Revenue Memorandum Circular · RMCInternal administration / RMO ops

RMC No. 34-2023

Bureau of Internal RevenueIndependent research copyOpen source document

Document type: RMC
Number: 34
Year: 2023
Text quality: ok

Source PDF

Official document hosted by the Bureau of Internal Revenue

Document text

Reference copy · verify against the official source

REVENUE MEMORANDUM CIRCULAR NO. 34-2023 issued on March 17, 2023 publishes the full text of the Data Sharing Agreement (DSA) between the BIR and the Securities and Exchange Commission (SEC) pursuant to Republic Act No. 10173 and the National Privacy Commission (NPC) Circular No. 16-02. The SEC shall share to the BIR its data on corporations and other registered/licensed entities, including beneficial ownership information. These data may contain Personal Information and Sensitive Personal Information, such as but not limited to the complete name, specific residential address, date of birth, nationality, tax identification number; and percentage of ownership, if applicable, of the incorporators, stockholders, directors, trustees, members, officers, and beneficial owners of registered corporations, partners in a partnership and other persons licensed by the SEC. On the other hand, the SEC may request intelligence information necessary for the performance of its function from the BIR, provided that the request for information does not violate any applicable laws, rules, and regulations. For the SEC, the Commission Secretary, the Director of the Enforcement and Investor Protection Department, and the Assistant Director of the Anti-Money Laundering Division of the Enforcement and Investor Protection Department are designated as Data Protection Officers (DPOs) to carry out the DSA. For the BIR, the Deputy Commissioner for Information Systems Group (ISG) is designated as Data Protection Officer to carry out the DSA. The BIR shall treat the personal data shared by the SEC with the utmost confidentiality and solely for the furtherance of its lawful mandate. Unless otherwise exempted from the coverage of the Data Privacy Act, the BIR shall also inform the SEC of the following information one (1) week upon the signing of the Agreement: a. Any personal information processor that will have access to or process the personal data, including the types of processing it shall be allowed to perform; b. How the party may use or process the personal data, including, but not limited to, online access; c. The remedies available to a data subject, in case the processing of personal data violates his or her rights, and how these may be exercised; d. The names and designations of personnel who will be involved in the handling of personal data, upon request OR the designated Data Protection Officer. The DSA shall remain valid and binding for five (5) years from the date of signing, unless pre-terminated by either party for reasonable ground, without prejudice to entering into a new data-sharing agreement before or upon the expiration thereof. Pre-termination shall be in writing upon the agreement by both parties. Upon the termination of the DSA, the personal data shall remain with the BIR unless otherwise instructed and agreed upon by the agencies involved in the DSA. The confidentiality obligations contained in the DSA shall remain in force even after the termination of the Agreement. Either party will provide the relevant data and/or document to the other party either through electronic upload, electronic mail (e-mail), or personal service, and ensure the security of the Personal Information, Sensitive Personal Information and other confidential information while in transit or while being transmitted through the channels or media authorized under the Agreement. Each Party shall process Personal Information, Sensitive Personal Information and other confidential information disclosed or transferred to it pursuant to the Agreement in accordance with the methods and other terms and conditions of its privacy notice, statement, or policy that apply to its processing of such personal and sensitive information. The parties shall establish reasonable and appropriate safeguards and security measures to ensure the confidentiality, integrity, and security of the Personal Information, Sensitive Personal Information and other classified information shared or disclosed by either party to the other party pursuant to the Agreement. The parties shall be responsible for preventing the unauthorized access and use of such Personal Information, Sensitive Personal Information and other classified Information in their respective custody. Unless otherwise exempted under existing law, the parties are likewise prohibited from further sharing or disclosing such Personal Information, Sensitive Personal Information and other classified information to any unauthorized party without the prior written consent of the originating party or the Data Subjects, as appropriate. The parties shall regularly monitor its compliance with the security measures provided in the Agreement. If there is a breach in data security affecting Personal Information, Sensitive Personal Information, and other classified information, the party shall notify the Data Protection Officer or any other appropriate officer of the other party in writing, immediately after discovery of such data breach or upon reasonable belief that such data breach has occurred. Unless applicable laws or regulations allow or require a longer period for retention, the Personal Information, Sensitive Personal Information and other classified information subject of the Agreement shall be kept and retained by the parties so long as may be necessary for the pursuit of their lawful mandate. Upon termination of the Agreement, the parties shall, upon instruction of the other party, destroy, delete or return to the latter all Personal Information, Sensitive Personal Information and other classified information that the former received from the latter within thirty (30) days from the effective date of termination, unless the former is mandated or permitted by the applicable law to maintain a copy thereof for a longer period and subject to the internal policy of the BIR on destruction and deletion. Personal Information, Sensitive Personal Information and other classified information in the custody of a Party that requires disposal shall be disposed of and/or discarded by such Party in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other person or entity. The laws of the Philippines shall govern all matters arising out of relating to the DSA. Any dispute arising in the course of the execution and performance of the DSA shall be settled amicably through negotiations by the parties and/or shall make every effort to amicably resolve such dispute of difference by mutual consultation. If after thirty (30) days, no amicable settlement is reached, the parties undertake to submit their respective claims in accordance with Rules on Alternative Dispute Resolution (ADR) for Disputes between National Government Agencies. Each Party shall comply with the Data Privacy Act of 2012 and all other applicable data protection laws and issuances. The Personal data subject whose right is violated and/or affected may exercise his/her rights provided for by the Data Privacy Act, its Implementing Rules and Regulations (IRR), and other NPC issuances. A copy of the Agreement may be obtained by a Personal data subject from the Office of the DPO of the Parties subject to processes and policies by the Parties governing such request, and prior information to the party. The Parties may redact or prevent the disclosure of any detail or information that could endanger its computer network or system, or expose to harm the integrity, availability, or confidentiality of personal data under its control or custody. Such information may include the program, web services, and encryption method in use.

Research aid

Issuance analysis

Structured from the available issuance text · Internal administration / RMO ops

RMC No. 34-2023 (March 17, 2023) publishes the full text of the Data Sharing Agreement (DSA) between the BIR and the Securities and Exchange Commission (SEC), entered into pursuant to Republic Act No. 10173 (Data Privacy Act) and NPC Circular No. 16-02. Under the DSA, the SEC shares with the BIR its data on corporations and other registered or licensed entities, including beneficial ownership information that may contain personal and sensitive personal information (e.g., name, address, date of birth, nationality, TIN, and percentage of ownership of incorporators, stockholders, directors, trustees, members, officers, and beneficial owners). In turn, the SEC may request intelligence information from the BIR for its functions, subject to applicable laws. The circular also sets out safeguards: designated Data Protection Officers for both agencies, strict confidentiality, security measures, breach notification, retention and disposal rules, a five-year term with written pre-termination, and amicable dispute resolution through ADR rules for national government agencies.

Purpose

To publish for information and guidance the full text of the Data Sharing Agreement between the BIR and the SEC, executed pursuant to Republic Act No. 10173 and NPC Circular No. 16-02, governing the exchange of corporate registration, beneficial ownership, and intelligence data between the two agencies.

In brief

RMC No. 34-2023 publishes the BIR-SEC Data Sharing Agreement under which the SEC shares corporate registration and beneficial ownership data with the BIR, and the SEC may request BIR intelligence information, subject to Data Privacy Act safeguards.

Keywords

Data Sharing AgreementSecurities and Exchange Commissionbeneficial ownership informationData Privacy ActNPC Circular No. 16-02Sensitive Personal InformationData Protection Officertax identification numberintelligence informationdata breach notification

Key points

RMC No. 34-2023, issued March 17, 2023, publishes the full text of the Data Sharing Agreement between the BIR and the SEC pursuant to Republic Act No. 10173 and NPC Circular No. 16-02.
The SEC will share with the BIR its data on corporations and other registered/licensed entities, including beneficial ownership information that may include personal and sensitive personal data such as complete name, residential address, date of birth, nationality, TIN, and percentage of ownership of incorporators, stockholders, directors, trustees, members, officers, beneficial owners, and partners.
Reciprocally, the SEC may request intelligence information from the BIR necessary for the performance of its functions, provided the request does not violate applicable laws, rules, and regulations.
Designated Data Protection Officers are: for the SEC, the Commission Secretary, the Director of the Enforcement and Investor Protection Department, and the Assistant Director of its Anti-Money Laundering Division; for the BIR, the Deputy Commissioner for the Information Systems Group.
The BIR must treat the shared personal data with utmost confidentiality and use it solely for its lawful mandate; unless exempted under the Data Privacy Act, it must inform the SEC within one week of signing about any personal information processor, how the data will be used or processed, remedies available to data subjects, and (upon request) personnel handling personal data.
The DSA is valid and binding for five years from signing, may be pre-terminated in writing upon agreement of both parties, and confidentiality obligations survive termination; upon termination, personal data remains with the BIR unless otherwise agreed, and parties must destroy, delete, or return received data within thirty (30) days of the effective termination date unless applicable law requires longer retention.
The parties must maintain reasonable security safeguards, notify the other party's Data Protection Officer in writing immediately upon discovery or reasonable belief of a data breach, and settle disputes amicably, resorting after thirty (30) days to the Rules on Alternative Dispute Resolution for disputes between national government agencies.

Affected taxpayers

Corporations, partnerships, and other entities registered or licensed by the SEC whose registration data and beneficial ownership information will be shared with the BIR under the DSA.
Individuals connected with SEC-registered entities - incorporators, stockholders, directors, trustees, members, officers, beneficial owners, and partners - whose personal and sensitive personal information (including TIN and percentage of ownership) may be shared with the BIR.
Data subjects whose rights under the Data Privacy Act may be exercised, and who may request a copy of the Agreement from the parties' Data Protection Officer offices, subject to the parties' processes and policies.