Publishing the Full Text of the Memorandum of Agreement between BIR and DTI

May 5, 2021 REVENUE MEMORANDUM CIRCULAR NO. 61-2021 SUBJECT : Publishing the Full Text of the Memorandum of Agreement between the Bureau of Internal Revenue and the Department of Trade and Industry TO : All Revenue Officials, Employees and Others Concerned For the information and guidance of all concerned, attached is the full text of the Memorandum of Agreement between the Bureau of Internal Revenue and the Department of Trade and Industry. All concerned are hereby enjoined to be guided accordingly and give this Circular a wide publicity as possible. (SGD.) CAESAR R. DULAY Commissioner of Internal Revenue ATTACHMENT MEMORANDUM OF AGREEMENT (MOA) between The BUREAU OF INTERNAL REVENUE and The DEPARTMENT OF TRADE AND INDUSTRY KNOW ALL MEN BY THESE PRESENTS: This AGREEMENT is made and executed this 7th day of May in 2021 in Makati City by and between: The BUREAU OF INTERNAL REVENUE (BIR) an agency of the national government duly created, organized, and existing in accordance with Philippine Law with office address at BIR National Office, BIR Road, Diliman, Quezon City, herein represented by Commissioner CAESAR R. DULAY ; and The DEPARTMENT OF TRADE AND INDUSTRY (DTI) an agency of the national government duly created, organized, and existing in accordance with Philippine Law with office address at 5F Industry and Investments Bldg., 385 Sen. Gil Puyat Ave., Makati City, herein represented by Secretary RAMON M. LOPEZ ; aScITE (collectively referred to as the "Parties" and individually referred to as a "Party"). WHEREAS, the BIR is mandated by Republic Act (R.A.) No. 8424 or the National Internal Revenue Code (NIRC) of 1997 to comprehend the assessment and collection of all national internal revenue taxes, fees, and charges, and the enforcement of all forfeitures, penalties, and fines connected therewith; WHEREAS, R.A. No. 9480 (dated 24 May 2007) authorizes and grants a tax amnesty covering all national internal revenue taxes for the taxable year 2005 and prior years, with or without assessments duly issued therefor, that have remained unpaid as of 31 December 2005; WHEREAS, R.A. No. 9480 requires any person availing the tax amnesty under the Act to file with BIR a notice and Tax Amnesty Return accompanied by a Statement of Assets, Liabilities and Networth (SALN) as of 31 December 2005; WHEREAS, for purposes of enhancing revenue administration, revenue collection and policy formulation, R.A. No. 9480 has directed the Department of Finance, in coordination with the BIR, DTI, and other concerned agencies, to institute an Information Management Program for the effective use of the information declared or obtainable from the Tax Amnesty Returns and the SALNs required to be filed under the Act; WHEREAS, Executive Order (E.O.) No. 53 (dated 22 January 1993) directs all agencies and instrumentalities of the government to provide BIR with the necessary information relevant to its mission of effectively implementing revenue laws; WHEREAS, Section 5 (B) of R.A. No. 8424, as amended by R.A. No. 10963 (dated 27 December 2017), otherwise known as the Tax Reform for Acceleration and Inclusion (TRAIN) law, grants the Commissioner of Internal Revenue the power to obtain any information on a regular basis from any person other than the person whose internal revenue tax liability is subject to investigation, or from any office or officer of the national and local governments, government agencies and instrumentalities; WHEREAS, DTI as the primary arm of the Executive Branch of the government for the coordination, promotion, facilitation and regulation in the area of trade, industry and investment; WHEREAS, Act No. 3883 was issued to regulate the use in business transactions of names other than true names, wherein a person intending to engage in business is required to first register with then Director of Commerce (now the DTI) a name, other than its true name, before such name is used in any business transactions; WHEREAS, the records, documents, data and information, which are necessary in the institution of the Information Management Program and are vital to BIR's program of augmenting the tax revenue base, enforcing tax laws, and increasing tax collections, are filed before and maintained by DTI; HEITAD WHEREAS, to assist in the institution of the Information Management Program and to maintain the validity of its records, cross-referencing and sharing of personal, confidential, and privileged data between the DTI and BIR is necessary; WHEREAS, in the sharing of personal information the Parties acknowledge the vital role of communication and information in nation-building under Article II, Section 24, of the 1987 Constitution; WHEREAS, Section 2 of Republic Act No. 10173, also known as the Data Privacy Act of 2012, similarly provides that it is the policy of the State to protect the fundamental right of privacy of communication while ensuring free flow of information to promote innovation and growth and recognizes its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected; WHEREAS, Section 22 of the Data Privacy Act provides that all sensitive personal information maintained by the government, its agencies and instrumentalities shall be secured, as far as practicable, with the use of the most appropriate standard recognized by the information and communications technology industry, and as recommended by the National Privacy Commission (NPC) and that the head of each government agency or instrumentality shall be responsible for complying with the security requirements mentioned therein; WHEREAS, Section 13 of the Data Privacy Act states that the processing of personal information is allowed if provided for by existing laws and regulations; WHEREAS, Section 23 of the Data Privacy Act provides that, unless otherwise provided in NPC guidelines, sensitive personal information maintained by an agency may not be transported or accessed from a location off government property unless a request for such transportation or access is submitted and approved by the head of the agency in accordance with the guidelines in the Implementing Rules and Regulations (IRR) of the Data Privacy Act; WHEREAS, Section 30 of the IRR of the Data Privacy Act states that no employee of the government shall have access to sensitive personal information on government property or through online facilities unless the employee has received a security clearance from the head of the source agency; WHEREAS, Section 20 of the IRR of the Data Privacy Act likewise provides that further processing of personal data collected from a party other than the data subject shall be allowed under certain conditions; WHEREAS, Section 270 of the NIRC of 1997 similarly prohibits any officer or employee of the BIR from divulging to any person or making known in any manner other than may be provided by law information regarding business, income, estate, the secrets, operation, style or work, or apparatus of any manufacturer or producer, or any confidential information regarding the business of any taxpayer, knowledge of which was acquired by him in the discharge of his official duties; and WHEREAS, NPC Circular No. 16-02 provides the rules governing data sharing agreements involving government agencies. NOW THEREFORE, for and in consideration of the foregoing premises, BIR and DTI hereby execute this MOA in connection with the institution of an Information Management Program required by R.A. No. 9480, subject to the following terms and conditions: 1. DTI, through the undersigned representative, hereby consents to share with BIR, by means of online access, those personal data or information which it collected in the performance of mandated duties and functions, pursuant to Section 5 of the NIRC of 1997, as amended by the TRAIN law, to be utilized by BIR exclusively for purposes of assessment, collection, and enforcement of national internal revenue taxes and strictly in compliance with the Data Privacy Act, its IRR, and related laws/rules/regulations. Such use shall be limited, non-exclusive, non-transferable, revocable, and only for the aforementioned purposes. 2. BIR, through the undersigned representative, hereby consents to share with DTI, by means of online access, personal data or information of the taxpayers not otherwise covered by Section 270 of the NIRC of 1997, as amended, and those that are declared or obtainable from the Tax Amnesty Returns and the SALNs required to be filed under R.A. No. 9480, which it collected in the performance of its mandated duties and functions, subject to compliance with Section 4 of NPC Circular No. 16-02, to be utilized by DTI for validation purposes only. ATICcS 3. The type of personal data or information to be shared between DTI and BIR, mode of data sharing, frequency, and other operational details shall be specified in the Technical Annex of this MOA, which shall form as an integral part hereof; Provided that, BIR and DTI shall not share information regarding business, income, estate, secrets operation, style of work, apparatus of any manufacturer or producer, or any confidential information regarding the business of the taxpayer, knowledge of which was acquired during the performance of duties pursuant to Section 270 of the NIRC of 1997. 4. The operational details of this data sharing agreement shall be updated in a phased-in approach, once infrastructure is available. Provided, that such updates shall be considered amendments to this MOA, which shall be in the form of a written instrument duly executed and signed by all Parties hereto and executed with the same formality as this MOA. Provided further, that BIR and DTI shall designate and authorize technical representatives to update the operational details. 5. Access to the personal data or information shall be limited to the list of BIR and DTI officers/employees specified in the Technical Annex of this MOA. The types of processing to the data shall likewise be limited to those specified in the Technical Annex. Any modification to the access list and the types of processing allowed shall require the approval of the Commissioner of Internal Revenue for BIR and the Secretary for DTI. Such modification shall be in the form of a written instrument duly executed and signed by the Party approving the modification. 6. BIR and DTI shall implement appropriate security measures, as specified in the Technical Annex, to ensure protection of the personal information of data subjects, including the policy for retention, destruction and disposal of records. 7. Both BIR and DTI warrant to treat any and/or all information by both Parties pursuant to this MOA with utmost confidentiality, in accordance with the Data Privacy Act, and for validation, tax assessment, collection, and enforcement purposes only. 8. In the performance of their obligations under this MOA, the Parties shall ensure the privacy and security of any and all personal data and information that the Parties and their officers, employees, or agents may have access to; and shall store, use, process, and dispose the said information in accordance with Data Privacy Act, its IRR, and applicable NPC issuances. Any violation of this clause and any of the provisions of the said law and issuances committed by the aforementioned persons shall be subject to corresponding sanctions, penalties, and/or fines under the said law without prejudice to any other applicable civil and/or criminal liability. This clause shall survive the termination or expiration of this MOA. 9. The process for filing a complaint for violation of data privacy rights of any data subject shall be in accordance with the procedures and guidelines provided for by the Data Privacy Act, its IRR, and other relevant laws/rules/regulations. 10. The following shall be designated as the Parties' Data Protection Officer (DPO) and Compliance Officer for Privacy (COP): DTI: Name of DPO: Director Patricia May M. Abejo Email address: [emailprotected] Office Address: Trade and Industry Building, 361 Sen. Gil Puyat Avenue, Makati City Name of Alternate COP: Ms. Josephine M. Virrey Email address: [emailprotected] Office Address: 2F HPGV Building, 395 Sen. Gil Puyat Avenue, Makati City TIADCc BIR: Name of DPO: DCIR Lanee Cui-David Email Address: [emailprotected] Office Address: BIR National Office Building, Agham Road, Diliman, Quezon City Name of COP: COS Maria Theresa E. Maligad Email Address: [emailprotected] Office Address: BIR National Office Building, Agham Road, Diliman, Quezon City The DPO and COP shall be responsible for addressing any information request, or complaint filed by the data subject and/or investigation by the NPC in relation to this MOA. 11. The data subject may be given access to a copy of this MOA upon written request and for a valid purpose, provided that the Parties may redact or prevent the disclosure of any detail or information that could endanger its computer network or system or expose to harm the integrity, availability or confidentiality of personal data under its control or custody. Such information may include the program, middleware and encryption method in use, as the case may be. 12. Nothing herein is intended nor shall be construed as creating any exclusive arrangement among the Parties. This MOA shall not restrict any Party from entering into any similar, equal or like agreements with other persons or entities. 13. This MOA may be terminated either through mutual written agreement or for just cause, as follows: a. Violation of any of the material terms and conditions of this MOA; b. Failure or refusal to comply with the duties and responsibilities of each Party under this MOA; or c. Circumstances that would make it impossible for the agreement to continue or to be carried out. Any Party who wishes to terminate this MOA must serve the other Party with a written notice within thirty (30) calendar days before the intended date of termination. 14. The Parties undertake to act in good faith with respect to each other's rights and obligations under this MOA and to adopt all reasonable measures to ensure the satisfactory realization of the objectives of this MOA. 15. In the event of any dispute arising out of or related to this MOA, the same shall be settled amicably by mutual consultation between the Parties. In case the Parties fail to amicably settle their dispute, the same shall be resolved in the manner prescribed under Chapter 14, Book IV of the Administrative Code of 1987. 16. No failure, omission, or delay by any of the Parties in exercising any of its rights, privileges, or remedies hereunder or under any statute shall operate as a waiver thereof. Any waiver, however, shall not be valid unless made in writing and signed by the parties or their authorized representative, and such waiver shall be effective only in the specific instance and the purpose for which it was given. 17. This MOA, including the Technical Annex, contains all covenants, stipulations and provisions agreed to by the Parties. No agent or representative of either Party has authority to make any statement, representation, promise, or agreement not set forth herein of which the Parties shall not be bound by or be liable for. 18. This MOA may be revised, amended or modified only through a written instrument duly executed and signed by all Parties hereto and executed with the same formality as this MOA; AIDSTE 19. This MOA must not be in conflict with existing laws, legal orders, procedures or rules and regulations, otherwise the pertinent provision/s violating or conflicting with the same will be void. If any provision of this MOA is held invalid or declared contrary to law, the validity of the other conditions or provisions shall not be affected; and 20. This MOA shall take effect upon the signing thereof by the parties' authorized representatives and shall remain in full force for five (5) years or until mutually abrogated by the parties concerned, without prejudice to entering into a new MOA and a new data sharing agreement. IN WITNESS WHEREOF, the parties have hereunto affixed their signatures this 7th day of May, 2021 in Quezon City, Philippines. BUREAU OF INTERNAL REVENUE By: (SGD.) CAESAR R. DULAY Commissioner DEPARTMENT OF TRADE AND INDUSTRY By: (SGD.) RAMON M. LOPEZ Secretary Signed in the presence of: (SGD.) LANEE CUI-DAVID Data Protection Officer Deputy Commissioner Information Systems Group (SGD.) PATRICIA MAY M. ABEJO Data Protection Officer Director Knowledge Management and Information Service (SGD.) MARIA THERESA MALIGAD Compliance Officer for Privacy Chief of Staff Office of the Commissioner (SGD.) JOSEPHINE M. VIRREY Alternate Compliance Officer for Privacy Supervising Trade-Industry Development Specialist Competitiveness Bureau ACKNOWLEDGEMENT REPUBLIC OF THE PHILIPPINES ) QUEZON CITY ) SS. Before me, a Notary Public for and in Quezon City this 7th day of May 2021, personally appeared: Names ID with ID Nos. Caesar R. Dulay BIR ID 21421 Ramon M. Lopez DTI ID 00039 known to me and to me known to be the same persons who executed the foregoing Memorandum of Agreement Between the Bureau of Internal Revenue (BIR) and the Department of Trade and Industry (DTI) and they acknowledged to me that the same is their own free and voluntary act and deed. This instrument consists of 8 pages including this page whereon the acknowledgement is taken, refers to Memorandum of Agreement Between the BIR and the DTI and signed by the parties and two (2) witnesses at the bottom and left margin of each and every page. In testimony whereof, I hereto set my hand and affixed my notarial seal at the place and date just above written. NOTARY PUBLIC Doc. No. 151 Page No. 32 Book No. 4 Series of 2021 TECHNICAL ANNEX TO MEMORANDUM OF AGREEMENT BETWEEN BUREAU OF INTERNAL REVENUE AND DEPARTMENT OF TRADE AND INDUSTRY This document provides the operational and technical details of the Memorandum of Agreement dated __________________ on the data sharing between the Bureau of Internal Revenue (BIR) and Department of Trade and Industry (DTI) . AaCTcI I. TYPES OF DATA COLLECTED In adherence to the principles of transparency, legitimate purpose and proportionality, only the personal data and information enumerated below shall be shared by DTI and BIR with each other: Department of Trade and Industry Data Type Field Description 1. Registered single proprietors 1.1 Name of Owner/Proprietor Owner Name 1.2 Registered Business Name Business Name 1.3 TIN (optional) Owner TIN 1.4 Residence Address Owner Address 1.5 Business Address Business Address 1.6 Nature/Line of Business PSIC Code 1.7 Certificate of Registration 1.7.1 Certificate/Business Name Number Certificate/Business Name Number 1.7.2 Validity Date Registration Date Registration Date (End) 1.8 Date of Birth Date of Birth 1.9 Citizenship Citizenship 1.10 Transaction Type Transaction Type Bureau of Internal Revenue Data Type Field Description Trade Name Name of Business TIN TIN Registered Name Name of Owner Line of Business/PSIC Code Line of Business/PSIC Code Registered Address Business Address II. GEOGRAPHIC LOCATION OF THE PROCESSING The processing of data shall only be made in BIR and DTI offices/premises by persons on the Access List. III. METHOD OF DATA ACCESS OR TRANSFER Data exchange between DTI to BIR and vice-versa will be through the following: 1) For the initial DTI bulk submission of historical data, it will be through Web Service with dedicated URL through internet via Secure File Transfer Protocol (SFTP) 2) For the succeeding submissions, a Virtual Private Network (VPN) access will also be given to DTI in order to access the Bureau's landing server. All data must be encrypted and must conform to AES 256 standards before transmitting the same to BIR. Transmission shall be done quarterly every 20th of the month. Note : Refer to Section 31 of the IRR of Data Privacy Act , which provides conditions for On-site and Online Access and Off-site Access. Please consider that for off-site access, only 1,000 records are allowed per transfer according to the IRR. IV. ACCESS LIST The data may only be accessed by the following officers: Bureau of Internal Revenue Officer Role vis--vis Data Sharing Access Level/ Processing Type Commissioner of Internal Revenue Personal Data Controller Read/Store/Dispose Deputy Commissioner, Operations Group Personal Data Processor Read/Store Deputy Commissioner, Information Systems Group Data Protection Officer Read/Store Assistant Commissioner, Assessment Service Personal Data Processor Read HREA, Assessment Service Personal Data Processor Read Division Chief, AITEID and BID Personal Data Processor Read Department of Trade and Industry Officer Role vis--vis Data Sharing Access Level/ Processing Type Assistant Secretary, Digital Philippines Personal Data Controller Read/Store Division Chief, Competitiveness Bureau-BNRD Compliance Officer for Privacy Read/Store Supervising Trade-Industry Development Specialist, Competitiveness Bureau-BNRD Alternate Compliance Officer for Privacy and Personal Data Processor Read/Store Any modification to the above list shall require the approval of the Personal Information Controller. V. DATA STORAGE AND RETENTION Data will be stored in a secured storage servers of DTI and BIR, and will be retained for five (5) years subject to their respective rules and regulations on electronic data/information. EcTCAD Within thirty (30) days/months thereafter, the data shall be returned, disposed or discarded in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other party or the public, or prejudice the interests of the data subjects. VI. DATA DISPOSAL The BIR and DTI shall strictly implement measures on the disposal of data in compliance with the National Privacy Commission (NPC) Circular 16-01, Rule V, Sections 30 to 32 on Disposal of Personal Data. Data disposition shall be guided by the archiving procedure per RMO 23-2004. VII. REMEDIES OF DATA SUBJECT In the event of the violation of any of the data subject's rights, the data subjects involved in this agreement may request for a remedy through email: DTI [emailprotected] BIR [emailprotected] VIII. ACCESS TO THIS AGREEMENT BY THE DATA SUBJECT The data subject may be given access to a copy of this DSA upon written request and for a valid purpose, provided that the parties may redact or prevent the disclosure of any detail or information that could endanger its computer network or system or expose to harm the integrity, availability or confidentiality of personal data under its control or custody. Such information may include the program, middleware and encryption method in use, as the case may be. IX. SECURITY MEASURES Only authorized personnel, employees, and/or agents of the parties can access the data. Strict compliance to all security policies and measures as defined in various BIR existing issuances such as RMO 50-2004, RMO 3-2014, RMO 12-2014 and RMO 15-2014 shall be observed. XII. LIMITATIONS The limitations on the use of the shared data includes all restricted usages, such as but not limited to, restrictions on data results or findings, including sharing, publishing, selling, or dissemination of data, further processing of data, ownership of data, and the like.