Which Federal, State, and Local Agencies Receive Taxpayer Information? According to IRS, there were 37 federal and 215 state and local agencies that received, or maintained records containing, taxpayer information under provisions of IRC section 6103 during 1997 or 1998. The information can include such things as the taxpayers’ names, Social Security numbers, addresses, or wages. Some agencies receive this information on a regular schedule—for example, monthly, quarterly, or annually. Other agencies receive it on an as-needed basis—for example, while conducting criminal investigations. How Is the Taxpayer Information Being Used? We asked the agencies we surveyed to indicate how they use taxpayer information. What Policies and Procedures Are Agencies Required to Follow to Safeguard Taxpayer Information? Before receiving taxpayer information from IRS, agencies are required to provide IRS with a detailed Safeguard Procedures Report (SPR) that describes the procedures established and used by the agency for ensuring the confidentiality of the information received. Agencies are expected to submit a new SPR every 6 years or whenever significant changes occur to their safeguard program. In addition to the SPRs and annual SARs that are sent to IRS, agencies’ OIGs may also review agency programs for safeguarding taxpayer information. How Frequently Is IRS to Monitor Agencies’ Adherence to the Safeguarding Requirements? IRS is supposed to conduct on-site reviews every 3 years to ensure that agencies’ safeguard procedures fulfill IRS requirements for protecting taxpayer information. IRS’ National Office of Governmental Liaison and Disclosure, Office of Safeguards, has overall responsibility for safeguard reviews to assess whether taxpayer information is properly protected from unauthorized inspection, disclosure, or use as required by the IRC and to assist in reporting to Congress. What Are the Results of IRS’ Monitoring Efforts? IRS’ safeguard reviews over the last 5 years have identified discrepancies in agency safeguard procedures and made recommendations for corrections. The reviews have uncovered deficiencies with agency safeguarding procedures, ranging from inappropriate access of taxpayer information by contractor staff to administrative matters, such as the failure to properly document the disposal of information. Possible use Tax administration and tax withholding purposes Criminal investigation and litigation Reporting criminal activities Judicial or administrative procedures Enforce federal criminal or civil statutes Locate fugitives from justice Conducting government program audits Statistical purposes Offsets Storing and maintaining data for IRS Administration of welfare and public assistance programs Collection and enforcement of child support Verify taxpayer filed original or amended return and initiate state audit Initiate state penalty investigation Audit selection Provide listing of alleged violators of criminal tax laws Verify or update addresses Skip tracing Sales tax matching Identify nonfilers Determine discrepancies in reporting of income Identify S corporation shareholders who avoid state tax by taking dividends in lieu of wages Statistical and revenue forecasting Identify payers and employers not reporting to state and determine underreporters Identify partnerships with changes in number of partners to detect possible sale of partnership interest Compare officers’ salaries and total wages paid on corporate returns to withholding tax filed Compare federal tax withheld to state tax withheld Locate delinquent taxpayers Identify out-of-state income (Continued)

Summary of Tax Information Security Guidelines for Federal, State, and Local Agencies

As a condition of receiving taxpayer information, agencies must show, to the satisfaction of the Internal Revenue Service (IRS), that their policies, practices, controls, and safeguards adequately protect the confidentiality of the taxpayer information they receive from IRS. Agencies receiving taxpayer information from IRS are also required to conduct internal inspections.
Why GAO Did This Study

Pursuant to a congressional request, GAO assessed the disclosure practices and safeguards employed by the Internal Revenue Service (IRS) and other federal, state, and local agencies to protect taxpayer information, focusing on: (1) which federal, state, and local agencies receive taxpayer information from IRS; (2) what type of information they receive; (3) how the taxpayer information is being used; (4) what policies and procedures the agencies are required to follow to safeguard taxpayer information; (5) how frequently IRS is to monitor agencies' adherence to the safeguarding requirements; and (6) the results of IRS' most recent monitoring efforts.

What GAO Found

GAO noted that: (1) there were 37 federal and 215 state and local agencies that received, or maintained records containing, taxpayer information under provisions of section 6103 during 1997 or 1998; (2) the information that agencies received included, among other things, the taxpayers' names, Social Security numbers, addresses, and wages; (3) the information came in a variety of formats; (4) some agencies received the information on a regular schedule; (5) others received the information on an as-needed basis, such as while conducting criminal investigations; (6) federal, state, and local agencies said they used taxpayer information for one of several purposes, such as administering state tax programs, assisting in the enforcement of child support programs, verifying eligibility and benefits for welfare and public assistance programs, and conducting criminal investigations; (7) before receiving taxpayer information from IRS, agencies are required to advise IRS how they intend to use the information and to provide IRS with a detailed safeguard plan that describes the procedures established and used by the agency for ensuring the confidentiality of the information they want to receive; (8) these safeguard plans are supposed to be updated every 6 years or if significant changes are made to the agencies' procedures; (9) agencies are also required to submit annual reports to IRS summarizing their efforts to safeguard taxpayer information and any minor changes to their safeguarding procedures; (10) in addition to providing IRS with safeguarding plans and annual reports, agencies' Offices of Inspector General may also review internal agency programs for safeguarding restricted or classified information; (11) IRS conducts on-site reviews to ensure that agencies' safeguard procedures fulfill IRS requirements for protecting taxpayer information; (12) IRS' National Office of Governmental Liaison and Disclosure, Office of Safeguards, has overall responsibility for safeguard reviews to assess whether taxpayer information is properly protected from unauthorized use or access as required by the Internal Revenue Code and to assist in reporting to Congress; (13) IRS' safeguard reviews have identified discrepancies in agency safeguard procedures and made recommendations for corrections; and (14) the reviews have uncovered problems with agency safeguarding procedures, ranging from inappropriate access to taxpayer information by contractor staff to administrative matters, such as the failure to properly document the disposal of information.