Identity theft cannot be traced to BIR seal QR code alone, says privacy body

The National Privacy Commission (NPC) said Monday that identity theft and other online abuses result from a combination of a person's online activities and cannot be carried out solely using information contained in the QR code of the Bureau of Internal Revenue's (BIR) registration seal.

The NPC’s statement came after online sellers and creators raised concerns over the BIR memorandum requiring online taxpayers to post the BIR-issued seal on their websites, e-commerce pages, or social media accounts as proof of registration.

“Iyan naman ay labas na sa usapan nitong QR code kasi one source lang iyong QR code ng information,” NPC Deputy Commissioner Jose Belarmino II said on Bagong Pilipinas Ngayon when asked how online sellers and creators can protect themselves from identity theft and other possible online abuses using their names.

(That is already beyond the scope of this QR code because the QR code is just a single source of information.)

“... Gusto kong sabihin sa lahat ng tao, iyong pagiging victim ng identity theft it’s a combination ng mga ipinost natin at iyong mga na-gather sa iba’t ibang sources. So, either nakakuha sila ng information from a breach, nakakuha sila sa isang public posting ‘no,” he added.

(.. I want to tell everyone that becoming a victim of identity theft is the result of a combination of what we post and what is gathered from various sources. So, they either obtained information from a breach or gathered it from a public posting.)

The NPC cautioned online sellers and creators to be mindful of their online activities, as what they think is harmless information could, when combined, be used by cybercriminals to commit crimes in the digital space.

Badge information

Following concerns online, the BIR suspended on Monday the mandatory display of the registration seal badge to "provide for the orderly implementation of the Bureau's registration verification initiatives."

Scanning the QR code on the BIR registration seal badge will reveal the individual's registered name and masked digits of their Tax Identification Number (TIN).

According to the NPC, a person's name is not classified as sensitive personal information under the law, but it noted that it frequently serves as the starting point for identity theft.

“Kapag ini-scan mo iyong QR code iyong TIN kasi mo nandoon pero naka-mask siya na ang makikita mo doon ngayon is iyong full name ng tao,” Belarmino said.

(When you scan the QR code, your TIN is there, but it is masked, so what you will see there now is the person's full name.)

“Now, under sa law, hindi naman ho sensitive personal information ang pangalan. Pero ho, sasabihin po natin na kadalasan ang starting point ng identity theft ay nagsisimula sa fact na alam mo iyong buong pangalan ng isang tao, even iyong middle name,” he added.

(Now, under the law, a name is not sensitive personal information. However, we must point out that the starting point of identity theft often begins with the fact that someone knows a person's full name, including their middle name.)

Belarmino noted that the NPC cannot answer on behalf of the BIR as to why those specific details are required on their registration badge, adding that the public should wait for an explanation from the implementing agency itself.

“But again po ano, hindi po natin sinasabi na mali iyon dahil nga nakadepende po iyan sa controller, which po iyong BIR na i-defend kung bakit po kinakailangan iyon at kung talagang may dahilan sila kung bakit kinakailangan iyon,” Belarmino said.

(But again, we are not saying that it is wrong, because it depends on the controller, which is the BIR, to defend why that is necessary and if they truly have a reason for requiring it.)

BIR Commissioner Charlito Martin Mendoza said taxpayers with existing seal badges may continue displaying them at their option, assuring that no penalties will be imposed for failing to display the badge during the suspension period. —LDF, GMA News