NPC Advisory Opinion No. 2025-006 involved a condominium corporation that received an Access Letter from a Bureau of Internal Revenue (BIR) Revenue District Office requesting the names and tax identification numbers of condominium unit and parking slot owners involved in leasing, sub-leasing, Airbnb, staycations, and similar activities. The NPC advised that the BIR could do so and obtain the data without violating the Data Privacy Act (DPA) even without the consent of the condominium owners, as consent is not the only lawful basis for processing under the DPA. The disclosure may be justified under Section 12(c) of the DPA, as it is necessary for compliance with a legal obligation, and under Section 13(f), as the information is provided to a government or public authority in the exercise of its regulatory mandate. The BIR, as a public authority tasked with enforcing tax laws under the National Internal Revenue Code, is authorized to obtain information necessary for tax compliance. Processing of personal data pursuant to such statutory mandate falls under the special cases recognized by Section 5 of the DPA IRR.
