Identity theft cannot be traced to BIR seal QR code alone, says privacy body

The National Privacy Commission (NPC) addressed concerns from online sellers regarding a Bureau of Internal Revenue (BIR) mandate that required displaying a registration seal with a QR code. The NPC clarified that while scanning the QR code reveals a registered name and masked Tax Identification Number (TIN), identity theft cannot be carried out solely using this information. Instead, it results from a combination of a person's online activities and data gathered from various sources.

NPC Deputy Commissioner Jose Belarmino II emphasized that becoming a victim of identity theft is a cumulative risk, often combining information posted by individuals with data obtained from breaches or public postings. Although a person's name is not legally classified as sensitive personal information, the NPC notes that it frequently serves as the starting point for identity theft. This suggests that individual pieces of data, while seemingly harmless, can become significant when aggregated by cybercriminals.

Following these public concerns, the BIR has suspended the mandatory display of the registration seal badge, allowing taxpayers to continue displaying them voluntarily without penalty during this period. However, the NPC declined to provide a rationale for why the BIR required these specific details on the badge, stating that the BIR, as the data controller, is responsible for defending its necessity.