RMC No. 94-2017: Prescribes the BIR Privacy Policy

Key points

1. Coverage and definitions. The Policy applies to personal information collected from all BIR forms, the website and online services. Personal information is any information that ascertains one’s identity, including address and contact details. Sensitive personal information includes age, date of birth, marital status, social security and other government identification numbers, financial information and tax returns.
2. How information is collected. The BIR collects it directly when taxpayers fill in a BIR form online or in hard copy, register and use BIR online services, or contact the BIR by phone or other means. It also collects personal information from third parties.
3. Uses of the information. The BIR may use it to administer the NIRC of 1997, as amended, and other tax laws, to update its database or records, to provide it to other government agencies entitled to it by law, and to contact the taxpayer, including electronically.
4. Confidentiality and exceptions. BIR personnel cannot divulge information on a taxpayer’s business, income or estate, trade secrets or other confidential business information. The exceptions are disposition of ITRs under Section 71 of the NIRC, disclosure of ITRs under Section 26 of RA No. 6388 (Election Code) for a candidate who executes a waiver, and information given to a foreign tax authority under a treaty pursuant to RA No. 10021.
5. Consent. The Data Privacy Act of 2012 provides that personal data is never collected and processed without the individual’s consent, unless otherwise provided by law.

Who is affected

• Taxpayers and other data subjects
• BIR personnel