Comments to IRS on Tax Return Info Sharing
[BY EMAIL Notice.Comments@irscounsel.treas.gov / Notice 2005-93 and E-Filing REG-137243-02.]
March 8, 2006
CC:PA:RU (Notice 2005-93)
Room 5526
Internal Revenue Service
Ben Franklin Station
Washington, DC 20224
CC:PA:LPD:PR (REG-137243-02)
Room 5203
Internal Revenue Service
PO Box 7604
Ben Franklin Station
Washington, DC 20044
Re: Comments of the Electronic Privacy Information Center, Privacy Rights Clearinghouse, and World Privacy Forum on Notice 2005-93 and REG-137243-02 Concerning Secondary Use of Tax Preparation Data
To Whom It May Concern:
EPIC is a public interest research center in Washington, D.C. It was established in 1994 to focus public attention on emerging civil liberties issues and to protect privacy, the First Amendment, and constitutional values.
The Privacy Rights Clearinghouse (PRC) is a nonprofit consumer organization with a two-part mission -- consumer information and consumer advocacy. It was established in 1992 and is based in San Diego, California. It is primarily grant-supported and serves individuals nationwide.
The World Privacy Forum is a nonprofit, non partisan organization focused on conducting in-depth research and consumer education in the intersecting areas of technology and privacy.
We submit the comments below on Notice 2005-93 and proceeding REG-137243-02.[1]
Introduction
Section 7216 of the Internal Revenue Code, 26 U.S.C. § 7216, prohibits tax return preparers from using or disclosing tax return data except as allowed by Congress or by the implementing regulations. The IRS drafted proposed changes to those regulations in response to concerns about privacy problems created by the secondary marketing use of tax information and the outsourcing of tax preparation services.[2] The agency seeks to safeguard taxpayer information by making knowing and voluntary consent a prerequisite for disclosure of personal information.[3]
The proposed changes to the regulations represent an important effort to increase taxpayers' awareness of what is done with their personal information. However, the updated regulations fail to adequately safeguard taxpayer privacy because they neglect to protect information once it is disclosed, allow consent that is less than voluntary, and carry penalties that are not harsh enough to ensure tax return preparers obey the law.
Most importantly, taxpayers lose most of the protections for their private information as soon as they consent to its disclosure. While the proposed regulations generally set a high standard for consent, they give tax return preparers no incentive to make responsible decisions about disclosure, and they often impose no obligations at all on the recipients of disclosed information. Insufficient protections endanger consumer privacy. The British tabloid The Sun demonstrated these risks to privacy when it purchased the details associated with 1000 personal bank accounts from an Indian call center employee for $5000.[4]
Taxpayers entrust their tax return preparers with sensitive personal information, and they deserve a guarantee of responsible behavior in return. Furthermore, preparers are in a position to evaluate the credibility of third-party recipients of taxpayer information, while consumers are not. In fact, in some cases, companies characterize their information sharing relationships as "trusted" or otherwise vetted by some process to ensure their integrity. In reality, these information sharing agreements will be made with almost any company, and the offers to enter into one of these agreements are advertised to the world on the Internet, not to a limited group of "trusted" partners.[5]
These factors should create an obligation for tax return preparers to refrain from making disclosures without taking precautions to ensure the continued security of taxpayer information. Instead, the proposed regulations give consumers a hollow right to control over their personal information because consent to disclosure eliminates most protections. If tax preparers will not take responsibility for the use of personal data by information sharing partners, IRS should withdraw the consent rule and not allow disclosures for marketing purposes whatsoever.
This problem is intensified by exceptions to the "knowing and voluntary" consent standard. Tax return preparers are allowed to disclose information to other domestic preparers, including the contractors who repair their equipment and software, without any guarantee of credibility and without even informing the taxpayer. Such induced consent is not truly voluntary because consumers will be unwilling to back out of the service entirely by the time they receive the consent notice, and because they will be unable to find affordable alternatives that do not impose the same conditions.
In addition to allowing involuntary consent, the regulations do not adequately ensure that consent will be "knowing." They make an important start by setting minimum text and paper sizes and requiring that all the text on a consent page relate to the disclosure or use authorized. However, they do not ensure that, in practice, consumers will read and understand the consent form. As the National Consumer Law Center [NCLC] notes in its comments, time pressures and lack of English literacy may prevent taxpayers from reading the consents they sign. We second the NCLC's recommended requirements for preparers who use software to provide services in person. Preparers should be required to obtain consent electronically, following the steps now required for electronic consent. Additionally, the text of the consent should be read aloud by audio output. We agree that this policy approach will be effective because it will draw greater attention to the consent. It will also create an electronic trail, allowing the IRS to ascertain whether the required process is followed.
Even if the regulations are changed to better protect taxpayer privacy, the current penalties under Sections 7216 and 6713 are not harsh enough to deter tax return preparers from breaking the law. Taxpayer information is very valuable, and many preparers may decide that they stand to gain more from selling it than they are likely to lose through prosecution under § 7216.
Specific Comments
1. §301.7216-1
-
Tax return preparer
The proposed definition of "tax return preparer" is appropriately broad. Importantly, even preparers who do not charge a fee for tax return preparation services are included within the definition. This inclusion will prevent preparers from offering free services in order to collect and sell taxpayer information.
However, the proposed definition excludes employees of tax return preparers who do not personally assist in the preparation of returns or assist in the provision of auxiliary services. Any employee with access to tax return information should be prohibited from using or disclosing it.
-
Tax return information
We strongly support the inclusion of all information "furnished in any form or manner for, or in connection with," preparation of the taxpayer's tax return within the definition of "tax return information." All such information is provided in order to receive tax preparation services, so the taxpayer should be able to limit its use to legitimate tax return preparation purposes.
However, § 301.7216-1(b)(3)(ii) Example 1 could be read to imply that information supplied to register tax preparation software is not tax return information unless the tax return preparer states during the registration process that it will provide updates to registrants. Because consumers furnish registration information in connection with return preparation and for the purpose of receiving tax preparation services, registration information falls within the definition of tax return information regardless of whether the preparer advertises or provides software updates. We recommend the revision of Example 1 to clearly indicate that all information supplied to register tax preparation software is tax return information.
-
Use
"Use" is narrowly defined by the regulation as any circumstance where a covered entity "refers to, or relies upon, tax return information as the basis to take or permit an action." IRS should expand the definition of "use" to include all foreseeable situations where the preparer accesses the information.
The regulations currently afford very little protection for tax return information after the taxpayer consents to disclosure. They allow preparers to condition service on disclosure to contractors but give them no incentive to ensure that those contractors do not abuse the information. To encourage preparers to disclose information responsibly, use by a preparer should include subsequent use by a person to whom the preparer discloses information.
-
Disclosure
Importantly, the regulations clarify that disclosure includes any affirmative manner of making information known to any person. However, the definition of disclosure should be expanded to include situations where tax return preparers merely make information available passively, by inaction (for instance, where a preparer leaves information on a desk or on a computer screen that a passerby or other unauthorized person can see). Tax return preparers are entrusted with sensitive personal information, so they should be responsible for safeguarding information rather than just refraining from willfully making it known. This distinction could be important regarding employees who are excluded from the definition of "tax return preparer" under § 301.7216-1(b)(2)(i)(D).
"Disclosure" by a tax return preparer should also include subsequent disclosure by a third party to whom the tax return preparer makes information available. As discussed above, the regulations currently allow preparers to condition service on disclosure to contractors but give them no incentive to ensure that those contractors do not abuse the information. Extending the definition of disclosure would encourage preparers to make responsible decisions about contracting out tax return preparation. In the marketing industry, it is routine to sell a customer list under the condition that the recipient not re-disclose the information to others. Marketers even "seed" their lists with dummy addresses that are monitored to catch recipients who use the list more than once or those who resell the information. Similar procedures should be in effect to prevent a chain of reselling of tax return information.
2. §301.7216-2
-
Disclosures to other tax return preparers
The exception to the consent requirement for disclosures to other tax return preparers inappropriately weakens the "knowing and voluntary" consent requirement. Consumers should be informed before their information is passed to third parties. Although all tax return preparers who receive taxpayer information are technically bound by the consent requirements of § 7216, this protection becomes less effective as information is passed to small, amorphous providers who may be difficult to track for enforcement purposes.
If the IRS does create an exception for disclosures made to contractors, the regulations should require disclosing tax return preparers to take affirmative steps to prevent misuse of the information by the third-party recipients. Disclosing preparers should be required to have audited security measures in place to protect the security and authenticity of data. Furthermore, as in the proposed regulations, disclosure should be limited to the extent necessary for the contractor to perform the services.
B. Certain disclosures by attorneys and accountants
Section 301.7216-2(h)(2) states that tax return preparers are permitted to use or disclose a taxpayer's information in the course of performing services for another client if "the information is, or may be, relevant to the subject matter of the legal or accounting services for the other client, and consideration of the information by those performing the services is necessary for the proper performance of the services." However, the regulation does not clearly limit the exception to such situations. It should state that use and disclosure are only permissible when relevant and necessary.
C. Payment for tax preparation services
As the regulations recognize, information the taxpayer provides to pay for tax preparation services is tax return information. The regulations appropriately limit the use and disclosure of such information to the extent necessary to process the payment and to the information relevant to the payment.
D. Producing statistical information in connection with tax return preparation business
The proposed regulations appear to allow the use of a statistical compilation of data for the internal management or support of the tax return preparer's tax return preparation business. This exception should be reduced to use for internal management, because "support" could be interpreted as financial support, allowing a tax return preparer to target specific customers with advertising.
3. §301.7216-3
-
Taxpayer consent
We strongly support the knowing and voluntary standard for taxpayer consent. If taxpayers do not actually understand what they are agreeing to, the consent requirement offers them no protection.
Importantly, the regulations generally prohibit preparers from conditioning service on consent. Conditioning service on consent makes consent involuntary because the consumer is likely to have committed to the service before the consent is requested, and is unlikely to find substantially different options elsewhere.
Even where service cannot be conditioned on consent, consumers may assume that they will be refused service if they decline consent. To prevent taxpayers from consenting because they erroneously believe that they must do so, the revenue procedure should require requests for consent to state that taxpayers will not be refused service if they decline to consent.
Additionally, the use or disclosure authorized by a consent should be limited to the information necessary to accomplish the purpose of the consent.
B. Disclosure of entire return
We strongly oppose the provision authorizing the disclosure of an entire return. Disclosure of a full return is never necessary for marketing. Marketers target individuals by categorizing them, and they do not need full returns to group consumers. Income ranges and other general facts will suffice.
3. Notice 2005-93
-
Separate written document
We strongly support the provisions requiring the notice and consent disclosures to appear on a separate piece of paper. In other situations, companies have attempted to obfuscate notice by providing it on papers integrated with a bill. Having the disclosure on a separate sheet of paper or computer screen will increase the likelihood that consumers see and read the notice. The minimum standards for paper and text size will also improve readability.
-
Identification of tax return information to be disclosed or used
We support the requirement that the consent specify the particular items of tax return information to be disclosed or used. However, the information used or disclosed should be limited to information necessary to accomplish the purpose of the use or disclosure.
-
Mandatory statements in the consent
Contrary to the required warning, taxpayers' privacy rights should not end when they consent to disclosure. Consumers entrust tax return preparers with sensitive personal information. Furthermore, preparers are in a position to evaluate third-party recipients of taxpayer information, while consumers are not. These factors should create an obligation to refrain from making disclosures without taking precautions to ensure the continued security of taxpayer information. Tax return preparers should be required to audit the people who receive information from them, and held responsible for abuse of information by those third parties. The mandatory warning should reflect this situation. If preparers cannot guarantee that information will be handled ethically and securely, there should be no consent option.
While the regulations properly require the tax return preparer to include certain statements in the consent, they should place stricter limits on what preparers may add to those statements. Section 4.01 appropriately requires that all text on the consent form pertain solely to the disclosure or use authorized. However, this requirement does not prevent a preparer from distracting taxpayers with long, misleading, or dull narratives. The text of consent forms should be limited to the mandatory statements and a succinct explanation of the use or disclosure.
-
Affirmative consent
We strongly support the affirmative consent requirement. Opt-out choice is not knowing and voluntary because it does not sufficiently direct the taxpayer's attention to the consent being given. Opt-out consent decreases the likelihood that the consumer will read and process the agreement.
-
Electronic signatures
We strongly suggest that taxpayers be required to physically enter a statement to indicate that they are willing to have their tax information disclosed. This requirement will force consumers to pay more attention to the consent process, increasing the likelihood that they see and read the notice. For instance, instead of typing in the customer's name in the form to express consent, the preparer could obtain a statement such as: "Although I am not required to do so, I give my consent for my tax information to be sold" or "I have taken the option to waive my right to keep my return information secret."
-
Examples
Example 2 allows the tax return preparer to make false statements in the request for consent. The hypothetical provider states that it must disclose taxpayer information to provide the taxpayer with information on IRAs or RALs. This claim is clearly untrue—the preparer could easily provide the customer with information about the services simply by providing a pamphlet or a link to an instructive website. The misrepresentation hides the fact that the preparer is selling the customer's personal information, and makes the disclosures authorized appear benign and necessary.
Respectfully Submitted,
/s
Pam Dixon
Executive Director
World Privacy Forum
Beth Givens
Director
Privacy Rights Clearinghouse
Chris Jay Hoofnagle
Director, West Coast Office
Electronic Privacy Information Center
Erin MacDonald
EPIC Intern
UC-Hastings Law
[1] IRS Issues Proposed Regulations to Safeguard Taxpayer Information, Internal Revenue Service, Dec. 7, 2005, available at http://www.irs.gov/newsroom/article/0,,id=151368,00.html
[2] Statement of Rep. Edward U. Markey (D-Mass.) on Proposed Taxpayer Privacy Rules, Dec. 7, 2005, available at http://www.irs.gov/newsroom/article/0,,id=151372,00.html
[3] IRS Issues Proposed Regulations to Safeguard Taxpayer Information, Internal Revenue Service, Dec. 7, 2005, available at http://www.irs.gov/newsroom/article/0,,id=151368,00.html; Statement of Rep. Edward U. Markey (D-Mass.) on Proposed Taxpayer Privacy Rules, Dec. 7, 2005, available at http://www.irs.gov/newsroom/article/0,,id=151372,00.html
[4] Transcript of Quentin McDermott's report into cyber-fraud, "Your Money and Your Life," Australian Broadcasting Corporation, Aug. 15, 2005, available at http://www.abc.net.au/4corners/content/2005/s1438338.htm
[5] Over 50,000 "datacards" advertising the sale of personal information are available online in the "List Finder" section of Direct Magazine: http://www.directmag.com.