This article first appeared in Wealth, The Edge Malaysia Weekly on November 29, 2021 - December 5, 2021

In 2017, the Bar Council Malaysia received complaints that Inland Revenue Board (IRB) officers wanted access to all the books and records of their clients.

The Bar Council resisted, saying it would be a breach of the legal professional privilege, which ensures the confidentiality of communications between lawyers and clients. A court case ensued. Eventually, the High Court of Malaya in Kuala Lumpur ruled in favour of the Bar Council. The IRB has since applied, however, for leave to appeal to the Federal Court.

This case highlighted the question of how far tax authorities could go to collect information and identify tax avoiders. Its implications at this time are significant, as more Malaysians are dabbling in investments and own digital assets, which tax authorities might find difficult to track.

At the same time, wealth taxes on capital gains have often been suggested as a solution to fill government coffers, especially during tough economic periods. To implement such taxes, more visibility on the wealth of individuals would be needed.

But, if the tax authorities’ information-seeking practices breach existing privacy laws, do they still have the right to demand such information?

The Bar Council case is not the only one. Some industry players in the fintech space have told Wealth recently that they were also approached by the IRB in the past year to disclose their customers’ information.

The companies are wary of handing over customers’ data for fear of breaching the Personal Data Protection Act (PDPA). Yet, they do not want be seen to be obstructing the IRB in carrying out its duties.

Anand Raj, head of tax disputes at law firm Shearn Delamore & Co, says: “On the Malaysian Bar case, the Bar resisted the IRB’s request for sweeping access to the clients’ accounts of all law firms. We also acted for a company (Genting Malaysia Bhd) on a similar case. The IRB asked the company to hand over its entire database of customers. We couldn’t rely on legal privilege [to argue] for this client, but we argued the PDPA. The High Court agreed with us.”

Anand represents the Malaysian Bar in the ongoing privilege case against the IRB and Genting Malaysia in the ongoing PDPA case. Both cases are still on appeal.

Anand explains how the PDPA protects individuals’ data from being used without consent. “Let’s say you, as a customer, visited a company and signed a form giving them your data because you want a loyalty card. The company keeps your data with your consent. But you wouldn’t have agreed for that information to be seized and used by the IRB, which doesn’t have your consent to use that data,” he says.

Section 81 of the Income Tax Act 1967 (ITA) enables the director general of the IRB (DGIR) to request from taxpayers any information or particulars that the DGIR deems necessary for income-tax purposes. Again, this may contradict the PDPA if it is used to collect information without individuals’ consent.

The PDPA also allows disclosure of data, however, if it is required or authorised by law, says Amarjeet Singh, EY Asean tax leader and Malaysia tax managing partner at Ernst & Young Tax Consultants Sdn Bhd.

The question, then, is whether the DGIR’s requests are authorised by law.

“The reading of Section 81 suggests that the DGIR’s powers to request for information are wide, except in limited circumstances. Notwithstanding the wide-reaching powers, case law suggests these powers are not without limitation,” says Amarjeet.

“There are numerous established overseas case law decisions that set the principle that the tax authority cannot be allowed to use its powers to ‘fish’ for information.”

In Canada, judicial authorisation is required before revenue authorities can obtain information related to an unnamed person or more than one unnamed person in a group, adds Amarjeet.

The data commissioner also has a role to play in these events. Anand cites the example of a CCTV in a condominium car park that captures footage of a murder suspect on the run.

“The data commissioner would allow authorities to use the CCTV to zoom in on that suspect. But if the authorities want the contact details, names and addresses of every occupant in the condominium so they can interview everyone, the data commissioner should say ‘no’,” says Anand.

Basically, the request for information must be for a specific purpose and pertain only to certain individuals. Chong Mun Yew, executive director of Crowe Malaysia PLT, suggests that Malaysia learn from the Organisation for Economic Co-operation and Development’s (OECD) Automatic Exchange of Information (AEOI) initiative.

One of its guidelines states that a country should not request information that is unlikely to be relevant to tax matters. If it does, it must be shown that there is a reasonable probability that the requested information is relevant.

“In this regard, if the IRB has reasonable doubt that a specific taxpayer is committing tax fraud or evasion, then the DGIR should be able to invoke Section 81 of the ITA to collect information from other parties that are relevant to determining the quantum of tax evasion or fraud,” says Chong, adding that the conditions in which the DGIR can do so must be clear.

“There must be a balance between the DGIR’s powers to collect information for tax purposes and the powers of confidentiality of information of the taxpayers. The DGIR should not have absolute powers to collect information without reason, and taxpayers who are committing tax evasion or fraud should not be shielded by the PDPA to hide their crimes.”

In Malaysia, taxpayers are expected to voluntarily declare their income and trading gains, which are taxable if they are active traders. The IRB initiates tax audits randomly on taxpayers to ensure compliance.

It could also target specific taxpayers who have unexplained wealth, which means that the taxpayer maintains a lifestyle beyond the means of the income reported in his annual tax returns, says Chong.

“In this situation, the IRB may require taxpayers to prepare a capital statement that will reveal the taxpayer’s income, as the capital statement has to match the taxpayer’s expenses with their income.”

Banks that notice suspicious transactions could also inform the central bank, which might then notify the IRB. There could also be informants who go directly to the IRB, says Anand.

If a new wealth tax in the form of a capital gains tax were to be introduced, it would be up to the taxpayers to declare their capital gains for income-tax purposes. Currently, Malaysia imposes capital gains tax only on the disposal of real property or on the sale of shares in a real property company.

“Otherwise, the IRB or government may have to look at passing or amending legislations to enable the flow of information from the operators, which could include cryptocurrency platform operators and Bursa Malaysia, to the IRB in the form of annual declarations of their users’ gains. That is much like how companies currently submit Form E, which declares to the IRB their employees’ annual income,” says Chong.

That will have to be done without sacrificing personal privacy, say the interviewees. But is that possible?

Amarjeet believes so. “Technology available today provides the opportunity to address some of the structural limitations of the current tax administration system, such that the taxation processes can be integrated into the systems used by taxpayers as part of their daily lives,” he says.

For instance, automated data collection from exchange and electronic payment platforms could give IRB almost real-time information on trading gains, Amarjeet adds.

“Furthermore, introducing electronic invoicing to reduce the use of cash will increase visibility of the taxpayers’ transactional activities.”

He brings up an example of Brazil, whose e-invoicing system is complemented by tax rebates and monthly lotteries, incentivising consumers to submit their receipts online to tax authorities for cross-checking against the same receipts submitted by businesses.

“As a result, the country’s sales and net tax revenue were reported to have increased by 21% and 9.3%, respectively, in the first four years of implementation. Similarly, Mexico experienced a 48% hike in revenue from tax on goods and services after e-invoicing was made mandatory in 2014. It brought 4.2 million microbusinesses into the formal economy,” says Amarjeet.

The boom in cryptocurrency and digital asset investments in recent years has posed a headache for tax authorities globally. Its decentralised nature, anonymity of asset owners and valuation difficulties make it a challenging asset to tax. Tax authorities worldwide will have to improve their capabilities to understand the various digital assets and cryptocurrencies.

“It is known that cryptocurrency platforms require users to register their accounts with some form of identity document verification. As such, the IRB may identify specific taxpayers via other methods — like those who have unexplained wealth or publicly declared they are trading in cryptocurrency — and approach the platform operators to obtain information on those taxpayers,” says Chong.

He believes, however, that international initiatives might be due soon, as it is a problem that governments and tax authorities face globally.

Wealth reached out to the IRB for comments but had yet to receive a reply by press time.

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.