Each of us in the Internal Revenue Service (IRS), is affected in the performance of our duties by laws governing the degree of confidentiality to be accorded to the records and information we work with. Under these laws we determine what information is confidential, its degree of confidentiality, who may have access to it and for what purposes, and how we must account for any release of confidential Information. Under these laws, we also determine what information must be made public and, if so, whether it must be published, made generally available, or made available only upon request. In addition, these laws restrict the types of personal information we may gather and maintain about individuals, and grant individuals the rights to inspect and amend records about themselves.

These laws are collectively referred to as disclosure laws. They are principally composed of certain sections of the Internal Revenue Code (IRC), (especially IRC §6103, IRC §6104, IRC §6105 , IRC §6110, IRC §7213, IRC §7213A, and IRC §7431, the Freedom of Information Act (5 U.S.C. 552), and the Privacy Act (5 U.S.C. 552a). Disclosure laws balance the competing interests of protection of the public's personal and financial privacy while maintaining open and effective administration of government.

This IRM provides the instructions, guidelines, and procedures necessary to fulfill our obligations under the disclosure laws.

There are various web-based products available for both Disclosure personnel and IRS employees that are useful in either responding to technical inquiries and in understanding your disclosure requirements.

The tools available to assist Disclosure personnel can be found on the Disclosure web page through the Disclosure Resources web page and are as follows:

The tools available to assist other IRS employees in understanding and applying their disclosure responsibilities can also be found on the Disclosure Reference web page at the following link: http://mysbse.web.irs.gov/CLD/GLD/Disclosure/Reference/default.aspx . Some examples of what is available are as follows:

The Office of Governmental Liaison and Disclosure GLD) is responsible for the IRS disclosure program. To meet this responsibility, the Office of GLD must be kept informed of the problems and questions that the various IRS functions encounter. Accordingly, requests for advice or legal opinions are to be addressed to the Office of GLD.

The Office of GLD will often be able to respond to such inquiries directly since many of the questions raised are either procedural in nature or involve legal issues which have already been addressed by the Office of Associate Chief Counsel (Procedure and Administration). Disclosure officials needing assistance on technical disclosure matters should seek assistance, through appropriate channels, from the Office of the Chief Disclosure.

Staff of the Office of GLD and Chief Disclosure will refer issues that require legal advice to the Office of Associate Chief Counsel (Procedure and Administration) using agreed upon procedures and will provide guidance to the requester after receiving advice from Counsel.

In administering Federal tax laws, the IRS receives, collects, and maintains vast amounts of information protected by law. The Internal Revenue Code prohibits unauthorized disclosure of tax returns and return information. The United States Code Title 18, Section 1905 (18 U.S.C. 1905), prohibits unauthorized disclosure of certain types of confidential financial and commercial information. The Privacy Act, 5 U.S.C. 552a, prohibits unauthorized disclosure of information from systems of records pertaining to individuals. Each of these statutes provides criminal and/or civil sanctions for unauthorized disclosure of protected information.

All IRS officials and employees must be aware of information that must be protected, how to protect it, and how to dispose of or destroy the information when it is no longer required. Proper destruction of protected records is an especially important step in preventing unauthorized disclosures that could occur when protected records are merely discarded.

IRM 1.15.2, Types of Records and their Life Cycles, and IRM 1.16.1, Physical Security Program, provide specific guidelines and procedures for safeguarding and disposing of protected records.

An unauthorized access or disclosure is willful when it is done voluntarily and intentionally with full knowledge that it is wrong.

For a complete discussion of the rules concerning unauthorized accesses or disclosures of confidential tax information, see IRM 11.3.38, Reporting Unauthorized Accesses or Disclosures.

Indications of willful (voluntarily and intentional with full knowledge of wrongdoing) unauthorized accesses or disclosures of returns or return information must be reported to TIGTA. Field employees should report these matters to the local TIGTA office. Washington, D.C., metro area employees should report these matters to TIGTA's main office.

Unauthorized disclosures where no willfulness is involved, and as described in IRM 11.3.38, are not willful and are therefore excepted from the above TIGTA reporting procedures. Employees must report violations of this nature directly to their immediate supervisors who, in turn, are to report them to the local Disclosure Manager. Form 10848, Report of Inadvertent Disclosure of Tax And Privacy Act Information, is used for this purpose.

Generally employees commit inadvertent disclosure errors once (e.g., because of a misunderstanding of rules or procedures), and no further corrective action is necessary once the matter is discussed with the employee. Occasionally errors are repeated by the same employee or are serious enough even in one incident to warrant corrective action. When a manager thinks additional corrective action is necessary, he or she should consult the Labor Relations staff to determine if conduct or performance action is appropriate. The manager should still complete a Report of Inadvertent Disclosure of Tax and Privacy Act Information form and send part II to Disclosure. Disclosure can advise the manager and Labor Relations about the technical aspects of the disclosure, but not the appropriateness of any conduct or performance action. Again, if the manager believes an unauthorized disclosure is willful or deliberate, he or she should report it to TIGTA rather than to Disclosure and Labor Relations.

Generally, persons or agencies to whom IRS directly discloses returns or return information pursuant to IRC §6103 shall be informed in writing of the applicable criminal and civil sanctions for unauthorized inspections or disclosures as provided by IRC §7213, IRC §7213A, and IRC §7431. This may be accomplished by the use of Notice 129 ( See Exhibit 11.3.1-1 wherever possible. If the use of Notice 129 is not practical, insert text equivalent to Notice 129 in the response or transmittal letter to the requester.

Notice 129 (as revised) should be affixed to each magnetic media provided. ( See Exhibit 11.3.1-2). With the migration to a secure electronic transmittal of this information, the Notice 129A cannot currently be embedded in the electronic control file. Agencies receiving in these transmittals have been previously notified of the content of the Notice 129A and are subject to on-going safeguard reviews that verify the agencies, compliance with the disclosure laws and statutes discussed in the Notice.

Notices are not necessary for disclosures under IRC §6103(h)(1) IRC §6103(h)(6), IRC §6103(k)(6) , or to Congressional committees.

Some recipients of returns or return information who are covered by IRC §6103(a) do not receive the information directly from the IRS. Instead they receive the information from other Federal agencies who have the authority to make a re-disclosure (e.g., IRC §6103(I)(6) or IRC §6103(I)(10) disclosures to state or local child support enforcement agencies that receive information through the Health and Human Services Office of Child Support Enforcement, or IRC §6103(I)(12) disclosures to employees and officers of qualified employers or groups health plans from Centers for Medicare & Medicaid Services). The IRS will not be able to provide notices to these recipients. Instead, the IRS in its initial dealings with the recipient agency and in its written agreements, includes cautions for dissemination of confidential tax information.

The latest revision of Delegation Order 11-2, Authority to Permit Disclosure of Tax Information and to Permit Testimony or the Production of Documents, should be used to determine proper delegated authority. In addition, local or function specific re-delegations of 11-2 authority should be consulted.

Delegation of authority to respond to Freedom of Information Act and Privacy Act requests is issued by the Director, Office of GLD.

Records and files, created or maintained in the administration and execution of the disclosure program, must be disposed of in accordance with applicable legal and administrative requirements. See IRM 11.3.1.14 for information on IRS-wide records management issues.

Records or files must never be destroyed while they are the subject of a pending request, appeal, or lawsuit under 5 U.S.C. 552 (FOIA), notwithstanding applicable disposition schedules.

IRM 1.15.1, Records Management, provides instructions for the management of records in the IRS. Records Management also requires that all records be retained and disposed of in accordance with established Records Control Schedules.

Records created within or for the Disclosure function derive their retention periods from National Archives and Records Administration (NARA) General Records Schedule 14 or approved authorizations from the IRS Records Management Officer or Archivist of the United States.

The GLD Records Control Schedule as revised has been recently approved and published. It contains records control schedules for Disclosure specific records and should be consulted as needed. It can be accessed at: http://mysbse.web.irs.gov/CLD/GLD/Disclosure/Office/Awareness/PPT/6096.aspx

All non-record copies or reference materials may be destroyed when no longer needed.

Disposition instructions must be requested from the Director, Office of GLD, and cleared through the Records Management Officer for any item that is not included in the schedule.

Any item that has historical significance must be scheduled for offer to the National Archives and Records Administration. Disposition instructions will be issued on a case by case basis for records believed to have historical significance after approval of written justification for permanent retention. Forward such written justification to the Director, Office of GLD, who will clear it through the Records Management Officer of the IRS before disposition instructions are issued.

Faxing of tax information to other IRS offices is permitted consistent with existing internal rules. The subsections below provide guidance in determining whether it is appropriate to fax tax information to taxpayers or their authorized representatives within the United States, U.S. possessions, commonwealths, and territories. See IRM 10.8.1, Facsimile and Facsimile Devices, which contains several clarifying examples. A chart highlighting faxing rules can be found at: http://mysbse.web.irs.gov/CLD/GLD/Disclosure/Office/TechnicalResources/IRC+6103/Guidelines/3272.aspx . IRM 10.8.1 includes more detailed information on faxing between IRS offices and should be referenced for questions about that process.

Facsimile transmission of sensitive but unclassified (SBU) material (which includes tax information) to foreign countries is governed by the Department of State. If operational requirements demand that sensitive but unclassified (SBU) information be sent by unclassified fax to overseas locations, the originator must carefully review the document and comply with all requirements contained in IRM 11.3.1.10, Facsimile Transmission of Tax Information. The transmission of SBU information must be restricted to the conduct of official U.S. business. The custodian of the information must ensure that the recipient’s facsimile phone number is correct, that the recipient is authorized to receive the information, and when faxed to a number outside U.S. Government control, that the recipient is present to receive the information.

The legal authority for permitting facsimile transmission of tax information is consistent with that which allows for the telephonic disclosures of tax information and the mailing of tax information. However, since faxing presents more security vulnerabilities, careful consideration of all IRC §6103 requirements is especially important. Information shall only be disclosed in accordance with the IRC.

Faxing of tax or Privacy Act information should only be used in those situations where the authorized recipient has approved use of the faxing method for the information involved.

The facts and circumstances of each case should be considered prior to making a disclosure via facsimile transmission.

Careful consideration should be given to accepting faxed return information in conjunction with examination activity, collection activity, and criminal investigations. Employees must consider and evaluate the need to examine original documents as opposed to faxed copies.

Issues concerning the acceptance of a faxed return, document, signature, etc., as opposed to obtaining the original, must be addressed individually. See the Deputy Commissioner for Services and Enforcement June 24, 2003 memo on "New Policy for Use of Fax and Signature Stamps in Taxpayer Submissions." See IRM 21.3.4, Use of Fax for Taxpayer Submissions. In situations concerning the legality of accepting a fax in lieu of original documents, assistance and guidance of Counsel should be sought.

Each office establishing formal guidelines for faxing should address the potential need for a paper trail, such as maintaining a centralized log. Logs should be maintained based upon local office need; however, all applicable statutory requirements must be met.

Procedures for facsimile transmissions of tax information to taxpayers and their authorized representatives include:

The information in (9) above is not all inclusive. If any doubt exists as to the validity of the caller’s identity, entitlement, and/or intent, information should be mailed to the taxpayer’s address of record.

While faxed information is not sealed and little protection may be guaranteed at the receiving end, certain precautions are to be used to protect confidential tax information. At a minimum, a cover sheet, identifying the person for whom the information is intended and how many pages are being faxed, must be used. This cover sheet should not contain specific confidential information of the taxpayer other than their name and phone number, assuming the fax is directed to the taxpayer. If faxing to an authorized third party, put the name of the third party on the cover sheet, not the taxpayer's name, TIN, or other confidential information. The information should be faxed in an order in which the cover sheet will become the first page covering the faxed tax information.

The following statement is to be used on all cover sheets:

IRS policy is that we accept collect calls in misdirected fax notifications. This is based on the fact that we must take reasonable steps to correct the error and get the faxed information to the correct party. Also, the number of misdirected fax situations should be few. Any perceived conflict with a general IRS policy of accepting collect calls can be mitigated by using a toll free number for reporting misdirected faxes.

If an IRS employee receiving a phone call notification regarding a misdirected fax decides, after talking with the recipient, that, the caller will properly destroy (e.g., shred) the misdirected information, the IRS employee need not ask the recipient to return the information to the IRS. If the IRS employee is concerned that the unintended recipient may not properly destroy the faxed information, the employee may request that the information be mailed back to the IRS and may take such steps necessary for the Government to cover the costs for such mailing.

Guidelines for faxing between IRS offices were contained in a July 2000 memo from IRS' Chief Information Officer to all IRS Executives. See IRM 10.8.1,Information Technology (IT) Security Policy and Guidance for the use of non-encrypted fax machines to transmit SBU information (including returns and return information) between IRS offices in the United States is permissible as long as the following physical security and management controls are used:

Fax machines should be secured at the end of the day.

The United States Office of Government Ethics (OGE) has no independent right of access to tax information under IRC §6103. OGE's statutory mandate is not tax administration.

When IRS employees report ethics violations to the OGE, no tax information may be disclosed. OGE's authorizing statute recognizes that OGE will not have access to agency records prohibited by law from disclosure.

Relatives of IRS employees have no right to access or receive confidential information based on their relationship to the IRS employee. Potential criminal and civil penalties under IRC §7213, IRC §7213A, IRC §7431, 5 USC 552, and 18 USC 1905, among others, could apply to such accesses/disclosure.

When IRS employees bring confidential information home, all applicable security rules must be followed (e.g., Flexiplace guidelines).

When IRS employees bring relatives (e.g., children) into their work environment, care must be exercised to ensure that the visitors are not exposed to confidential information verbally, on computer screens or in hard copy. It is immaterial whether the visitors have an interest in the material or understand the technical work-related meaning of the information. During "Take Your Children to Work Day" , children cannot be allowed access to confidential information while parents explain their job or tour the work environment, etc. Even simple tasks such as photocopying could involve inappropriate exposure to confidential information. Exposure to confidential information is not allowed and can have severe consequences.

Relatives must not accompany employees during field compliance activities where the accompaniment itself could reveal who has a tax liability, who is being examined, etc.

Security and disclosure are not synonymous. Practicing security awareness reduces the risk of unauthorized or inappropriate access or disclosure. The Disclosure function has no jurisdiction over the rules applicable to physical and computer security, but does work closely with the security functions in the setting and communicating of standards.

Physical security standards fall under the oversight of Agency Wide Shared Services (AWSS) Physical Security and Emergency Preparedness. See IRM 1.16.1, Physical Security Program .

Computer and electronic security, including use of E-mail and the Secure Messaging System, fall under the oversight of Information MITS Cybersecurity Policy and Program Management. See IRM 10.8.1, Information Technology Services (IT) Policy and Guidance.

Modernization & Information Technology Services has final jurisdiction over security policy as it applies to faxing and use of cordless devices. They have concurred with the guidelines on faxing and cordless devices as detailed respectively in subsection 11.3.1.10 above, and IRM 11.3.2, Use of Cell Phones and Cordless Devices .

Records management is the planning, controlling, directing, organizing, training, promoting, and other related activities related to the creation, maintenance, use, and disposition of records for proper documentation of an agency's policies and transactions. Records management in IRS comes under the jurisdiction of the IRS Records and Information Management Services (RIMS) Program, part of Agency-wide Shared Services (AWSS).

A Federal record is any recorded information relating to work of an office regardless of the medium, who created the record, or how it was created. Most records are paper documents, but increasingly records are becoming electronically generated and maintained (e.g., Word, Excel, and E-mail documents). Other types of records include photographs, maps, microfilm and fiche, video and sound recordings, and computer tapes or diskettes and CDs.

The Federal Records Act of 1950, as amended, governs the creation and preservation of government files. Other statutes and policies also apply. IRS works closely with the National Archives and Records Administration to ensure compliance with records management requirements.

IRM 1.15.1, The Records Management Program, IRM 1.15.2, Types of Records and their Life Cycle, IRM 1.15.3, Disposing of Records, and IRM 1.15.7, Files Management, should be consulted for guidance on the records management program. The Records Management website is: http://awss.web.irs.gov/facilities/RecordsMgmt/REFM-Index.htm.

In today's climate, security checks are everywhere - IRS offices, airports, and at other buildings IRS employes must access during the performance of official duties.

Certain precautions are needed to mitigate the risk of disclosures that might occur when employees are subject to a security check and their briefcase or suitcase contains tax information or other sensitive data.

Whenever providing tax information to taxpayers or their representatives, it is important to ensure that only authorized information is disclosed.

Often, tax transcripts (including computer printouts) must be sanitized by redacting information that:

Any such redactions must be authorized by a functional employee having authorization to do so. See Delegation Order 11-2 or established functional guidelines on transcript redacting

Functional IRMs and various sections of IRM 11.3 provide guidance about redacting standards.

While some transcripts are specifically designed for taxpayer use (e.g., RTFTP, MFTRAX, IRPTRW without the summary sheet), others are not and require much more scrutiny and deliberation before release to a taxpayer is made.

Freedom of Information Act redaction guidelines must be followed when applicable. See IRM 11.3.13, Freedom of Information Act.

Disclosure personnel can be consulted with questions regarding redactions.

The Office of Special Counsel (OSC) is an independent Federal investigative agency whose primary mission is to safeguard the merit system by protecting Federal employees and applicants from prohibited personnel practices, such as reprisal for whistle-blowing. Occasionally in the context of an OSC investigation, or the use of tax information in a court proceeding, a question arises as to whether tax information may be accessed by OSC.

The OSC investigation is a "proceeding affecting the personnel rights" of the employee. Tax information may be disclosed to the OSC investigator under IRC §6103(l)(4)(B) if the IRS determines that the disclosure is necessary to advance or protect the interests of the United States. Generally, OSC should be asked to make a written request explaining the reasons why tax information is needed. Data should be stripped of identifiers unless inclusion of identifying information is necessary to advance or protect the interests of the United States. If the investigation's focus turns to the actions of a specific manager, then the OSC investigation is also a "proceeding affecting the personnel rights" of the manager. At that point, the manager (or his private attorney) may make an IRC §6103(l)(4)(A) request for relevant and material tax information. Disclosures must be approved by officials having Delegation Order 11-2 authority. See IRM 11.3.20, Personnel Records, for more information on IRC §6103(l)(4).

The Privacy Act may be involved if OSC requests nontax information, such as personnel records, from the IRS. Personnel records may be turned over to OSC pursuant to the "routine use" authority of Treasury/IRS System of Records 36.003, General Personnel and Payroll Records .