External agencies and their contractors that receive Federal tax returns and/or return information subject to the safeguards of IRC 6103(p)(4) must file a Safeguard Procedures Report (SPR) with the Service prior to the receipt of the tax information. This enables the Service to review the agency's and contractor's procedures for protecting return information from unauthorized inspection or disclosure before the information is released. Agencies must submit a revised Safeguard Procedures Report whenever significant changes occur in their safeguard program; this should take into consideration changes made by agency contractors. See the subsection on " Submission of Safeguard Procedures." Exhibit 11.3.36-1 identifies the IRS GLD offices and their responsibilities for each type of agency in the safeguard awareness, evaluation and review process.

Annually thereafter, agencies submit a Safeguard Activity Report (SAR)to certify that they are continuing to protect return information. Refer to IRM 11.3.24.3.2(1) for information on recertifying SARs from contractors.

It is important that these reports are complete and remain current. In order for agencies and contractors to submit acceptable reports, recipients of Federal tax information must be aware of the IRS reporting requirements. The requirements are outlined below and are included in IRS Publication 1075, Tax Information Security Guidelines for Federal, State, and Local Agencies.

Authorized agents and contractors are to submit their SPRs and SARs to the agency for routing to the IRS Disclosure Office. IRS contractors are to submit their SPR and SARs to the COTR; refer to IRM 11.3.24.3.2(1)(b) for additional discussion of the necessary reporting requirements for contractors.

Agency and contractor reports will be evaluated upon receipt. If reports are complete and no significant questions arise, the evaluation should be concluded within 45 calendar days for the SPR and 30 calendar days for the SAR, with written notification to the agency and contractor via the agency.

It is essential that Disclosure Officers take a pro-active approach in assuring that agencies and agency contractors submit complete and comprehensive SPRs. To the extent necessary, hands-on guidance/assistance should be provided so that the agencies and their contractors will be aware of what kind of information is Federal tax information, its level of importance, and when new reports are needed.

Agencies and contractors are required to develop safeguard procedures for all tax data received and all uses of that data by the agency or the contractor. Agencies and contractors receiving tax information under a single section of the Code may have several separate or independent uses of the data within the agency, involving several programs or functional units. The report should describe the various program uses and attendant safeguards in the information paragraph Flow of the Data; refer to subsection 36.6.2(4).

Disclosures Under Multiple Code Sections (Federal Agencies)—Some Federal agencies receive tax return information from the IRS under the authority of more than one section of the Internal Revenue Code. In these cases, the agency must distinguish between the IRC sections, and provide safeguard procedures for each program or use. The agency may either file separate Safeguard Procedures Reports or consolidate the separate procedures for the various programs or uses into a single SPR.

Federal, state, and local agencies requesting Form 8300 information pursuant to IRC 6103(I)(15) must file a separate SPR for this program. All agencies requesting data under IRC 6103(I)(15) should be referred to the Director, Governmental Liaison and Disclosure (Attention: Headquarters Safeguards Office).

Responsible Officer(s)

Initial/new recipient agencies must include a copy of the statute(s) governing their activities for which Federal tax information will be used, including legal authorities or delegation orders permitting use and access, as may be applicable.

Location of the Data—Include an organization chart or narrative description of the receiving organization agency, agent, or contractor that includes all functions where tax data will be processed or maintained. If the information is to be used or processed by more than one function, then the pertinent information must be included for each function.

Flow of the Data—The report must contain a chart or narrative description of :
 

System of Records—A description of the permanent record(s) used to document requests for, receipt of, dissemination of (if applicable), and final disposition (return to the IRS or destruction) of the tax returns or return information (including tapes or cartridges). Agencies and contractors are expected to be able to provide an "audit trail" for information requested and received, including any copies or distribution beyond the original document/media.

Secure Storage of the Data—A description of the security measures employed to provide secure storage for the Federal tax data when it is not in current use. Secure storage encompasses such diverse considerations as locked files or containers, secured facilities, key or combination control, off-site storage, and restricted areas. It is requested that Federal agencies submit a Vulnerability Assessment completed by the General Services Administration for their building(s) as it addresses physical security.

Restricting Access to the Data—Restricting access to Federal tax information is the keystone of a sound safeguard policy, and a basic premise of the safeguard procedures employed by an agency, authorized agent, and contractor to ensure confidentiality. The agency’s and contractor's procedures should be designed to strictly limit access to the data to those employees with a need-to-know, and to prevent casual or unintended access (see IRC 7213A). The Safeguard Procedures Report should contain as much detail as necessary to provide assurance that the Federal tax information remains confidential and the taxpayer’s right to privacy is protected. The report should describe the procedural, physical, and systemic means employed to limit unauthorized access to the information as the information is used by the agency, organizations within the agency, and contractors.

Disposal—A description of the method(s) of disposal of the different types of tax information provided by the IRS, and/or produced by the agency and contractor (e.g. print-outs, back-up tapes and the like), if not returned to the IRS. The IRS has the right to request a written report that documents the method of destruction and which records were destroyed (see paragraph (5), System of Records, above).

Computer Security—All automated information systems and networks that receive, process, store, or transmit sensitive but unclassified information (tax return information) must meet the requirements for Controlled Access Protection as evaluated by the National Institute of Standards and Technology.

Disclosure Awareness Program—Each agency and contractor receiving returns and return information should have an awareness program by which all employees having access to the tax information certify annual notification of the confidentiality provisions of the Internal Revenue Code, what constitutes Federal tax information, and the civil and criminal sanctions for unauthorized inspection or disclosure. A description of the formal program should be included in the Safeguard Procedures Report.

The initial Safeguard Procedures Report should be submitted to the IRS at least 45 days prior to the scheduled or requested receipt of Federal tax information. Additional disclosures or receipts under the same authorizing IRC section do not require additional SPRs.

If the safeguard procedures outlined in the most recent Safeguard Procedures Report have become obsolete because of organizational or procedural changes within the agency, a new SPR should be filed.

Whenever legislative change authorizes an agency to receive tax data for a new or different purpose, a new or revised Safeguard Procedures Report covering the additional program(s) must be filed.

All agencies listed at 36.5(1) above should submit their SPRs and the reports of their authorized agents and contractors to:
Deputy Director
Office of Governmental Liaison and Disclosure
CL:GLD, Room 1603IR
Attn: Headquarters Safeguards Office
1111 Constitution Avenue, NW
Washington, DC 20224

Reports from state tax agencies and their authorized contractors should be submitted to the GLD Area Manager (Attn: " Liaison" Disclosure Officer). The "Liaison" Disclosure Officer is the one that has oversight responsibility for the State tax agency.

Changes to information or procedures previously reported, e.g.

Current annual safeguard activities shall include, at a minimum, the following items:

Actions on Safeguard Review Recommendations—If a safeguard review has been conducted and changes recommended by the IRS, the agency and/or the contractor should report all actions that have been taken (or are being initiated) regarding those recommendations.

Planned Actions Affecting Safeguard Procedures—Any planned agency or contractor action which would create a major change to current procedures or safeguard considerations should be reported. Such major changes would include, but are not limited to, new computer equipment, facilities or systems, or use of a non-agency contractor (as permitted by law or regulation) or subcontractors, to perform programming, processing or administrative services requiring access to Federal tax information.

Federal agencies and state Child Support Enforcement Agencies—Safeguard Activity Reports should be submitted for the calendar year by January 31 of the following year to:
Deputy Director,
Office of Governmental Liaison and Disclosure
CL:GLD, Room 1603IR
Attn: Headquarters Safeguards Office
1111 Constitution Avenue, NW
Washington, DC 20224

State Tax Agencies — Their Safeguard Activity Reports and the reports of their authorized agents and authorized contractors for the calendar year should be submitted by January 31 of the following year to the liaison Disclosure Officer.

State Public Assistance Agencies — Safeguard Activity Reports for the processing year (July 1 through June 30) should be submitted by September 30 to:
Deputy Director,
Office of Governmental Liaison and Disclosure
CL:GLD, Room 1603IR
Attn: Headquarters Safeguards Office
1111 Constitution Avenue, NW
Washington, DC 20224

Federal, State, and Local Law Enforcement Agencies — Agencies receiving Form 8300s pursuant to IRC 6103(l)(15) should submit their reports for the processing year (May 1 through April 30) by June 30 to the address in (3) above.

Disclosure personnel need to evaluate SARs thoroughly and quickly. If an SAR is incomplete or unclear, the agency or the contractor should be contacted and asked to provide the necessary additional information. The aggregate reports (most current SPR and SARS) should clearly reflect the safeguard procedures in place at the present time.

Delinquent reports, reports with incomplete information or reports which reveal safeguard deficiencies should initially be resolved through informal telephone contact between the reviewer and the agency or the COTR, in regards to SPRs solicited by the Headquarters Safeguards Office.

If an agency or contractor has sent the required report but does not supply missing information or take corrective action upon request, the reviewer should consider a limited review (see subsection 36.10.7) in order to obtain the information or cause corrective action to be taken.

If the agency or contractor fails to respond to a request for scheduling an on-site limited review, then formal procedures to withhold tax information may be initiated (see subsection 36.14.3). Conducting a review is an option and not required.

Reasonable attempts, including at least one written request, must be made to obtain a report, missing material, or cause corrective action to be implemented . If an agency or contractor fails to respond by sending in an acceptable report, the requested material or by taking action to correct a deficiency, formal procedures to withhold tax information will be initiated (see subsection 36.14).

If any agency or contractor fails to respond and is no longer receiving tax data, a written request will be made, to have the agency or contractor destroy any residual data or have it transferred back to the IRS.

If a deficiency is minor, not causing immediate unauthorized inspections or disclosures or the potential of immediate unauthorized inspections or disclosures, then the report may be held in abeyance or accepted with the deficiencies noted. The circumstances must be documented, including corrective actions to be taken and scheduled follow-ups by the reviewer.

The steps taken in reviewing reports and/or soliciting additional information from the agency or the contractor should be well documented. Notes, worksheets, communication contacts, memoranda, and other correspondence should be retained in the file to support decisions made as a result of the process.

If the evaluation of the reports and related materials does not indicate a need for an on-site review, then a letter should be sent to the agency or contractor acknowledging receipt and acceptance of the report. The letter should be signed by the appropriate supervisory level. The letter, however, should allow for the possibility of an on-site review, if subsequent information from other sources indicates a need for further investigation.

All state tax agency requests for tax information are subject to a Need and Use Determination which is to be documented by the Disclosure Officer with oversight responsibilities for the agency.

Need and Use Determinations are to be made at the time of request, prior to the actual exchanges(s), and should be a cooperative effort with the state tax agency to accurately determine the minimum amount or information required to accomplish the stated objective(s).

Disclosure Officers should ascertain and document the need for, and use of, the extracts requested by the state agency on the annual enrollment agreement to participate in the IRS Governmental Liaison Data Exchange Program. Please refer to IRM 11.3.32.4 for additional discussion regarding Need and Use Determinations.

Specific requests for return information may be related to a state agency project or to a joint project with the IRS, and there may be a separate Memorandum of Understanding covering the project. The Disclosure Officer should ensure that a documented Need and Use Determination is part of the request file.

Although a Need and Use Determination for a specific request may have been completed and documented, the agency may subsequently desire to use the information for a different tax administration purpose. If the subsequent use of the data is for bona fide tax administration purposes, and not in contravention of the Code, then applicable regulations, existing agency agreements, or Service policies, this would not usually be considered unauthorized use of the data so long as notification is given to the Disclosure Officer.

State requests for data for tax modeling or revenue estimating purposes may require extensive analysis. The State must clearly demonstrate that the data requested is the minimum required, and that the data will not be used by any other agency or for any purpose other than tax administration. The reason for the model creation must be for a tax administration purpose. The Disclosure Officer should request a detailed Need and Use Statement from the State agency in order to make a proper determination. There is no standard format for this Statement, but the State should be advised to describe all the data requested, why it is needed, how it will be used, who will have access to it, and why the information cannot be obtained or derived from other sources. See Exhibit 11.3.32-6 for modelling guidelines.

The Disclosure Officers will be responsible for maintaining complete and current documentation of the state tax agency’s need for and use of all Federal tax returns, return information and data elements which are provided to the agency on a continuing basis pursuant to the implementing agreement; refer to subsection 32.10.1.

The Office of Governmental Liaison and Disclosure has developed project guidelines for use when developing joint projects with the States. Disclosure Officers should be consulted on these projects regarding any statutory (Privacy Act or IRC 6103) considerations of the proposed disclosures or exchanges.

Need and Use Determinations should reflect the use of the tax data for tax administration purposes. The determination should not be contingent upon the cost-benefit analysis developed to make a business case for the project. However, projects that fall short of their initial objectives or expectations may indicate a need for a subsequent determination regarding the continuation of disclosures for the project.

A Need and Use Review should be considered as the verification or confirmation of the Need and Use determination made prior to the release of the requested tax information to the state agency.

An on-site Need and Use Review of each state tax agency receiving tax return information will be conducted at least once each fiscal year by the liaison Disclosure Office.

Disclosure Officers will establish an annual (fiscal year basis) review plan for the conduct of Need and Use Reviews to include all state tax agencies within their span of responsibility.

GLD Area Managers will incorporate the review schedules of the Disclosure Offices into the area plan and advise the Headquarters Safeguards Office of the schedules. Each GLD Area Office will provide, as prescribed in the annual program letter or other Directorship guidance, periodic reports to the Headquarters Safeguards Office of the status of reviews scheduled.

An evaluation of Need and Use is an element of all safeguard reviews of state tax agencies, and the Disclosure Officer should schedule the annual Need and Use review to coincide with a planned safeguard review.

The annual on-site Need and Use Reviews are conducted in order to provide reasonable assurance that the state tax agency’s actual need for and use of Federal tax information:

The scope of the review should be broad enough to provide the reviewer with sufficient information to document a conclusion as to the agency’s need for and use of Federal tax information. The reviewer should not make any assumptions regarding the current status (or usefulness) of exchanges that have been routinely in effect for many years.

Specific exchanges to be reviewed may vary from state to state, but the section on Information to be Exchanged on a Continuing Basis in the implementing agreement is a good starting point for planning the review.

Although the need for and use of specific types of data may remain fairly constant, tolerances and other selection criteria can be useful "filters" to help reduce the volume of data disclosed. Revising the tolerances may more accurately reflect the agency’s actual need for and use of the data as well as reduce the volume of unnecessary disclosures.

Other key areas to be reviewed would include (but are not limited to):

Non-use of tax data does not necessarily constitute misuse. However, the objective of the program is to reduce or eliminate unnecessary disclosures of tax information. If the original Need and Use determination was valid, but the actual utilization has been postponed, the Disclosure Officer should evaluate whether there is a reasonable expectation that continued retention of the data will be of value to the state for tax administration within a reasonable and logical timeframe .

Disclosure Officers must prepare a Need and Use Review Report promptly upon completion of the review. This report is to be furnished to the head of the state agency within 30 calendar days of completion of the on-site review. (If the Need and Use Review was conducted in conjunction with a scheduled safeguard review, the results will be included in the Safeguard Review Report and a separate report will not be required.) At a minimum, each report will:

Once the determination has been made that an on-site review needs to be conducted, the reviewer will evaluate whether a team approach is to be used, and if so, which functions will participate. The number of support personnel will depend on the complexity of the review, the size of the agency and contractor, and the amount of tax information shared. Campus personnel and Governmental Liaisons should participate when appropriate.

IRS Disclosure personnel are not computer security experts. Information processing is a dynamic environment and as the technology continues to advance, so does the importance of having a high degree of up-to-date knowledge for review purposes. Accordingly, IRS computer security technical specialists and other data processing professionals should be made available to accompany Disclosure employees for the automated systems portion of the safeguard reviews and provide input to the review report.

The reviewer or team leader is responsible for obtaining support from other functions and other offices. If support is desired from other Disclosure Offices or if needed support, such as a computer security analyst, is not available, the request for assistance will be coordinated through the GLD Area Manager(s) and/or appropriate functions. If necessary, GLD Area Managers may request assistance from HQS. When the HQS office requires field assistance, the team leader will coordinate the request through the GLD Area Manager(s).

The team leader may contact TIGTA to notify them of an impending review. TIGTA may be able to provide pertinent information concerning the agency and/or contractor and the Service function furnishing the tax data.

All personnel taking part in the actual on-site review should have an opportunity to participate in the planning process.

The team leader will make final assignments to each team member. Each assignment must have clearly defined boundaries to prevent overlap and duplication of effort.

The team leader will prepare the review plan and provide each team member with a copy of the plan as appropriate.