Publishing the Full Text of the Data Sharing Agreement between the Bureau of Internal Revenue and the Philippine Statistics Authority

April 22, 2022 REVENUE MEMORANDUM CIRCULAR NO. 53-2022 SUBJECT : Publishing the Full Text of the Data Sharing Agreement between the Bureau of Internal Revenue and the Philippine Statistics Authority TO : All Revenue Officials, Employees and Others Concerned For the information and guidance of all concerned, attached is the full text of the Data Sharing Agreement between the Bureau of Internal Revenue and the Philippine Statistics Authority, which ensures a secure and efficient data sharing pursuant to Republic Act No. 10173 and the National Privacy Commission Circular No. 16-02. All internal revenue officers, employees and other concerned are enjoined to give this Circular the widest dissemination and publicity possible. CAESAR R. DULAY Commissioner of Internal Revenue By: (SGD.) MARISSA O. CABREROS Deputy Commissioner Legal Group Officer-in-Charge ATTACHMENT Data Sharing Agreement KNOW ALL MEN BY THESE PRESENTS: This Data Sharing Agreement ("DSA") is made and executed, by and between: The BUREAU OF INTERNAL REVENUE (BIR) , an agency of the National Government, duly created, organized, and existing under the laws of the Philippines, with principal office address at the BIR National Office Bldg., BIR Road, Diliman, Quezon City, represented herein by its Commissioner, CAESAR R. DULAY , hereinafter referred to as the BIR; -and- The PHILIPPINE STATISTICS AUTHORITY (PSA) , an agency of the National Government, duly created, organized, and existing under the laws of the Philippines, with principal office address at 8th Floor, CRS Building, PSA Complex, East Avenue, Diliman, Quezon City, represented herein by its National Statistician and Civil Registrar General, CLAIRE DENNIS S. MAPA , hereinafter referred to as the PSA. (each, a "Party" and collectively referred to as "Parties.") WITNESSETH: WHEREAS , Section 2 of Republic Act No. 10173, also known as the Data Privacy Act (DPA) of 2012, provides that it is the policy of the State to protect the fundamental right of privacy of communication while ensuring free flow of information to promote innovation and growth. The State also recognizes its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected; WHEREAS , Section 22 of the DPA also provides that all sensitive personal information maintained by the government, its agencies and instrumentalities shall be secured, as far as practicable, with the use of the most appropriate standard recognized by the information and communications technology industry, and as recommended by the National Privacy Commission (NPC) and that the head of each government agency or instrumentality shall be responsible for complying with the security requirements mentioned therein; WHEREAS , Section 13b of the DPA allows the processing of sensitive personal information or privileged information when the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; WHEREAS , Section 23 of the DPA and Section 31 of its Implementing Rules and Regulations (IRR) allow on-site and online access as well as off-site access of data in the government as provided in the guidelines of the NPC; WHEREAS , NPC Circular 16-02 provides the rules governing DSAs involving government agencies; WHEREAS , to combat international tax evasion and avoidance and to be at par with its foreign counterparts, with the end view of sustaining a favorable investment climate, the Philippines has entered into Double Taxation Agreements or Conventions (hereinafter referred to as "DTAs") with various foreign jurisdictions. The list of treaty partners is hereto attached as Annex 1 , which may be updated by the BIR by sending a notice to the PSA every time a DTA ceases to have effect or takes into effect. Such notification shall form an integral part of the DSA; WHEREAS , the time-honored international principle of pacta sunt servanda , which has become part of the law of the land through the incorporation clause found under Section 2, Article II of the 1987 Constitution, demands the performance in good faith of treaty obligations on the part of the states that enter into the agreement; WHEREAS , the DTAs entered into by the Philippines contain a specific and independent Article on Exchange of Information (EOI) that allows the requested jurisdiction to provide information to the requesting foreign jurisdiction as is foreseeably relevant or necessary to the administration and enforcement of the domestic laws of the latter concerning taxes covered by the DTAs); WHEREAS , various information, including but not limited to, accounting, financial, property, identity, legal and beneficial ownership, survival, and immigration, are held in custody of identified individuals and other government agencies, like PSA, and are not at the immediate disposal of the BIR; WHEREAS , to enable the Philippines to effectively implement the EOI provision of such DTAs in a timely manner in accordance with the internationally agreed standard of tax information exchange set out by the Global Forum on Transparency and Exchange of Information for Tax Purposes (hereinafter referred to as the "Global Forum"), the BIR, being the government agency tasked to implement the EOI provision of the DTAs, finds it necessary to enter into a DSA with the appropriate agency or instrumentality of the National Government for the supply of such relevant information requested by the foreign jurisdiction, which may be found in its possession and/or custody; WHEREAS , the Commissioner of Internal Revenue was designated as the competent authority for the purpose of exchanging information pursuant to a valid and existing DTA and may, by virtue of a Revenue Delegation Authority Order (RDAO), authorize other competent officials of the BIR to comply with the EOI obligations of the Philippines in good faith in his stead. NOW, THEREFORE , for and in consideration of the forgoing premises, the BIR and PSA mutually agree to undertake the following: I. RESPONSIBILITIES OF THE PARTIES 1. The BIR shall undertake: a) to request assistance from the PSA for the requested information, including, but not limited to, the dates of birth and/or death of the person subject of the request and address/es per record; the identities, addresses and the respective dates of birth and/or death of his/her legal heirs; provided , That the BIR may obtain the requested information only after sending a formal letter addressed to the National Statistician and Civil Registrar General or his/her authorized representatives and signed by the Commissioner of Internal Revenue or his/her duly authorized representatives designated via a Revenue Delegation Authority Order, either through a registered mail or encrypted electronic mail (email); provided finally , that for this purpose, the BIR shall not be granted online access to personal data under the custody of the PSA; b) to maintain strict confidentiality of all information provided by the PSA and shall only disclose such information to the requesting foreign jurisdiction which, under existing DTA, is also bound by the same strict confidentiality rule on the information received; and c) to ensure the secure process of transmission of data or information to the requesting foreign jurisdiction. 2. The PSA shall undertake: a) to organize a special team that should handle all requests for EOI and to apprise the members thereof of their obligation to maintain confidentiality of all information connected thereto; b) to designate the personnel who shall act as the head of the team and who shall supervise the handling of all EOI requests; c) to provide the requested information or any alternative relevant information within fifteen (15) working days from receipt thereof via a registered mail or an encrypted email, and in the event the requested information is not immediately available, the PSA shall request for an extension not exceeding fifteen (15) working days; and d) to issue a Certification duly signed by the National Statistician and Civil Registrar General or any authorized representative in case the requested information cannot be obtained after exerting all efforts to locate it, stating such fact and the reason/s for failure to provide such information. 3. The PSA and BIR shall: a) form or organize a committee/technical working group (TWG) to effect, implement and enhance the provisions of this DSA, when necessary; b) continue to work through the established TWG in maintaining and enhancing the system of tax information exchange and in the process, advance inter-agency cooperation; c) take disciplinary action against their respective personnel who shall be found, after thorough investigation, to have violated the guidelines set forth herein. II. DATA STORAGE AND RETENTION The data received by the BIR from the PSA shall be stored in a secure filing range inside the restricted EOI room of the International Tax Affairs Division (ITAD) of the BIR and shall be retained for a minimum of five (5) years from the effectivity of this DSA. On the other hand, all requests for information received by the PSA from the BIR shall be stored in secure storage facilities of the PSA and shall also be retained for a minimum of five (5) years from the effectivity of this DSA. III. DATA DISPOSAL The BIR strictly implements measures on the disposal of data in compliance with the National Privacy Commission (NPC) Circular 16-01, Rule V, Sections 30 to 32 on Disposal of Personal Data. Data disposal shall be guided by the disposal procedures per Revenue Memorandum Order (RMO) No. 1-2020 or the Data Privacy Manual for Bureau of Internal Revenue. The PSA, on the other hand, shall be guided by the disposal procedures per Data Privacy Manual. IV. SECURITY MEASURES The BIR shall strictly comply with all security policies and measures as defined in various existing revenue issuances such as RMO No. 50-2004, RMO No. 3-2014, RMO No. 12-2014 and RMO No. 15-2014. Conversely, the PSA shall strictly comply with its Data Privacy Manual. V. CONFIDENTIALITY The Parties warrant to treat all information shared by them pursuant to this DSA with utmost confidentiality, in accordance with the Data Privacy Act, its implementing rules and regulations, and other issuances of the NPC, the confidentiality rules of the EOI provision of the DTAs, as well as the Terms of Reference related to Exchange of Information on Request (EOIR), as approved by the Global Forum, and shall not, at any time, be disclosed or caused to be disclosed to any third party other than the requesting foreign jurisdiction or to the taxpayer subject of the EOI request without the prior written consent of the other Party. The Parties further warrant to use all information received from each other only for the purposes set forth in this DSA and shall not copy, in whole or in part, such information without the other Party's prior written consent. Finally, the Parties shall return or destroy all information received from the other Party upon termination of this DSA or immediately after the lapse of the minimum retention period prescribed herein, whichever is later. VI. COMPLAINT a) In case of violation of the rights of the data subject as specified in the Data Privacy Law and its IRR, he/she may file a complaint together with copies of any evidence and affidavit/s of witness/es before the concerned Data Protection Officer/s of each Party. b) Any complaint filed by the data subject shall be resolved by the respective Data Protection Officer/s of the concerned Party in accordance with its Data Privacy Manual, the Data Privacy law and its IRR. The Data Protection Officer/s of the BIR and PSA are hereto attached as Annex 2 . Changes in the DPOs shall be communicated in writing by the concerned party to the other party and such communication shall form part an integral part of the DSA. VII. NON-LIABILITY The Parties shall be held free from liability arising from the exercise of their rights and obligations under this DSA except when such liability is attributable to the gross negligence or willful misconduct of any Party or any of its officers/representatives or employees. VIII. ACCESS TO THIS DSA This DSA may be accessed by the concerned data subjects in accordance with the process specified in Section 9 of Executive Order No. 2, otherwise known as the Freedom of Information. The request for information shall be addressed to the concerned Data Protection Officer/s. For the BIR, the request for information shall be processed pursuant to the revised Freedom of Information (FOI) Manual of BIR, as circularized in Revenue Memorandum Circular 128-2019 dated November 29, 2019. For the PSA, the request for information shall be processed pursuant to its FOI Manual dated November 2016. IX. PERSONAL DATA BREACH MANAGEMENT AND REPORTING OBLIGATION a. In case of security breach involving personal data of data subjects within its network, operating systems, software applications, data storage systems, media channels or its office policies and procedures, the concerned Party shall implement the framework for data breach management and the procedure for personal data breach notification and other requirements as provided for in the Data Privacy Act, its IRR and other issuances of the NPC specifically NPC Circular No. 16-03 on Personal Data Breach Management dated December 15, 2016. b. If any Party suspects or becomes aware of any security breach involving personal data of data subjects within its network, operating systems, software applications, data storage systems, media channels or office policies and procedures, the Party shall immediately notify the other in writing from the occurrence or discovery of the breach and shall fully cooperate to prevent or stop the personal data breach. c. Immediately following the Party's notification to the other of a personal data breach, the Parties shall coordinate with each other to investigate the said breach. Each Party agrees to fully cooperate with the other to resolve and to prevent the recurrence of a similar breach. d. Each Party shall immediately resolve any personal data breach and prevent the recurrence thereof at the Party's sole expense in accordance with the Data Privacy Act, its IRR and other issuances of the NPC. X. DUTIES OF THE PERSONAL INFORMATION CONTROLLERS The parties shall act and have duties and accountabilities of a Personal Information Controller for all personal data received from the other Party, which includes lawful, adequate, and secure processing of personal data. Further, the parties shall fully cooperate with any investigation conducted by the NPC in accordance with its policies and procedure, through its designated Data Protection Officers. XI. TERM AND TERMINATION This DSA shall take effect immediately and shall remain in full force and effect for a period of five (5) years, subject to renewal or extension at the instance of either Party, which, in no case, shall exceed a period of five (5) years. It may, however, be terminated: a. upon the expiration of its term, or any valid extension thereof; b. upon the agreement by all parties; c. upon a breach of its provisions by any of the parties; or d. where there is disagreement, upon a finding by the National Privacy Commission that its continued operation is no longer necessary, or is contrary to public interest or public policy. Notwithstanding the foregoing grounds, either Party may terminate this DSA at any time by giving written notice to the other Party thirty (30) days prior to the effectivity of the termination. XII. DISPUTE RESOLUTION The Parties shall endeavor to resolve any disagreement arising from or in connection with this DSA, in an amicable manner by direct informal negotiation. If the Parties are not able to resolve the dispute after thirty (30) days from commencement of the informal negotiations, the dispute shall be settled in accordance with the Rules on Alternative Dispute Resolution (ADR) for Disputes Between National Government Agencies before the Office of the Solicitor General (OSG). XIII. TRANSITORY PROVISION Immediately upon execution of this DSA, the duly authorized representatives of the Parties shall meet, come up with all the operational details required hereof and ensure the smooth implementation of this DSA. XIV. SEPARABILITY CLAUSE In case this DSA, or any part hereof, is found to be unconstitutional, illegal or invalid for any reason, the remainder hereof not affected by the declaration of invalidity shall remain in full force and in effect. XV. AMENDMENTS OR MODIFICATIONS Any amendment and supplement to this DSA shall be made in writing and mutually agreed upon by the Parties. XVI. RATIFICATION The Parties shall be responsible for the ratification of their respective execution of this DSA before a Notary Public. IN WITNESS WHEREOF , the parties have hereunto affixed their signatures this _____ day of ________________, 2021 in ________________, Metro Manila, Philippines. BUREAU OF INTERNAL REVENUE By: (SGD.) CAESAR R. DULAY Commissioner PHILIPPINE STATISTICS AUTHORITY By: (SGD.) CLAIRE DENNIS S. MAPA National Statistician and Civil Registrar General SIGNED IN THE PRESENCE OF: _____________________________ _____________________________ FIRST ACKNOWLEDGEMENT REPUBLIC OF THE PHILIPPINES) City of Quezon City ) S.S. BEFORE ME, a Notary Public in and for the City of Quezon City , this 13th day of August , 2021 personally appeared: Name Competent Evidence of Identity Date/Place of Issue CAESAR R. DULAY BIR ID 00021421 known to me to be the same person who executed the foregoing Data Sharing Agreement consisting of ten (10) pages, including this page but excluding annexes, and he acknowledged to me that the same is his own free and voluntary act and deed and that of the institution he represents in this instance. WITNESS MY HAND AND SEAL, this 13th day of August, 2021 in Quezon City . NOTARY PUBLIC Doc. No. 437 ; Page No. 89 ; Book No. 6 ; Series of 2021. SECOND ACKNOWLEDGEMENT REPUBLIC OF THE PHILIPPINES) City of Quezon City ) S.S. BEFORE ME, a Notary Public in and for the City of Quezon City , this 2nd day of August , 2020 personally appeared: Name Competent Evidence of Identity Date/Place of Issue CLAIRE DENNIS S. MAPA known to me to be the same person who executed the foregoing Data Sharing Agreement consisting of ____ (___) pages, including this page, and he acknowledged to me that the same is his own free and voluntary act and deed and that of the institution he represents in this instance. WITNESS MY HAND AND SEAL, this 2nd day of August, 2021 in Quezon City . (SGD.) ATTY. ELISEO S. CALMA JR. NOTARY PUBLIC Until December 31, 2021 PTR No. 0694702-D, Jan. 4, 2021 IBP No. 041058, Jan. 4, 2021 Adm Matter No. NP-067 Roll No. 50183 MCLE Comp. No. VI-0012817 Until April 14, 2022 Doc. No. 442 ; Page No. 89 ; Book No. IV ; Series of 2021. ANNEX 1 The DTA with the following countries contain an EOI provision: 1. Australia 22. Mexico 2. Austria 23. Netherlands 3. Bangladesh 24. New Zealand 4. Belgium 25. Nigeria 5. Brazil 26. Norway 6. Canada 27. Pakistan 7. China 28. Poland 8. Czech Republic 29. Qatar 9. Denmark 30. Romania 10. Finland 31. Russia 11. France 32. Singapore 12. Germany 33. Spain 13. Hungary 34. Sri Lanka 14. India 35. Sweden 15. Indonesia 36. Switzerland 16. Israel 37. Thailand 17. Italy 38. Turkey 18. Japan 39. United Arab Emirates 19. South Korea 40. United Kingdom of Great Britain and Northern Ireland 20. Kuwait 41. United States of America 21. Malaysia 42. Vietnam ANNEX 2 Data Protection Officers For the BIR: ATTY. LANEE CUI-DAVID Deputy Commissioner Information Systems Group For the PSA: ATTY. ANSARY S. COSAIN Data Protection Officer Office of the National Statistician