATTY. MARKNEIL S. COLLADO NOTARY PUBLIC FOR AND IN QUEZON CITY Appellate Division, Legal Service, BIR National Office Building Room 807, Diliman, Quezon City ADM. MATTER NO. NP-084(2022-2023) Roll of Attorney No. 60141 IBP No. 012320 (Lifetime Member) Leyte PTR No. 2438161; 1/7/2022; Quezon City My Commission Expires on December 31, 2023 Doc. No. 293 : Page No. 60 : Book No. 15 : Series of 2022 Footnotes 1. See Rule VI, Section 25, Implementing Rules and Regulations of the Data Privacy Act of 2012. n Note from the Publisher: Copied verbatim from official document.