RMC No. 53-2022: Publishes the full text of the Data Sharing Agreement between the BIR and the Philippine Statistics Authority

Key points

1. Undertakings of the BIR. The BIR requests information from the PSA, such as dates of birth or death, addresses and the identities of legal heirs, by a formal letter signed by the Commissioner or an authorized representative. The letter goes by registered mail or encrypted email, and the BIR gets no online access to PSA personal data. The BIR keeps the information confidential and discloses it only to a requesting foreign jurisdiction bound by the same confidentiality rule under a Double Taxation Agreement.
2. Undertakings of the PSA. The PSA forms a special team for EOI requests, designates its head, and provides the information or alternative relevant information within fifteen (15) working days from receipt. It may request an extension of up to fifteen (15) working days, and it issues a signed Certification if the information cannot be obtained.
3. Joint undertakings. The BIR and PSA form a Committee or Technical Working Group to implement and improve the DSA. Each takes disciplinary action against its personnel who violate the Agreement.
4. Storage, disposal and security. Data the BIR receives is kept in the restricted EOI room of the International Tax Affairs Division, and both parties keep data and requests for a minimum of five (5) years from the effectivity of the DSA. Disposal follows NPC Circular 16-01, Rule V, Sections 30 to 32, and each party’s data privacy manual, with the BIR also following the security issuances it lists.
5. Confidentiality and data breaches. Parties use shared information only for the purposes in the DSA, disclose it to no third party other than the requesting foreign jurisdiction or the taxpayer concerned without written consent, and return or destroy it on termination or after the retention period, whichever is later. A party aware of a breach of personal data notifies the other in writing immediately and cooperates to resolve it, and data subjects may complain to the Data Protection Officers.
6. Term and termination. The DSA takes effect immediately for five (5) years, renewable or extendable for no more than five (5) years. It ends on expiration, agreement, breach, or an NPC finding that continuing is unnecessary or against public interest, and either party may terminate on thirty (30) days written notice.

Who is affected

• Bureau of Internal Revenue
• Philippine Statistics Authority

Deadlines and effectivity

• Takes effect immediately for five (5) years
• PSA provides requested information within fifteen (15) working days from receipt, with an extension of no more than fifteen (15) working days
• Data retained for a minimum of five (5) years from the effectivity of the DSA
• Termination by written notice thirty (30) days before it takes effect