Your Data at the Treasury Counter: What an Office May Share, and What It Must Protect
Every payment at the town hall leaves a trail of personal information. Here is what the Data Privacy Act means at the treasury counter, what an office may share, what it must protect, and simple habits that keep taxpayers safe.
A man walks up to the treasury window and asks a simple question. “Magkano po ba ang utang sa amilyar ng kapitbahay ko?” How much does my neighbor still owe in real property tax? He says they are relatives, and he only wants to help.
(As in my other treasury posts, the case is a composite. No real person or amount is described.)
The clerk smiles and says she cannot give that information. The man is annoyed. Isn’t the government supposed to be transparent?
Both of them have a point, and that is what makes this topic worth explaining.
What a Treasury Knows About You
Think about everything you hand over at the counter in a year. Your full name, address and birthday for the cedula. Your income, because the community tax depends on it. Your business name, gross sales and sometimes your tax identification number for the business permit. Your land, its location and its assessed value for real property tax. Copies of your IDs. Your phone number, in case a check is ready.
Put together, that is a detailed picture of a person’s life and money. In the wrong hands, it can be used for scams, harassment or identity theft. That is why the law treats it seriously.
The Law in Plain Words
The Data Privacy Act of 2012, Republic Act 10173, protects personal information held by both private companies and government offices. It is enforced by the National Privacy Commission.
The Act sets out three simple principles. Transparency: people should know what is being collected and why. Legitimate purpose: information must be collected and used only for a lawful, declared purpose. Proportionality: an office should collect only what it really needs for that purpose.
The law also gives each person rights over their own information. You have the right to be told how it is used, to see it, to have mistakes corrected, and in some cases to object or have it blocked. If a breach causes you harm, you may also seek damages.
Some Information Is Extra Sensitive
The Act places some kinds of information in a stricter group called sensitive personal information. It includes a person’s age, marital status, health and education. It also covers information issued by government agencies that is peculiar to a person. The law names examples such as social security numbers, licenses, and tax returns.
Some of what passes through the counter falls in this group, and the rest is still personal information that the Act protects. That is why the clerk in our story was right. A taxpayer’s account is not something to share with a neighbor, even a kind one, even a relative.
So Is the Treasury Being Secretive?
No. Privacy protects people, not spending. The Data Privacy Act itself says it does not cover information about a government officer or employee’s position and official work, such as their name, title and salary range. It also does not cover information about the work a contractor does for the government.
So the budget, the list of projects, how much was spent and who was paid for public contracts remain public matters. Local governments are expected to post their budgets, financial reports and procurement results where citizens can see them. Data privacy is never a reason to hide those.
The line is simple. How the town spends public money is public. What a private person owes, earns or owns is theirs.
When the Law Says Something Must Be Posted
There are cases where the law itself requires names to be made public. When real property tax stays unpaid, the Local Government Code requires the treasurer to post a notice of delinquency in the town hall and the barangays, and to publish it in a newspaper. If the property is later advertised for public auction, the notice names the owner and describes the property.
The Data Privacy Act allows this, because processing that is needed to comply with a legal obligation, or to carry out a public office’s functions, is lawful. The key words are “required by law.” A notice posted the way the law prescribes is proper. A list of “pasaway” taxpayers shared on social media to shame them is something else entirely. It goes beyond the purpose and can expose the office to a complaint.
Habits That Protect Taxpayers
Most privacy problems do not come from hackers. They come from small daily habits. Here are some that every treasury can practice.
Turn the screen away. Position monitors so that the person in line cannot read the account of the person ahead.
Cover the logbook. A visitor’s logbook open on the counter shows every name and number above. Use a fresh page or a simple cover.
Ask only what you need. If a transaction does not need a photocopy of an ID, do not keep one. Less data held means less data to lose.
Verify before you answer. Give account details only to the owner or someone with a proper authorization letter and a valid ID.
Never use group chats for records. Sending lists of taxpayers or scanned receipts through personal messaging apps puts them outside the office’s control.
Lock the cabinet and the computer. Files and screens left open at lunch are an easy target. Lock both when you step away.
Dispose properly. Government records may only be destroyed under the disposition schedules of the National Archives of the Philippines. Old forms should never end up as scratch paper or food wrappers.
When Something Goes Wrong
Mistakes happen. A laptop is stolen. A file is sent to the wrong email. A cabinet is left open overnight. What matters is what the office does next.
Under the rules of the National Privacy Commission, a serious breach involving sensitive personal information, or data that could be used for identity fraud, must be reported to the Commission, and the affected people informed, within 72 hours of the office knowing about it. Each office should have a data protection officer who knows what to do.
This connects with what I wrote in my cybersecurity series. Most attacks begin with ordinary mistakes, like a clicked link or a weak password. Treasury data is valuable, so treasury offices must expect to be targeted.
Read: How Modern Cyberattacks Really Work
What Taxpayers Can Do
Privacy is also a habit for the people outside the window. Here are a few things you can do the next time you visit your town hall.
Ask why. If a form asks for something that seems unrelated, you may politely ask what it is for.
Mark your photocopies. When you submit an ID copy, write across it what it is for and the date, so it cannot easily be reused.
Keep your receipts private. Official receipts carry your name and payment details. Do not post them online.
Use authorization letters. If someone pays or follows up for you, give them a signed letter and a copy of your ID, so the office can verify them.
Beware of fake collectors. Treasury staff do not ask for payments through personal accounts. Pay at the office or through the channels your town has announced.
Privacy and Systems
When I design treasury software, privacy is part of the plan from the start, not something added at the end. Each user should see only what their job needs. Every view and change should leave a record. Backups must be protected as carefully as the main system.
A system that protects data well also protects the people who use it. When questions come, the logs show who did what, and honest workers have nothing to fear.
Back to the Counter
So what should the clerk in our story have done? Exactly what she did, with one more step. She can explain kindly that the account belongs to the owner, and that the owner, or someone with the owner’s written authority and ID, can get the details. She can also tell him the general rules, such as when real property tax is due and how the discounts work, because that information is for everyone.
That answer protects the neighbor, respects the visitor and keeps the office within the law.
The Question to Ask
If you work in a local treasury, look at your counter tomorrow from the taxpayer’s side. What can a person in line see that is not theirs? Fixing that is often the cheapest privacy measure there is.
Has a privacy question ever come up at your counter? I'd like to hear how you handled it. Email me.
