10.5.1. Privacy Policy

(1) Some examples and categories of IRS SBU data include, but are not limited to:

1. Personally Identifiable Information (PII) in this IRM refers to Privacy information and its subcategories. These categories include:
   - Contract use.
   - Death records.
   - General privacy.
   - Genetic information.
   - Health information, also known as Protected Health Information (PHI).
   - Inspector General protected.
   - Military personnel records.
   - Personnel records.
   - Student records.

2. Tax Information refers to a Tax category that includes:
   - Federal Taxpayer Information (FTI), which includes individual and corporate (or other business) tax return information under IRC 6103.
   - Tax convention.
   - Taxpayer Advocate information.
   - Written determinations.

   Note: Tax information is also PII if it identifies an individual.

3. Documents marked "Official Use Only" (OUO).

4. Certain Procurement information, which can include:
   - General procurement and acquisition (such as contract proposals).
   - Small business research and technology.
   - Source selection.

5. Financial information in the Finance category, including:
   - Bank Secrecy Act (31 USC Bank Secrecy Act protected reports filed by financial institutions).
   - Budget.
   - Retirement.
   - Electronic funds transfer.
   - General financial information.
   - International financial institutions.
   - Mergers.
   - Net worth.

6. Criminal Investigation and Law Enforcement information, such as:
   - General Law Enforcement (procedures and training materials).
   - Informant (identification, activities, contacts, payments, and correspondence).
   - Investigation (identifiers, associations, and relationships; investigative records received from other law enforcement and regulatory agencies, foreign and domestic; records related to investigation related travel and financing).
   - Law Enforcement Financial Records (and other records obtained via witness consent, subpoena, summons, search warrant, or any other legal process).
   - Pen Register/Trap & Trace.
   - Reward (recipient and payment information).
   - Whistleblower Identity. (Refer to IRC 7623 or the Whistleblower Protection Act of 1989, Pub.L. 101-12 as amended. For more information, refer to IRM 25.2.1, General Operating Division Guidance for Working Whistleblower Claims.)

7. Case selection methodologies including tolerance criteria or general investigation parameters.

8. Proprietary processes or algorithms used in investigative work or tax processing.

9. Critical infrastructure category information, which includes:
   - Information system vulnerabilities information (referred to as system information in this IRM), which includes passwords.
   - Physical security information, such as details of facility vulnerabilities (entry codes, badge access, etc.).
   - Emergency management.

10. Proprietary business information entrusted to the IRS.

11. Confidential data to be released to the public later.

12. Legal information, including:
    - Administrative Proceedings.
    - Collective Bargaining.
    - Federal Grand Jury (18 USC Grand Jury information protected by Rule 6(e) of the Federal Rules of Criminal Procedure).
    - Legal Privilege (including draft, pre-decisional, and deliberative information).
    - Legislative Materials (including Congressional or state).

13. 18 USC 1905 information protected under the Trade Secrets Act (trade secrets, processes, operations, style of work, or apparatus, or confidential statistical data, amount or source of any income, profits, losses, or expenditures of any person, firm, partnership, corporation, or association).

(1) By definition, documents designated as Official Use Only (OUO) and Limited Official Use (LOU) include SBU data.

(2) For more information, refer to IRM 11.3.12, Disclosure of Official Information, Designation of Documents.

(1) The Freedom of Information Act (FOIA) exempts most SBU data from release to the public under one of the nine exemptions listed in 5 USC 552(b).

(2) The fact that the IRS must release certain information if requested under FOIA does not automatically remove its status as SBU data. [FOIA]

(3) For more information, refer to IRM 11.3.13, Freedom of Information Act.

(1) Examples and categories of PII may include, but are not limited to the following, when used to distinguish or trace an individual’s identity, or when combined with information that is linked or linkable to an individual:

1. Name, such as full name, maiden name, mother’s maiden name, alias, or name control (first 4 letters of last name).

2. Address information, such as street address or email address.

3. A unique set of numbers or characters assigned to a specific individual, such as:
   1. Telephone numbers, including mobile, business, and personal numbers.
   2. SSN or ITIN, including the last 4 digits.
   3. Taxpayer identification number (TIN) that identifies an individual, such as an Employer Identification Number (EIN) for a sole proprietorship or partnership.
   4. Document locator number (DLN) to identify an individual’s record.
   5. Email or Internet Protocol (IP) address.
   6. Driver’s license number.
   7. Passport number.
   8. Financial account or credit card number.
   9. Standard Employee Identifier (SEID).
   10. Automated Integrated Fingerprint Identification System (AIFIS) identifier, booking, or detention system number.
   11. Universally Unique Identifier (UUID), a unique random number generated for each individual taxpayer in the electronic authentication process (eAuth).
   12. Any other type of identification number or card, including state ID or Alien Card ID.

4. Employee and employee information, including personnel files, employment testing materials, medical information, and information concerning reasonable accommodations for disabilities.

   Note: For privacy considerations concerning pandemics and employee illness, refer to Infectious Disease in the Workplace, Document 13001. For more about the application of the Privacy Act in this situation, refer to IRM 10.5.6, the Health or Safety Disclosure section. For further privacy considerations concerning disability and reasonable accommodation information, refer to IRM 1.20.2, Equity, Diversity and Inclusion, Providing Reasonable Accommodation for Individuals with Disabilities, the Confidentiality and Disclosure section.

5. Individual tax return information, including Adjusted Gross Income (AGI) or combinations of fields that identify an individual. See IRM 10.5.1.2.4, Federal Tax Information (FTI).

6. Corporate or other business tax return information that identifies an individual, such as an S-Corporation, partnership, or sole proprietorship.

7. Personal characteristics and data, including:
   1. Date of birth.
   2. Place of birth.
   3. Age.
   4. Height.
   5. Weight.
   6. Gender.
   7. Hair color.
   8. Eye color.
   9. Race.
   10. Ethnicity.
   11. Scars.
   12. Tattoos.
   13. Distinguishing features.
   14. Religious affiliation.
   15. Sexual orientation.
   16. Gang affiliation.
   17. Photographic image (especially of face or other distinguishing characteristic).
   18. Biometric information (such as x-rays, fingerprints, retina scan, voice, facial geometry, DNA).
   19. Behavior patterns.

8. Asset information, such as Media Access Control (MAC) address, Device ID, or other host-specific persistent static identifier that consistently links to a particular person or small, well-defined group of people.

9. Descriptions of events or times (information in documents, such as behavior patterns, incident reports, police reports, arrest reports, and medical records).

10. Descriptions of locations, such as geographic information system (GIS), Global Positioning System (GPS) data, and electronic bracelet monitoring information.

11. Information identifying personally owned property, such as vehicle registration number or title number and related information.

Exception: "Constitutionally Required Disclosures" — Some situations require disclosure of information, including SBU data, such as criminal cases where the IRS has a constitutional obligation to disclose, upon the defendant's request, evidence material either to guilt or punishment (exculpatory evidence). For more details, refer to IRM 11.3.35, Requests and Demands for Testimony and Production of Documents.

(2) Information about an individual that is linked or linkable to one of the above.

(1) IRS personnel must protect SBU data regardless of whether the same information is in the public record or publicly available. However, less stringent protections might apply in some situations.

(2) Generally, personnel must encrypt SBU data (including PII). However, inside the IRS network, encryption is not required if the IRS proactively makes it available to all personnel on internal resource sites (including, but not limited to, Discovery Directory, Outlook [calendar, profile information, and address book], intranet, and SharePoint or Teams site collections), such as names, SEID, and business contact information. [NIST SP 800-122; [TD P 85-01, Appendix A, AC-20(3)_T.028, and MP-6(3)_T.124]

(3) Email addresses, by themselves as the method of the email conveyance, generally do not need encrypting. However, when combined with the content and attachments of an email, the email address may become SBU data.

1. Encryption rules still apply for the body of emails and attachments.

2. See IRM 10.5.1.6.8, Email, for more information on email.

(4) As for other SBU data and PII in the public record or publicly available, the requirements differ, depending on the information.

(5) No IRC 6103 public records exemption exists. However, the Information Which Has Become Public Record section of IRM 11.3.11, Information Available to the Public, discusses disclosure of matters that have become public records as a result of tax administration, such as court cases. This is known as the judicially created public records exception.

(6) Treasury security guidance exempts Treasury information made available proactively to the public from certain encryption controls. This exemption implies a public records exception for information the agency makes available to the public. [TD P 85-01, Appendix A, AC-20(3)_T.028, and MP-6(3)_T.124]

(7) The Public Information Listing (PIL) designated by OPM makes certain federal employee information available to the public by FOIA request. For more information, refer to IRM 11.3.13, the Public Information section. [5 CFR 293.311]

(8) IRS policy also authorizes the withholding of the public information items of employees in cybersecurity designated positions. Cybersecurity designated positions are not identified by a specific GS/IR series or position title.

(9) Personnel should exercise caution and consult with PGLD for any questions they might have about application of a public record exception, on a case-by-case basis, prior to reducing privacy protections based on a public record exception. For further information, email *Privacy.

(10) For more information, refer to IRM 11.3.13, Freedom of Information Act.

(1) Little difference exists between PII and what personnel refer to as "sensitive" PII. For the definition of PII, see IRM 10.5.1.2.3, Personally Identifiable Information (PII).

(2) The level of risk increases with the potential level of harm caused by exposed SBU data or PII.

(3) Context is important. PII that does not seem high risk may still require protection if its context makes it risky. For example, a collection of names:

• Is not sensitive PII if it is a list, file, query result, etc., of:
  - Attendees at a public meeting.
  - Names out of a public telephone book.
  - FOIA listing of IRS employees in non-protected positions.

• Is sensitive PII if it is a list, file, query result, etc., of:
  - Individual taxpayers who filed returns.
  - Law enforcement personnel.
  - Employees with poor performance ratings.

(4) For more information, see IRM 10.5.1.6.1.1, Deciding Risk Levels for SBU Data and PII.

(1) All IRS personnel are responsible and accountable for the effective implementation of privacy protections.

(2) Privacy is personal. Do what’s right with sensitive information. Treat it like it’s your own. Put privacy first.

(1) Use or collect PII only when necessary and relevant for legitimate IRS purposes, namely tax administration and other authorized purposes.

(2) Privacy is a public trust. Limit the use of data to the purpose collected, for what is relevant and necessary for a legitimate IRS purpose. Don’t sell sensitive data.

(1) Limit the collection, use, retention, and disclosure of PII to what is minimally necessary for the specific purposes for which it was collected, unless specifically authorized.

(2) Privacy is simplicity. Data minimization means to access and use only the sensitive information you need. Just because you can access and collect data doesn’t mean you should. Reduce clutter. Keep it only if you must. Dispose of and manage it properly.

(1) The IRS makes its privacy policies and practices readily available to individuals, such that we inform individuals of the collection, use, retention, and disclosure of their PII, and we get individuals’ consent to the greatest extent practical.

(2) Privacy is transparency. Tell individuals what we do with their information and why we need it, so they know what to expect. Get consent to collect data.

(1) Only access or disclose PII to authorized individuals who require the information for the performance of official duties. The IRS does not tolerate browsing of confidential information, including PII and tax information, by unauthorized IRS personnel. Protected information includes confidential information of all individuals, not just taxpayers. Protected information includes, but is not limited to, confidential information of IRS employees, volunteers, practitioners, and other individuals who interact with the IRS.

(2) Privacy is discretion. Keep sensitive information private. Don’t talk about your cases. Share data only with those who have a need to know.

(1) Provide appropriate administrative, technical, and physical safeguards to protect against the unauthorized collection, use, and disclosure of SBU data, including PII and tax information.

(2) Privacy is protection. Safeguard sensitive information. You can’t have privacy without security.

(1) Follow requirements governing the accuracy, completeness, and timeliness of PII to ensure fair treatment of all individuals. Collect information, to the greatest extent practical, directly from the individual to whom it relates.

(2) Privacy is fairness. Be fair. Go to the source for sensitive information. Data is no good if it’s wrong.

(1) Verify all information about an individual with the individual, as well as any other relevant sources, to the greatest extent possible before taking adverse action based on that information. Notify individuals prior to final action to the greatest extent possible.

(2) Privacy is assurance. Verify information and provide individuals with prompt notification before acting.

(1) Allow individuals to access and correct their PII upon request to the maximum extent allowable. Individuals include, but are not limited to, taxpayers, IRS employees, IRS contractors, practitioners, and others who interact with the IRS. Individuals will be able to contest determinations made based on allegedly incomplete, inaccurate, or out-of-date PII to the maximum extent allowable.

(2) Privacy is visibility. Allow individuals to access their own information when allowable. Make it right. 

(1) Make IRS personnel aware of the proper treatment of SBU data, including PII and tax information, and train them accordingly.

(2) Privacy is fundamental. Learn what you need to know about privacy. Be aware of how to protect data.

(1) The IRS considers SBU data (including PII and tax information) at a moderate to high risk confidentiality level.

(2) Loss, compromise, or disclosure of SBU data (including PII and tax information) could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual or the IRS.

(3) Harm includes any adverse effects experienced by an individual whose PII was compromised, or adverse effects to the IRS such as a loss of public confidence.

(4) The greater the potential for harm, the more at risk the SBU data becomes. As outlined in NIST SP 800-122:

1. Low confidentiality level means limited potential harm with minor impact on an individual or the IRS.

   Example: Low confidentiality level data might include information that the IRS may release under FOIA requests, or information that has become public record or is publicly available. For more information, see IRM 10.5.1.2.2.3, FOIA and SBU Data, and IRM 10.5.1.2.3.2, Public Record.

2. PII with moderate or high confidentiality levels means the potential harm ranges from serious to severe or catastrophic, with significant to severe impact to an individual or the IRS. Tax information is an example of moderate to high risk PII confidentiality levels.

(5) The greater the risk to SBU data, the stronger the privacy and security protections become. [OMB A-130, NIST SP 800-122] For example, moderate and high risk SBU data require encryption, but publicly available low risk data might not need encryption.

(6) When in doubt about the level of risk of SBU data (including PII and tax information), or the privacy concerns around the data, email *Privacy for help.

(7) For more information about publicly available information, see IRM 10.5.1.2.3.2, Public Record.

(8) For more information on the IT aspects of data security, refer to IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance.

(1) We must protect all SBU data (including PII and tax information). Limit what SBU we share based on authentication, authorization, and need to know. See IRM 10.5.1.2, Key Privacy Definitions. [Purpose Limitation, Strict Confidentiality]

(2) Share SBU data (orally, visually, or electronically) in a way that avoids access by unauthorized persons. Precautions might include preventing visual access and restricting oral disclosure to designated individuals.

(3) You may reproduce SBU data only to the extent needed to carry out official business. Properly destroy flawed or otherwise unusable reproductions. See the Disposition and Destruction section in IRM 10.5.1.6.10, Disposition and Destruction.

(4) For tax information, follow extensive Disclosure rules in the IRM 11.3 series, Disclosure of Official Information.

(5) For Privacy Act information, follow IRM 10.5.6, the Conditions of Disclosure under the Privacy Act section.

(6) Internally: Only share SBU data (including PII and tax information) with other IRS personnel if the recipient’s need for the information is related to their official duties.

(7) The electronic transmission of SBU data (including PII and tax information) requires encryption for security purposes. See IRM 10.5.1.6.2, Encryption, and IRM 10.5.1.6.9.7, Electronic and Online, for more information.

(8) The confidentiality provisions of IRC 6103 restrict release of tax information (whether of an individual or business). Share tax information only with authorized individuals following established written procedures.

(9) Externally: Only share SBU data (including PII and tax information) with authorized individuals outside of IRS, in encrypted files, if you meet all these conditions:

1. Individual authorized to receive it under law or regulation, such as the Privacy Act or IRC 6103. Establish authority by a formal request for information processed using established written procedures, or a memorandum of understanding or executed agreement which also shows the secure method of transmission for the data.

   Note: Keep agreements in an approved database/program, such as IRS Agreement Database (IAD). For more information about the IAD, see IRM 10.5.1.7.11, Governmental Liaison (GL).

2. Recipient need for the information related to official duties.

3. Recipient authenticated.

4. Recipient accepted information and any obligation to protect.

5. Access controls limited to those with need to know.

6. The applicable System of Records Notice (SORN) includes the use as a published routine use. Refer to the internal System of Records site and IRM 10.5.6, the Privacy Act System of Records Notices (SORNs) section.

(10) Refer to the IRM 11.3 series (Disclosure of Official Information) or email *Disclosure for more guidance.

(1) IRS personnel must not create unauthorized, unnecessary, or duplicative hardcopy or electronic collections of SBU data (including PII and tax information), such as duplicate, ancillary, shadow, personal copies, or "under the radar" files. [Minimizing Collection, Use, Retention, and Disclosure]

(2) If creating new spreadsheets or databases that include SBU data (including PII and tax information) from a larger file or database is necessary, consider whether it requires a PCLIA.

1. To do so, submit a Qualifying Questionnaire (QQ) or Privacy Threshold Assessment (PTA), or email *Privacy.

2. For more information on the QQ, PTA, and PCLIA processes, refer to IRM 10.5.2, Privacy Compliance and Assurance (PCA) Program.

(1) Remember that the use of cell phones or other cordless devices (cordless land lines) does not automatically create privacy and disclosure concerns. However, use of these devices might raise some vulnerability issues. Refer to IRM 10.8.1, the Telecommunication Devices and the Personally-Owned and Other Non-Government Furnished Equipment sections.

(2) Whenever possible, conduct cellular phone conversations in a private setting (and not in a crowded public setting) to minimize the potential for eavesdropping. Cordless devices are rarely, if ever, used outside of a person’s home and do not lend themselves to conversations in crowded areas, but can still pose a risk of someone overhearing a conversation that the taxpayer does not want overheard.

(3) For contacts initiated by IRS personnel that discuss SBU data (including PII or tax information), you must inform the other party you are calling from a cell phone or other cordless device when in a public place where others could overhear sensitive information. This will alert the other party of the potential for the inadvertent disclosure of their tax information. When calling from a private setting where others cannot overhear the conversation, you don’t have to say the call is originating from a cell or cordless phone.

(4) Even when you don’t expect to discuss sensitive information in a call from a public place, you still should consider telling the other party you are using a cell phone or other cordless device in case a sensitive issue comes up in the discussion.

(5) You must honor the other party’s request not to conduct a conversation concerning sensitive information by cell or cordless phone. Offer them the choice of rescheduling the conversation when a private space or a more secure land line is available. Appropriately document any agreement (if documentation kept, such as history notes).

(6) For taxpayer-initiated contacts, the IRS is under no obligation to find if the taxpayer is using a less secure platform such as a cordless device or cell phone. You can talk about SBU data (including PII or tax information), because the taxpayer accepted any security vulnerability by using such a device to contact the IRS.

(7) Never discuss CNSI over a cell or cordless phone. For more about CNSI, refer to IRM 10.9.1, Classified National Security Information.

(8) For information about text messaging or texting, see IRM 10.5.1.6.9.6, Text Messaging (Texting).

(1) Use the following for answering machine and voicemail guidelines when leaving messages with sensitive information:

1. You generally may not leave tax information protected by IRC 6103 on an answering machine or voicemail. However, if you "reasonably believe" you have reached the taxpayer’s or representative’s correct answering machine or voicemail, leave your name, telephone number, any proper reference number for the inquiry, the fact that you work for the IRS (identifying your function is permissible), and the name of the person who should return the call. You may leave more information on the recording if the taxpayer or representative has given prior approval to leave such information.

2. The following supports "reasonable belief:"
   - The greeting on the answering machine or voicemail refers to the taxpayer or representative contacted, or
   - The taxpayer or representative has said this is the telephone number where you may reach them directly.

3. Document the taxpayer’s or representative’s telephone number, their approval to call that number, and their permission for IRS to leave information on the recording.

4. Without such reasonable belief that you have reached the correct taxpayer or representative, you must not leave any tax or other sensitive information on the message.

(2) When you can’t positively identify the number reached as the taxpayer’s or representative’s, and it is otherwise proper and practical, simply ask for a return call without giving the taxpayer’s name. If the call is in response to an earlier taxpayer inquiry or request, say the call is in response to an earlier inquiry or request. In such a case, you must not say the nature of the original situation nor reveal any specifics about the return call if it involves sensitive information.

(1) Unless authorized by this policy in the limited allowable situations listed in this section, you must not send emails that include SBU data (including PII and tax information) to taxpayers or their authorized representatives, even if requested, because of the risk of improper disclosure or exposure.

(2) When taxpayers request email contact and accept the risk of such, limited allowable situations without risking unauthorized disclosure of SBU data include:

1. Message sent under a previously authorized privacy- and IT-approved secure email or messaging program (rare). For example, the internal LBI Secure Email program site or for alternatives to email, see IRM 10.5.1.6.8.6, the Other Secure Electronic Communication Methods section.

2. Brief, unencrypted message confirming the date, time, or location of an upcoming appointment, but not the nature of the appointment. Include no SBU data (including PII and tax information, such as name control) in the email, subject line, or attachment. Do not allow follow-up email discussion of any taxpayer account or case.

3. Link to the publicly available forms and publications sections of IRS.gov. Avoid sending information about specific tax matters (revenue rulings, court cases, and specific IRS forms), which might unintentionally disclose the nature of a tax matter to an unauthorized third party.

(3) Do not encourage or suggest taxpayers email SBU data (including PII and tax information) unencrypted or outside of a previously approved secure email program.

(4) When responding to unsolicited emails from taxpayers or tax professionals, respond by letter or phone if possible; if address or phone number not available, respond by email. You must:

1. Delete any SBU data (including PII and tax information) appearing in the original email or subject line. Some examples of phrases to watch for are "my situation" or "my information."

2. Discourage the taxpayer from continuing the discussion by email. Sample response:
   
   To ensure your privacy, we discourage you from sending your personal information to us by unencrypted email. Further, IRS doesn’t allow its personnel to exchange unencrypted sensitive information with email accounts outside of the IRS network, even with your permission. For further discussion about the matters in your original email, please contact us by telephone, fax, or mail.

(1) If you are authorized to email SBU data to authorized recipients, you may email SBU data (including PII and tax information) to those external stakeholders using IRS IT-approved encryption technology (see IRM 10.5.1.6.8) only when:

1. Individual authorized to receive it under law or regulation, such as IRC 6103. Establish authority by a formal request for information processed using established written procedures, or a memorandum of understanding or executed agreement which also establishes email as the secure method of transmission for the data. See IRM 10.5.1.2.10, Authorization.

   Note: The IRS Office of Safeguards does not authorize agencies subject to Pub 1075 to email tax information (FTI).

2. Recipient need for the information related to official duties.

3. Recipient authenticated.

4. Recipient accepted information and any obligation to protect.

5. Access controls limited to those with need to know.

6. The applicable System of Records Notice (SORN) includes the use as a published routine use. Refer to the internal System of Records site.

7. For tax information (FTI), sender adheres to policy in the IRM 11.3 series, Disclosure of Official Information.

8. For non-tax PII, sender adheres to requirements in this IRM and IRM 10.5.6, the Conditions of Disclosure Under the Privacy Act section.

(2) Do not encourage or suggest stakeholders email SBU data (including PII and tax information) unencrypted or outside of a previously approved secure email program.

(3) For when you receive emails with SBU data from external parties, see IRM 10.5.1.6.8.1, Emails to Taxpayers and Representatives.

(4) Interact with applicants or prospective contractors by email only to answer questions about their information, qualifications, or administrative matters; minimize the exposure of their personal information (such as PII).

(5) For those who must provide IRS with their SBU data (such as PII) to facilitate a business arrangement, ask them to fax, mail, or upload their SBU data to a secure system, such as USAJobs.

(1) IRS personnel must use IRS email for email communications with other IRS personnel about official business matters. They must encrypt all internal email messages that contain SBU data (including PII and tax information) with IT-approved encryption, which includes secure messaging or password-protected encrypted attachments.

(2) For contractors, when provided with an IRS workstation as part of a contract, they must use their IRS workstation and account for all official communication (such as email or instant messaging). Refer to IRM 10.8.2, IT Security Roles and Responsibilities, the Contractor section.

(1) No officer, employee, or contractor of the IRS may use a personal email account to conduct any official business of the government. [PATH] Three limited allowable circumstances include:

1. Personal Information – You may send your own SBU data (including your PII and your tax information) to or from your personal email accounts, if it is in a password-protected encrypted attachment. Examples may include, but are not limited to:
   - Personnel forms or records.
   - Financial records used to prepare an OGE Form 450 or OGE Form 278 or other form for financial reporting related to the job.
   - Records needed for a personal transaction.
   - Job application, resume, self-assessment, or appraisal.
   - Health records or fitness for duty information.
   - Travel itinerary (but only by adding personal email address for ConcurGov notifications related to their own travel, not approvals for others; personnel cannot forward a travel itinerary from a work email address to a personal email address).

   Exception: The encryption policy does not apply to your own PII that the IRS proactively makes available to all employees on resource sites (including, but not limited to, Discovery Directory, Outlook (calendar, profile information [including profile photos], and address book), intranet, and SharePoint or Teams site collections [including profile photos]), such as names and business contact information.

2. Training or publicly available information – You may send non-case-related content, including links, to and from yourself when IT Security constraints prevent access. Examples of this include online training or meetings, such as webinars and seminars, as well as publicly available information (including public profile photos or business photos intended for publication with permission of pictured individuals).

3. Exigent circumstances, such as in emergencies. This includes when the IRS network is down and there is an urgent need to communicate or in disaster recovery situations, and you do not have other options. Refer to IRM 10.8.60 and IRM 10.8.62. Limit SBU data to that necessary for the situation. Encrypt necessary SBU data in password-protected attachments, if possible, in emergencies. Examples may include, but are not limited to:
   - Sending infectious disease-related documentation to an IRS email account when you do not have other options.
   - Reporting for work.
   - The condition or availability of the workplace.
   - An emergency (internal to IRS, not taxpayer communication).
   - Checking the well-being of IRS personnel.

Note: Other options include, but are not limited to, using the official IRS email application in your IRS-issued device or Bring Your Own Device (BYOD) to add an attachment and send an encrypted email, or using an IRS scanner.

(2) For more information on continuity management, contingency planning, or disaster recovery, refer to IRM 10.8.60 and IRM 10.8.62.

(1) The general rule for encrypting SBU data (including PII and tax information) in emails reflects the IRS’s priority to protect sensitive information from unauthorized disclosure causing a risk of loss or harm to individual privacy or to IRS data.

(2) Having evaluated business needs in relation to potential risk, the following limited exceptions for external emails are appropriate.

(3) Limited exception: Subject line of case-related emails to the Department of Justice.

1. When IRS personnel communicate with the Department of Justice about established cases, personnel may include the case name and filing number in the subject line of those emails. If the full name is not part of the case name, then do not use the full name.

2. This information fits within the judicially created public records exception to IRC 6103, recognized in most jurisdictions. Refer to IRM 11.3.11.12, Information Which Has Become Public Record, for more information on the public records exception.

3. However, if the body of an email or any attachment has other SBU data, IRS personnel must encrypt both the email and attachment using IT-approved technology.

(4) Limited exception: Emails generated to taxpayers or representatives by approved online applications.

1. The IRS online applications may issue emails to taxpayers or representatives, without encryption, when the messages contain only incidental information (not tax information, which includes but is not limited to payment amount, address change, or type of notice):
   1. To confirm authentication.
   2. To inform a user that a secure message is available for viewing on the IRS Secure Messaging Portal.
   3. To confirm an online transaction (without details).

2. This exception is limited to the following circumstances:
   1. The email is automatically generated by an approved IRS application developed by or in conjunction with the Office of Online Services, and
   2. The taxpayer or representatives consented to these notices by completing the application’s enrollment process. During this enrollment process, the taxpayer or representative must have received clear notice of the IRS’s intent to send such notices via email.

3. For approval of online application email content, email *Privacy.

(5) Limited exception: IRS employees sending their personal SBU data via encrypted email or encrypted attachment. Personal SBU data is information pertaining only to you.

1. You may choose to send your personal SBU data outside the IRS via encrypted email or a password-protected encrypted attachment.

2. You must send this information only if you encrypt the email or attachment(s) and send only your personal SBU data.

3. This exception does not include IRS usernames and passwords.

4. For policy on encryption, see IRM 10.5.1.6.2, Encryption.

5. For more information about when and how to encrypt, refer to the internal Encryption site.

6. Refer to instructions for using SecureZip to encrypt attachments on the internal IRS Service Central site.

(6) Limited exception: Emergency emails by Facilities Management and Security Services (FMSS).

1. Where significant incidents (as defined in IRM 10.2.8, Incident Reporting) occur, and FMSS employees need to supply law enforcement entities with detailed information, but cannot do it expediently by phone, they may use unencrypted email to send the necessary details, including SBU data.

2. FMSS employees must make every effort to minimize the amount of SBU data within those messages (for example, no SSNs).

(1) IRS offers some alternatives to email to protect taxpayer security and privacy:

1. Taxpayer Digital Communication (TDC) secure messaging platform: Taxpayers must register, but can then send and receive messages on an encrypted platform. For the internal login page, refer to Taxpayer Digital Communication (TDC) eGain platform site.

2. Document Upload Tool (DUT): The IRS initiates access to the tool by providing the link and, in some cases, unique access code or ID, though a notice, phone conversation or in-person visit. This is a one-way (public to IRS) encrypted communication. Refer to the external IRS Document Upload Tool site.

(2) These examples of IRS-approved alternatives might not be your only options. Check with your business unit for other secure communication methods.

(1) If IRS personnel carry SBU data (including PII and tax information) in connection with a trip or during daily activities, they must protect it and keep it with them to the extent possible.

(2) If you must leave SBU data (including PII and tax information) unattended in an automobile while traveling between work locations or between work and home, lock it in the trunk. If the vehicle does not have a trunk, conceal the material from plain view and secure it in some manner. When not in transit, secure data in an approved work location (office, approved and securable telework location, or approved taxpayer site in IRS-approved lockable containers).

(3) If you must leave the SBU data (including PII and tax information) unattended in hotel or motel room, lock it in a briefcase and conceal it to the extent possible.

(4) If SBU data (including PII and tax information) is moved from one building to another (even within the same campus) or one location to another even if it is a short distance, take necessary steps to protect the information from unauthorized disclosure, loss, damage, or destruction.

(5) Field employees might have SBU data needing protection while temporarily stored at the taxpayer's site.

1. Store SBU data (such as agent's work papers, original returns, examination plans, probes, or fraud data) housed unattended at the taxpayer's site in a container under the control of the responsible IRS employee.

   Note: If possible, use an IRS-furnished security container. If necessary, use a taxpayer-furnished container, but change the taxpayer-furnished container (such as with bars and locks) so the taxpayer cannot access the container.

2. During duty-hours, the SBU data must be under the personal custody of the IRS employee if not properly secured in approved containers.

3. If you don’t have a lockable and suitable container provided, you must not leave SBU data at the taxpayer's site.

(6) For more information about how to protect taxpayer location when using GPS and location services, see IRM 10.5.1.6.11, Global Positioning Systems (GPS) and Location Services.

(1) IRS personnel must follow proper data protection procedures when mailing SBU data. For more information on IRS policy about mail operations, refer to IRM 1.22.5, Mail and Transportation Management, Mail Operations.

(2) For telework mail procedures, refer to IRM 6.800.2, the Mail section, and IRM 1.22.5, the Guidance on Telework Employee Mail and the Home as Post-Of-Duty (HaP) Employees section.

(3) Mail letters and packages with SBU data that weigh less than 13 ounces via United States Postal Service (USPS). These packages do not require double packaging and double labeling. For more information about larger items, see IRM 10.5.1.6.9.3, Shipping through Private Delivery Carrier.

(4) When sending SBU data by mail within the U.S. and Territories (serviced by United States Postal Service [USPS]):

1. Place SBU data in a single opaque envelope/container.

2. Seal it to prevent inadvertent opening and to reveal evidence of possible tampering.

3. Clearly show the complete name and address of the sender and intended recipient or program office on the envelope/container.

Note: Mailroom personnel may open and examine SBU data the same way they evaluate and determine other incoming mail safe for internal delivery. You must mail SBU data by USPS First Class Mail. You may use express mail services or commercial overnight delivery service, as necessary.

(5) When sending SBU data to offices Overseas:

1. If serviced by a military postal facility (i.e., APO/FPO), mail SBU data directly to the recipient using USPS (regardless of letter or package weight). You must use USPS when mailing to a post office box, APO, FPO, DPO, etc.

2. Where a military postal facility does not service the overseas office, send the information through the Department of State’s (DOS’s) unclassified diplomatic pouch. Coordinate in advance with DOS officials to ensure delivery at the final destination meets Treasury/IRS needs and DOS schedule for such deliveries.

(1) IRS personnel must follow proper data protection procedures when shipping PII through a private delivery carrier. This practice helps prevent data loss and disclosure, and in case of loss or disclosure, allows the IRS to notify impacted individuals.

(2) For Telework shipping procedures, refer to IRM 6.800.2, the Mail section, and IRM 1.22.5, the Guidance on Telework Employee Mail and the Home as Post-Of-Duty (HaP) Employees sections.

(3) Mail letters and packages with PII that weigh less than 13 ounces via United States Postal Service (USPS). These packages do not require double packaging and double labeling. See IRM 10.5.1.6.9.2, Mail through USPS.

(4) You must ship packages with PII that weigh 13 ounces or more through a private delivery carrier.

(5) For shipping electronic media, including removable media such as USB drives and other portable storage devices, you must encrypt it first. Refer to IRM 10.8.1, the Media Transport section.

(6) For all PII shipments through a private delivery carrier, the sender must follow the procedures included below for properly double packaging, double labeling, and tracking the shipment, including the use of Form 3210, Document Transmittal (or equivalent). Whether you use a Form 3210 or its equivalent, you must include enough information on the transmittal to identify the package contents in case of its loss or disclosure, so the IRS can notify impacted individuals and take steps to decrease the possibility that the information will be compromised or used to perpetrate identity theft or other forms of harm.

(7) When shipping PII through private delivery carrier, you must use UPS CampusShip at all non-Campus locations and non-FMSS-contract-mailroom-supported offices; Campus locations and FMSS-contract-mailroom-supported offices may use UPS CampusShip, but it is not mandatory at those locations. UPS CampusShip is an internet-based shipping system that you can access from any location that has internet access. The IRS has rolled out UPS CampusShip across the country to IRS field offices not serviced by a FMSS contract mailroom. Find information about UPS CampusShip:

• Shipping Packages (Mailrooms and UPS CampusShip) site.

• Document 12888, UPS CampusShip: Electronic Shipping Methods.

• Document 12889, UPS CampusShip: Advanced Features.

(8) CampusShip allows employees to:

1. Generate labels electronically.

2. Secure current IRS address information from corporate address repository to improve accuracy of delivery.

3. Track packages via the internet to easily verify their shipments arrived at the intended destination and to quickly find a missing shipment, reducing the likelihood of PII loss or disclosure to an unauthorized individual.

4. Let recipients know a package is coming by adding their email address to CampusShip for notifications.

(9) You must double-package and double-label PII packages prior to shipping. Double-packaging helps protect the contents if the outer package is damaged or destroyed during the shipping process. Duplicate shipping labels allow proper delivery of the contents without potential disclosure if the external package is damaged or destroyed.

(10) Evaluate the size of the PII shipment and identify appropriate packing materials. The proper type of internal and external packaging depends upon the size and weight of the package. Use the smallest size packaging possible to reduce shipping costs and ensure minimal shifting of contents during shipment.

(11) The sender must also decide whether to ship via ground service or express (Overnight and Second Day Air) services:

• Use Ground service for shipping whenever possible. Ground service should always be the first choice; use express services only when necessary. There is no requirement to mail PII via express services. For distances up to 500 miles, the regular ground service offered by the small package or motor freight carriers (depending on weight of shipment) can deliver your shipment within one or two days. For ground shipments, the business operating divisions supply the packaging material.

• Express Services are the fastest mode of transportation available, but they are also much more expensive. Only use this mode when transit time requirements are short and the urgency of the shipment outweighs the added costs involved (for example, remittances, statute cases, or tax court cases) Only use small package carrier-provided packaging (carrier branded envelopes and boxes) for express services and when provided at no cost.

(12) For all PII shipments through a private delivery carrier, the sender must prepare Form 3210, Document Transmittal (or its equivalent), identifying the package contents for all packages with PII and asking for recipient acknowledgement. This practice includes shipments to IRS offices, contractors, external agency partners, and even taxpayers (or their representatives, referred to collectively as taxpayers) when applicable. For external partners and taxpayers, use an equivalent to Form 3210. Whether you use a Form 3210 or its equivalent, you must include enough information on the transmittal to identify the package contents in case of its loss or disclosure, so the IRS can notify impacted individuals and take steps to decrease the possibility that the information will be compromised or used to perpetrate identity theft or other forms of harm.

1. For easier tracking, the sender may include the small package carrier tracking number in the Remarks area in Part 4 (sender’s copy) of Form 3210 (or equivalent).

2. If the sender is using the small package carrier's web-based system to electronically generate shipping labels, the tracking number is available immediately on the shipping label.

3. If the sender is using a contract mailroom, the sender should complete the sender's email address section of Form 9814, Request for Mail/Shipping Service. The mailroom must enter this email address when preparing the shipping label, and the small package carrier software will generate an email to the sender with the tracking number. The sender can then place the tracking number on Part 4 of Form 3210 (or equivalent) for proper record keeping.

4. If using a transmittal form other than 3210 as its equivalent, include at least the same elements you would on a Form 3210.

(13) Securely package the PII by placing the contents and the properly completed Form 3210 (or equivalent) in an appropriately sized internal package. The sender keeps Part 4, Sender's copy, of Form 3210 (or equivalent) and includes Part 1, Recipient’s copy, and Part 3, Acknowledgement copy, with the shipment. When you use a transmittal letter as an equivalent of Form 3210, the shipment does not require a paper equivalent to Form 3210 Part 3; the recipient’s verbal or electronic confirmation of receipt suffices as acknowledgement. When sending the package to a specific individual, the sender may choose to notify the recipient via encrypted email, phone, or other method prior to shipment that the package with PII is on its way. The sender may also choose to send an electronic PDF version of Form 3210 (or equivalent) via encrypted email to the intended recipient, so the recipient is aware of the expected shipment.

(14) Internal packaging may include any of the following:

• An envelope: An E-20, Confidential Information envelope, is acceptable for this purpose.

• A plastic bag: Should be sturdy enough to support the weight of the contents without tearing; should be black, green, or a similar color so the contents are not readable through the plastic bag.

  Note: We recommend this as the easiest and most cost-effective method for double packaging large case file shipments.

• A small box: An undamaged smaller box that fits within the external shipping box.

(15) Label the internal package with the following information:

1. Send to Address, including Mail Stop and/or Drop Point Number, if applicable.

2. Return Address, including Mail Stop and/or Drop Point Number, if applicable.

3. Sender's phone number.

4. Small Carrier tracking number, if available.

(16) The sender may use a copy of the exterior small package carrier shipping label for the internal label, so print 2 copies (the first for the interior, the other for the exterior).

(17) Place the properly labeled, packaged, and sealed internal package into the external package. External packaging materials may include:

1. Envelope: For shipping smaller case files and documents via ground service, use an IRS issued non-confidential envelope (E-44; minimum size 9 ½” X 12”). Use an envelope or padded pack provided by the Small Package Carrier only when time constraints require shipping via express services.

2. Box: Use an undamaged box specifically designed for shipping. Choose a box strength that is suitable for the size and weight of the contents you are shipping. For shipping smaller packages up to 10 pounds, use a small box ordered from an office supply vendor for ground shipments. Use boxes provided free of charge by the small package carrier only when time constraints require shipping via express services. For shipments over 10 pounds, the external box should be a suitable flap top, corrugated cardboard box rated with a bursting strength to support the contents. Never exceed the maximum gross weight for the box, usually printed on the box maker's certificate on the bottom flap of the box.

   Note: A standard Shipping Record Box (size 14.75” X 12” X 9.5”) used to retire files meets this requirement. If possible, use the Shipping Record Box Sleeve as the external packaging. File boxes used for Federal Record Center storage, combined with a sleeve box, will have a bursting strength exceeding 125 pounds per square inch and will be more than adequate for most ground shipments.

Caution: Used copy paper boxes and other boxes with lids do not meet this requirement; boxes with lids can get caught on conveyer belts and damage or destroy the shipment.

(18) Whenever possible, use a new box; however, you may re-use undamaged packaging materials to ship PII. Only reuse a box if it is rigid and in good condition with no punctures, tears, rips, or corner damages, and all flaps are intact. Remove any existing labels and all other shipment markings if re-using a box.

(19) Use enough packing material inside the package so the contents do not move or shift when shaken.

1. Cushioning material should consist of materials that are readily available, and you can re-use them. It is not necessary to buy prefabricated materials specifically designed to cushion packages for this purpose.

2. Examples of cushioning material include non-confidential paper, shredded administrative paper, obsolete forms, newspaper, and/or commercially bought Styrofoam peanuts, air bags, etc.

3. Place the cushioning material around the items in the box. Close and shake the box to see whether you have enough cushioning material; add more cushioning material if you hear or feel the contents shifting.

(20) Do not mark or label external packaging material with information showing that package contents include sensitive information. You can mark packages as "time sensitive" or "process immediately" as applicable to ensure prompt processing. Labels that show sensitive contents include, but are not limited to:

• "Remittance" labels indicating package contents include remittances.

• Labels showing package contents include case files or re-files. An acceptable alternative method would be to write "Sort and Sequence."

Note: Do not remove references to IRS from an envelope since it is necessary to include IRS on Return Address and Send To Address labels to ensure package delivery to the intended location if any of the address information is incorrect.

(21) Seal the package with strong clear shipping tape that is two inches or more in width. Do not use string, paper over-wrap, shrink wrap, and/or plastic straps.

(22) Place the shipping label on the top of the package and ensure it is properly adhered and will not separate from the box. Do not place the label over a seam or closure or on top of sealing tape since this could cause it to be damaged or removed from the package.

(23) The sender must monitor the shipment delivery. Follow your organization’s established time frames for Form 3210 (or equivalent) acknowledgement follow-up. Where there is no established time frame in an individual organization, the follow-up action should take place in three business days for overnight shipments and 10 business days for ground shipments.

(24) Once received, the recipient will verify receipt of the contents and sign the acknowledgment copy of the Form 3210 (or equivalent). The recipient will return the Form 3210 (or equivalent) acknowledgement to the sender using secure email (electronic or scanned copy), fax, or mail. If the SSN was not redacted as required on the Form 3210 (or equivalent), redact all but the last four digits of the SSN prior to returning it to the sender.

(25) After receiving the acknowledgement copy (if applicable, equivalent confirmation of receipt), the sender will associate it with the original Form 3210 (or equivalent).

(26) If you do not receive the signed Form 3210 acknowledgement (or equivalent confirmation of receipt) within the established time frame, access the small package carrier's website to track the shipment to find if it was delivered successfully. The tracking number should have been included on Form 3210 (or equivalent) when the shipping labels were prepared or after the number was received from the carrier if Form 9814 was used.

(27) If the tracking information shows the package was delivered, the sender must contact the intended recipient to confirm actual receipt of the package.

1. If the recipient did receive the package, ask the recipient to complete and return the Form 3210 (or equivalent) acknowledgement.

   Note: If applicable, document alternative verbal or electronic confirmation of receipt.

2. If the recipient didn’t receive the package, consider the package lost. The sender must follow the procedures for reporting a loss of hardcopy documents. The intended recipient should also start a search in their facility when the carrier shows an individual signed for the package.

(28) If the tracking information indicates the package was not successfully delivered, the sender should closely monitor the tracking information for up to 48 hours (2 business days) after the anticipated delivery date for air services and up to 72 hours (3 business days) after the anticipated delivery date for ground services. If not delivered within these time frames, consider the package lost. The sender must follow the procedures for reporting a loss of hardcopy documents.

(29) Immediately upon discovering or identifying a package is lost, report the loss following IRM 10.5.4. Refer to the internal Report Losses, Thefts or Disclosures of Sensitive Data; Report Lost or Stolen IT Assets and BYOD Assets site.

(30) Business unit management must establish an internal process to identify the package contents and impacted individuals in case of a lost or compromised package. We must be able to identify the contents of the lost package and help the carrier determine if it belongs to the IRS. You must provide detailed information about the contents such as taxpayer last names, check numbers, forms numbers, documents enclosed, etc., including any and all identifying information that might help locate the contents of the package.

(31) Managers must perform, at a minimum, quarterly audits of the Form 3210 (or equivalent) acknowledgement process for packages with PII to ensure proper follow-up is occurring. Managers must document the results of these audits. This procedure will allow IRS managers the opportunity to confirm that PII senders are following up on Form 3210 (or equivalent) acknowledgments within defined time frames so that they identify lost shipments quickly. This reduces the likelihood of exposing PII to an unauthorized user. Local management must decide the proper follow-up time frame as part of the manager’s operational review. Keep Form 3210 (or equivalent) following the existing record retention schedule for each business unit.

(32) Additionally, management should periodically sample mail to ensure the business unit follows this PII shipping policy.

(33) For more information, refer to the PII Hardcopy Shipping.

(34) Refer to IRM 1.15.5, Relocating/Removing Records, for shipping records (such tax or personnel records) to the Federal Records Centers.

(1) Protect faxed SBU data (including PII and tax information) as with any other transmission of SBU data.

(2) Internally, use secure encrypted email, if possible, as an alternate way to send SBU data, instead of faxing. Scan, encrypt, and internally email documents that include SBU data. See IRM 10.5.1.6.8, Email.

(3) If you must fax the information, do not send SBU data to a fax machine without contacting the recipient to arrange for its receipt.

(4) Use a cover sheet for faxes with SBU data that lets the recipient know that it contains sensitive information and requests unintended recipients to report the disclosure and confirm destruction.

(5) For misdirected faxes, refer to IRM 10.5.4, Incident Management Program, the Responsibilities section.

(6) When transmitting SBU data via fax, use Enterprise Electronic Fax (EEF) as the preferred method of faxing documents. Refer to IRM 21.2.3, Systems and Research Programs - Transcripts (the IRS Electronic Fax System section) or the internal EEFax site.

(7) For more information on securely faxing documents, refer to IRM 10.8.1, the Facsimile and Facsimile Devices and AC-20 Use of External Information Systems - Control Enhancements sections.

(1) Protect printed documents with SBU data and follow the IRS Clean Desk Policy in all work locations (including field and telework).

(2) Minimize the printing of SBU data to what is explicitly necessary.

(3) Properly store and dispose of printed materials. See IRM 10.5.1.6.6, Storage, and IRM 10.5.1.6.10, Disposition and Destruction.

(4) Use only IRS-furnished (not personally owned) printers. Refer to IRM 10.8.1, the Printers, AC-20 Use of External Information Systems, and Personally-Owned and Other Non-Government Furnished Equipment sections.

(1) IRS personnel must not use text messaging (texting) for official business.

(2) Refer to IRM 1.15.6, Managing Electronic Records, the Use of Agency-approved Electronic Messaging Systems, Preserving Electronic Messages, and Common Questions about Electronic Messaging sections.

(3) Refer to IRM 10.8.1, the Telecommunication Devices section.

(1) External electronic transmission and online data exchanges address uploading or downloading, secure file transfer, file sharing, peer-to-peer (P2P), collaborative technology and systems, third-party sites (commercially available file-sharing sites in the cloud or private file-sharing on remote servers), and blacklisted sites.

(2) Do not post or upload SBU data (including PII and tax information) online, including IRS official internal or external websites or cloud-based systems or services, unless secured with IT-approved access controls by the IRS (or by an IRS vendor bound by contract to protect the information). [NIST SP 800-122, TD P 85-01]

(3) Use only IRS identifiers (name or email) when conducting official business.

(4) For receiving documents from taxpayers, IRS personnel may offer taxpayers the opportunity to use the Document Upload Tool (DUT) when this option is available. For more information about when you can offer this tool, refer to your business unit procedures.

(5) For internal collaborative electronic or online data sharing, see IRM 10.5.1.6.18, Data on Collaborative Technology and Systems, and IRM 10.5.1.6.18.3, Shared IRS Storage (OneDrive, SharePoint, Teams, and Other IRS Collaborative Sites).

(6) For more information about securing electronic transmissions, refer to IRM 10.8.1, the AC-20 Use of External Systems, the SA-9 External System Services, and the External Collaborative Technology and Systems sections.

(7) For more information about secure emailing, see IRM 10.5.1.6.8, Email.

(1) When moving an office or material, make plans to protect and account for all SBU data (including PII and tax information), as well as government property. Consider the relevant factors of the move (such as the distance involved and the method used in making the move).

1. Keep SBU data in locked cabinets or sealed packing cartons while in transit.

2. Maintain accountability to ensure that cabinets or cartons do not become misplaced or lost during the move.

(2) Take precautions equal with the type and value of property and data involved.

(1) Place hardcopy waste material with SBU data in locked receptacles specifically marked for sensitive document destruction (SDD or shred bins). This includes material shredded with non-compliant equipment that does not meet requirements.

(2) For one-step destruction of paper with SBU data, use cross-cut shredders which produce particles that are 1 mm x 5 mm (0.04 in. x 0.2 in.) in size (or smaller), or pulverize/disintegrate paper materials using disintegrator devices equipped with a 3/32 in. (2.4 mm) security screen. [NIST SP 800-88, Guidelines for Media Sanitization]

(3) For multi-step destruction of paper, you may use non-compliant methods for the first step. The IRS must then protect the product until it is then destroyed in a manner that renders it unreadable, indecipherable, and irrecoverable. [32 CFR 2002]

(1) For electronic media destruction requirements (for items such as magnetic media, diskettes, hard disks, CDs, external drives, USB drives or other removable media, or other storage devices), refer to IRM 10.8.1, the MP-6 Media Sanitization section, and follow NIST SP 800-88, Guidelines for Media Sanitization.

(2) Refer to the internal Media Destruction Shipping Procedures site on for disposal of electronic media.

(3) Do not put electronic media with hardcopy paper in the sensitive document destruction bins.

(1) For microforms with SBU data (microfilm, microfiche, or other reduced image photo negatives): [NIST SP 800-88, Guidelines for Media Sanitization]

1. Destroy microforms by burning.

2. Do not put microforms with hardcopy paper in the sensitive document destruction bins.

(1) For temporary storage, while waiting for destruction of sensitive waste, you don’t have to put it in a locked receptacle if you follow these requirements for burn bags or shred boxes:

1. Tear and place SBU data to be destroyed in sealed opaque containers, commonly known as burn bags or shred boxes, so that the sensitive information is not visible.

2. Protect burn bags or shred boxes awaiting destruction while in your custody.

3. Ensure burn bags or shred boxes only are collected and contents destroyed by cleared contractor personnel or facilities maintenance personnel, or persons authorized by IRS privacy, records, or security officials.

4. If not in your custody, store burn bags or shred boxes within a Sensitive Compartmented Information Facility (SCIF) or security-approved open storage area pending collection by authorized personnel.

5. Never leave unattended any burn bags or shred boxes located outside a SCIF or open-storage area.

(1) Manage IRS records (hardcopy and electronic), including those with SBU data (such as PII and tax information), properly and follow the Records Control Schedules (RCS) Document 12990 and General Records Schedules (GRS) Document 12829 to prevent unlawful or unauthorized destruction of records.

(2) Disposition and destruction of tax information must follow the Records and Information Management IRM 1.15.2, Types of Records and Their Life Cycle, IRM 1.15.3, Disposing of Records, and IRM 1.15.6, Managing Electronic Records.

(1) Turn over unshredded sensitive information to a contractor provided the contract includes necessary safeguards that ensures compliance with IRC 6103(n) requirements, provides for periodic safeguard reviews, and includes language describing methods of collection, pick-up, storage, and disposition. Refer to IRM 11.3.24, Disclosures to Contractors, the Destruction of Returns and Return Information section.

(2) If an independent contractor collects and destroys tax information media, to prevent the necessity of having an IRS employee present during destruction, the contract must include the safeguard provisions required by IRC 6103(n) and regulations.

1. The provisions of the contract must allow for IRS inspection of the contractor facility and operations to ensure the safeguarding of IRS information.

2. Contractors must keep waste material in a secured (locked) container in a secured area to prevent SBU data from unauthorized disclosure or access.

(3) CORs hold responsibility for verifying all contractors maintain certification designation with an industry trade association that conducts scheduled and unannounced site inspections and reports out on findings. periodically review work areas to ensure that contractors are discarding sensitive waste material properly.

(1) Do not place paper documents with SBU data in regular recycling containers. Instead, place them in clearly marked secured containers (sensitive document destruction bins).

(2) The preferred approach is to segregate and shred sensitive information following guidelines contained in IRM 10.5.1.6.10, Disposition and Destruction, before turning it over to the recycler.

(3) Another method is to have IRS personnel observe the destruction of sensitive information upon delivery to the recycler. This allows for destruction of sensitive information while maintaining custody of the material up to the moment of destruction. Again, the contractor must follow IRC 6103(n) requirements which provides for safeguards and periodic safeguard reviews.

(1) This exception for the use of personally owned GPS devices is limited to GPS functions only. For example, this does not apply to the use of the non-GPS functions on personally owned mobile computing devices.

(2) Input only taxpayer address information into the GPS device and delete this information from the device once it is no longer necessary. Never input individual or business taxpayer names into the device.

(3) Do not connect the GPS device to an IRS computer, as the device has the potential to introduce computer viruses and malware into the IRS network.

(4) If available, use a security personal identification number (PIN) code with the device to help protect the privacy of tax information in the event the device is lost or stolen.

(5) Take every precaution to prevent the GPS device from being left unattended or unsecured.

(6) Remove portable GPS devices from vehicle when not in use as circumstances allow. In those limited instances where you must leave a portable device in a locked vehicle, store it out of sight in the trunk or glove compartment.

(7) Never leave portable GPS devices in a vehicle overnight.

(8) Do not leave the portable GPS device and any mounts in an unattended vehicle in plain sight. After removing mount, clean the suction cup mount area because it can leave marks on the windshield/dashboard showing that a GPS or other device may be present in the vehicle, increasing the risk of a break-in.

(9) Report the loss or theft of a GPS device with taxpayer addresses (whether a government-issued GPS or a personally-owned GPS), as a potential breach of PII:

1. Immediately upon discovery of the loss or theft, the employee must report the potential breach to the employee’s manager and the appropriate organizations based on what was lost or disclosed.

2. For more information about how to report an incident, refer to IRM 10.5.4, Privacy and Information Protection, Incident Management Program, or the internal Report Losses, Thefts or Disclosures of Sensitive Data; Report Lost or Stolen IT Assets and BYOD Assets site.

(1) Except for the use of GPS in IRM 10.5.1.6.11.1, we strongly encourage you not to use your personal devices (such as phones, tablets, fitness watches, or wearable devices) or applications on them to identify taxpayer or work addresses with location services (geolocation), geotagging, or GPS features of any social media accounts (Facebook Check In, Find My Friends, etc.). Geotagging pinpoints location, which might inadvertently reveal a taxpayer’s home or business, or show activities and location at an IRS office. You should use an IRS-furnished device (if issued) when finding and receiving directions to taxpayer addresses.

(2) When using services that need location, try to avoid using an exact taxpayer address if it might pinpoint the IRS has an interest in the taxpayer.

(1) The Privacy Act prohibits federal agencies from maintaining records on how any individual exercises their First Amendment rights unless certain exceptions apply.

(2) First Amendment rights include religious and political beliefs, freedom of speech and of the press, and freedom of assembly and petition.

(3) Congress intended agencies to apply the broadest reasonable interpretation when determining whether a particular activity is a right guaranteed by the First Amendment.

(4) IRS personnel must not keep files of persons who are merely exercising their constitutional rights.

(5) IRS personnel involved in the design, development, operation, or maintenance of any system of records subject to the Privacy Act must be aware of the restrictions on maintaining records on the exercise of First Amendment rights and alert to any potential violation of those restrictions.

(6) Taxpayers must report income and provide information necessary to verify deductions on their tax returns. The IRS may collect such information although, in some instances, this data may reveal how individuals exercise their First Amendment rights, such as religious affiliation, group membership, or political preference. The IRS may collect this information because statutory exceptions apply. [Privacy Act; Purpose Limitation]

(7) For more information, refer to IRM 10.5.6, the Privacy Act Recordkeeping Restrictions (Civil Liberties Protections) section.

(1) Widely available electronic recording and monitoring technology (such as online meetings, digital cameras, smartphones, and smart devices) raises privacy and security concerns.

(2) Privacy concerns for recording (including, but not limited to, video, photographic, or infrared) in the workplace center around individual employee privacy, the potential disclosure of SBU data (including PII and tax information), and data minimization and retention. [Minimizing Collection, Use, Retention, and Disclosure]

(3) The law for recording others varies by state, but many states require consent of both the recording individual and the recorded individual. To protect individual employee privacy, IRS policy prohibits most recordings because of such variations.

(4) To record in the workplace, you need:

1. Business need [Minimizing Collection, Use, Retention, and Disclosure]

2. Approval [Accountability]

3. Consent [Openness and Consent]

4. Precautions [Strict Confidentiality]

(5) Business need: Minimize recordings in the workplace unless you have a compelling business need. Just referring to notes to refresh your memory after a meeting is not a reason to record.

(6) Examples of compelling business need that allows for limited recording in the IRS workplace with approval and consent include, but are not limited to:

1. Service Quality Control: Employees may make recordings when performed to determine the quality of service delivery, such as with Contact Recording.

2. Taxpayer Interviews: Taxpayers may request to audio record in-person interviews, with prior notice to the IRS, and the IRS may record those interviews, under IRC 7521(a). The IRS may also initiate audio recordings of taxpayer interviews. Refer to IRM 4.10.3, the IRS Initiated Audio Recordings section.
   Refer to the Requests to Audio Record Interviews section of IRM 4.10.3, Examination of Returns, Examination Techniques; to the Taxpayer Recording of Interviews section of IRM 5.1.12, Field Collecting Procedures, Cases Requiring Special Handling; and to the Right to Make an Audio Recording of the Proceeding section of IRM 25.5.5, Summons, Summons for Taxpayer Records and Testimony.

   Caution: Taxpayers do not have the right to record phone (including online meeting) interviews. If you know a taxpayer call is being recorded by a party other than the IRS (such as a prison recording an incarcerated taxpayer), end the call as described in the Taxpayer Request to Tape Record Conversation section of IRM 21.1.3.

3. Investigation: This policy does not apply to criminal investigations or official investigations relating to the integrity of any officer or employee of the IRS. Refer to IRC 7521(d).

4. Employee Education: When used for employee education, employees may make recordings using IRS-issued software applications or platforms, such as Adobe Articulate, Teams, or Saba Centra.

5. Reasonable Accommodation: When performed by an individual with a disability as part of an approved reasonable accommodation, certain recordings may be allowed. Refer to IRM 1.20.2, Equal Employment Opportunity and Diversity, Providing Reasonable Accommodation for Individuals with Disabilities.

6. Labor Relations: The policy is not intended to and should not be interpreted to interfere with employee rights to engage in concerted activity under the National Labor Relations Act. For more information, refer to IRM 6.432.1, Addressing Poor Performance; IRM 6.711, Labor-Management Relations; IRM 6.751, Discipline and Disciplinary Actions; IRM 6.752, Disciplinary Suspensions and Adverse Actions; and IRM 6.771, Agency Grievance System.

(7) Approval:

1. For IRS-initiated audio recordings with taxpayers, Field Territory manager approval is required. Refer to IRM 4.10.3, the IRS Initiated Audio Recordings section.

2. For physical security reasons, IRS personnel must not conduct photography without prior FMSS approval in IRS facilities or at alternative duty stations duties remote to the conventional office site (e.g., satellite locations, employee’s residence). Refer to IRM 10.2.14, the Photography and Video Recordings Prohibition section.

(8) Consent: If you must record, get consent to record from all participants. They can give explicit consent (verbal or by other action) or give implied consent after notice of recording by staying on the call or in the meeting. If you intend to disclose the recording for a legitimate business need, get written consent, such as via Form 15293, IRS Privacy Act Consent. Refer to IRM 10.5.6, the Privacy Act Consent for Disclosure section.

(9) Precautions:

1. Take precautions that no unauthorized recordings or disclosures occur. When working on any form of SBU data (including PII and tax information), such precautions include muting or disabling voice-activated devices and smartphone applications (such as FaceTime, Siri or Google Now (“Okay Google”) on phones, tablets, etc.). For more information about precautions, see IRM 10.5.1.6.20, Smart Devices, about digital assistants, smart devices, IoT, and other devices that can record or transmit sensitive audio or visual information.

2. If you receive proper approval and consent to make a recording or take a photograph, you must not record or photograph unnecessary SBU data (including PII and tax information). Ensue those items are not in view or earshot of the device.

3. If SBU data (including PII and tax information) appears in an electronic recording nonetheless, you must protect the recording as SBU data and must not disclose the information unless a statutory exemption applies under IRC 6103 or the Privacy Act (depending on the nature of the data).

(1) The IRS needs to conduct some monitoring of individuals to protect federal systems, information, and personnel. Examples of such monitoring include access logs to IRS facilities and audit trails that monitor IT usage. [Privacy Act]

(2) However, limitations still exist on use of any PII collected, with sharing on a need-to-know basis for its intended use only. [Privacy Act]

(3) Monitoring of the public outside IRS facilities must not occur without first consulting Privacy Policy [Treasury’s Privacy and Civil Liberties Impact Assessment Template and Guidance]. For help, email *Privacy.

(4) For more information about the limitation of monitoring individuals, refer to IRM 10.5.6, the Privacy Act Recordkeeping Restrictions (Civil Liberties Protections) section.

(5) The IRS PCLIA addresses these limitations. For more information about PCLIAs, refer to IRM 10.5.2, Privacy Compliance and Assurance (PCA) Program.

(1) The IRS internet privacy policy notices on IRS.gov inform the public of the information collection procedures and the privacy measures in place for a particular internet website or activity. [OMB-10-23, E-Government Act, OMB A-130, OMB-03-22, Openness and Consent, PT-5]

(2) Link to the IRS Privacy Policy at every major entry point to an IRS internet website or application, as well as on any page collecting substantial personal information from the public. The requirement also may include a unique privacy policy for that website. See IRM 10.5.1.6.16.2, Online Data Collection Website or Application Privacy Policy Notice.

(3) The IRS privacy policy notice is:

1. An overview of IRS privacy practices.

2. A description of any information collected and stored automatically by the system and how the IRS will use this information.

3. An explanation of how the IRS will use any PII submitted by the internet visitor.

4. A notice that security and intrusion protection measures are in place.

(4) Refer to the overarching IRS.gov Internet Privacy Policy notice:
https://www.irs.gov/privacy

(1) A unique privacy policy for a website or application must detail the differences from the IRS.gov privacy policy. This policy applies to any website or application hosted by or for the IRS. [OMB-10-23, E-Government Act, OMB A-130, OMB-03-22, Openness and Consent, PT-5]

(2) The website or application privacy policy must still link to the IRS.gov Privacy Policy.

(3) A simple example or template, with brackets [like this] to fill in the details pertinent to the website or application, is:

[Name of website or application] Privacy Policy Notice
We are collecting [what information] to [do what for what purpose]. The IRS is authorized to collect this information by the [statute or other legal authority, usually without subsections, with links helpful for online]. We may disclose this information to [those listed in routine uses from the applicable Privacy Act SORN] for [purpose of routine use disclosure from the SORN] under the routine uses published in [SORN, with links helpful for online]. Providing this information is [voluntary or required] and necessary to [do what this process does]. By giving us your information, you consent to its use for this purpose. If you choose not to provide your information, [list consequences to individual]. [For online data collection, including online forms, add:] We protect your information in a secure and readily accessible environment. See IRS.gov/privacy for more information on your privacy rights. We may automatically collect [what (such as user’s IP address, location, and time of visit)] for [what purpose (such as site management or security purposes)]. [Other – Add any more considerations unique to this collection or mode of collection.]

(4) If the website or application is more complex, you might need a more complicated policy notice.

(5) For questions or Privacy Policy notice review or approval, email *Privacy.

(1) Any IRS internet website (or link to a third-party site for the IRS) that links to external sites that are not part of an official government domain must post a privacy departure notice. This notice alerts internet visitors that they are about to leave the IRS website and its privacy practices. It advises them to review the website privacy practices for the website they are about to enter. [OMB-10-23, E-Government Act, OMB A-130, OMB-03-22, Openness and Consent, PT-5]

(2) The privacy departure notice must be a pop-up or a statement adjacent to the link.

(3) For the departure notice language, you can use:
You are leaving the IRS website. Protect your privacy. Review the privacy policy available on the websites you are visiting and be cautious about providing your personal information.
[Continue]    [Cancel]

(1) IRS intranet or non-publicly accessible privacy policy notices inform personnel of the information collection procedures and the privacy measures in place at a particular intranet site or activity. This notice is a a modified version of the IRS.gov Privacy Policy Notice; see IRM 10.5.1.6.16.1. [OMB-10-23, E-Government Act, OMB A-130, OMB-03-22, Openness and Consent, PT-5]

(2) Link to the internal IRS intranet privacy policy notice at every major entry point to an intranet site, as well as on any page collecting personal information from an individual.

(3) Any IRS intranet site or page that links to external sites that are not part of an official government domain must post a privacy departure notice. This notice alerts IRS personnel that they are about to leave the IRS website and its privacy practices. It advises them to review the privacy practices on the website that they are about to enter. This is a modified version of the privacy departure notice; see IRM 10.5.1.6.16.3.

(4) For the intranet departure notice language, you can use:
You are leaving the IRS intranet. Protect your privacy. Review the privacy policy available on the websites you are visiting and be cautious about providing your personal information.
[Continue]    [Cancel]

(5) Do not use persistent cookies or other tracking devices to monitor an individual's visit to IRS intranet sites, except as authorized by OMB regulations.

(1) You may place information that is not SBU data (including PII and tax information) on all calendars without restriction.

(2) You must not post SBU data (including PII and tax information) on public calendars with uncontrolled access.

(3) The following applies any time a business needs to enter some form of SBU data (including PII and tax information) on a shared calendar:

1. Assign permissions on the calendar to limit access to only those people with a need to know the information.

2. Encrypt any attachments to the calendar that contain SBU data (including PII and tax information) other than noted in the following sections.

(4) For Business Unit Calendar Meetings/Appointments about Taxpayers:

1. Place on the calendar only a portion of the taxpayer's name, the last two digits of the tax year, and any business unit-specific codes that are not sensitive PII (such as a case control number that is not an SSN and not easily linked to a taxpayer by an outside party).

2. The abbreviated name should consist of the first four significant characters of the taxpayer entity's name (the name control):
   i. For individual taxpayers, these significant characters could include the first four letters of the individual taxpayer's last name (for example, John Finch would be "FINC," or use the IDRS name control). If the taxpayer's name consists of only four characters or fewer, you may use the entire name.
   ii. For corporations, partnerships, trusts or other such entities, the first four letters of the entity's name, excluding articles, could be the first four significant letters used (for example, "The Quail Company" would be "QUAI", or "Bluebird Foundation" would be "BLUE").

(5) For Calendars for Offices with Regulatory, Investigative, and/or Advocacy Responsibilities (docketed case meetings):

1. These requirements apply to calendars for Appeals, Chief Counsel (Counsel), Criminal Investigation (CI), Taxpayer Advocate Service (TAS), and other functions with regulatory, investigative, and/or advocacy responsibilities.

2. When the subject matter of the meeting is a case docketed in the United States Tax Court or other judicial forum, calendar the meeting as the case name (for example, the name of the taxpayer with case number).

   Note: This does not violate privacy principles, as the name of the case is public record information. It falls under the judicially created public records exception. (For more information, refer to IRM 11.3.11, the Information Which Has Become Public Record section.)

3. This practice also applies for unsealed CI matters (such as an indictment, where testimony occurred in an open proceeding, or if an official press release is issued). It would not apply for sealed federal court matters.

(6) For Calendars for Offices with Regulatory, Investigative, and/or Advocacy Responsibilities (taxpayer meetings):

1. Counsel's calendar entry may use a succinct description of the subject matter and include the case control number assigned to the matter in Counsel's management information system (CASE-MIS). For example, a calendar entry for a meeting to discuss whether to pursue enforcement of a summons in the examination of taxpayer A would appear as "Summons enforcement/POSTF-x01234-56." Except for assignments of cases docketed in the U.S. Tax Court (see earlier section), this case control number is not public record and not PII that you must encrypt. So long as the shared calendar is accessible only by Counsel employees whose work requires them to know of such meetings, encryption is not necessary. An invitee could then access CASE-MIS to find the identity of the taxpayer.

2. CI may use the Criminal Investigation Management Information System (CIMIS) investigation number.

3. TAS, as well as Counsel to the National Taxpayer Advocate, may use the Taxpayer Advocate Management Information System number plus the first four (4) significant letters of the taxpayer entity's name.

(7) For Non-Taxpayer-Related Meetings/Appointments:

1. An entry on the calendar for meetings with external parties doing business with the IRS (Enrolled Agents, for example) that does not concern specific taxpayers, would consist of the name of the external representative, the name of the organization (where appropriate), and/or the subject matter of the meeting.

2. You may send any meeting-related non-taxpayer-related PII or SBU data in a separate email (with encrypted, password-protected attachments using IT-approved encryption methods) with directions in the calendar invite to look for the separate email.

3. Examples of situations where you may use this practice include, but are not limited to:
   i. Where Counsel hosts informational meetings with external parties, such as trade groups or other professional organizations, in conjunction with its published guidance program.
   ii. Where IRS organizations meet with external parties to plan or deliver presentations or for procurement matters.
   iii. Examples of emails requiring encrypted PII or SBU data attachments in these scenarios include details on speakers (such as resumes) or procurement issues (such as contract information).

4. You may voluntarily include your personal appointments on the calendar to ensure business appointments do not conflict.

5. Supervisors may note absences of direct reports on their calendar to schedule meetings, assign work, and manage their work unit more efficiently.

6. Supervisors may not include more information such as the location of those direct reports. However, official travel status and telework notations (without addresses) are acceptable supervisor calendar entries.

7. Include leave and other personal information on shared group calendars only with the permission of the affected personnel.

(1) Online meeting tools include M365 Teams, Saba Centra, Zoom for Government (ZoomGov), etc. Use only enterprise-approved tools as they will have the necessary authorization and protections, such as encryption, so you can do business with necessary SBU data (including PII and tax information) in a secure environment.

(2) When using approved virtual meeting tools with encrypted communication capability for official IRS business, you must apply these principles:

1. Authentication: Use your business unit’s authentication methods for all parties. Make sure you know who is in your meeting. Remove unidentified people from the meeting. See IRM 10.5.1.2.9, Authentication.

2. Authorization: Make sure the people on the meeting are authorized to hear or view the information. See IRM 10.5.1.2.10, Authorization.

3. Need to know: Share SBU data (including PII and tax information) only with those who have a need to know in the meeting or the chat. See IRM 10.5.1.2.8, Need To Know.

   Example: You may normally conduct an online meeting from a private workspace within your home or from an automobile where you are the only occupant without someone overhearing the conversation. You may also conduct a conversation away from passers-by. Be careful not to convey sensitive information that others might overhear.

4. Keep a clean desk(top): apply the clean desk policy to your computer screen and anything in view of your camera. Close all applications and documents that don't apply to your call.

5. Avoid recording meetings. Before recording online meetings, you must have a legitimate business need, proper approval, and prior consent from all parties. See IRM 10.5.1.6.14.2, Recordings in the Workplace.

6. Meeting hosts (organizers, co-organizers) hold responsibility for controlling the meeting environment, such as removing unauthorized parties, muting audio or video when appropriate to protect privacy, giving notice and getting consent for recording, promoting others as presenters or co-organizers to help moderate the meeting and chat, and setting meeting options (such as presenters and the meeting waiting rooms).

   Caution: If someone’s voicemail picks up, remove that party from the call to prevent it from recording the meeting.

7. Use IRS contact information (such as email or name).

8. Do not use personal email or device (unless BYOD) to access virtual meeting tools for official IRS business. [PATH]

Note: Training or publicly available information – IRS personnel may send non-case-related content (or information that is not SBU including PII and tax information), including links, to and from personal accounts when IT Security constraints prohibit access. See IRM 10.5.1.6.8.4, Emails with Personal Accounts.

(3) IRS-approved encrypted online meeting tools may convey SBU data; however, apply the principles of authentication, authorization, and need to know.

(4) To protect your own privacy, keep chats, profile pictures, and background images professional.

(5) To prevent inadvertent disclosure, verify which chat or meeting window you are using to ensure you do not put SBU data in the wrong conversation.

(6) For more information about online meeting privacy considerations, refer to the internal Online Meeting Tools - Privacy Considerations site.

(7) For best practices and answers to questions about using M365 tools, refer to the internal M365 site.

(8) Refer to IRM 10.8.1, the SC-15 Collaborative Computing Devices section.

(1) When putting SBU data (including PII and tax information) on shared storage, check to make sure only those with a need to know have access. Sharing data in collaborative data environments (such as a SharePoint site, a group or team site in Teams, or your OneDrive site) might offer valuable benefits while having inherent privacy risks. Understanding the risks involved with sharing data on these sites is key to managing those risks with tight access, privacy, and security controls in place. Collaborative environment access controls must limit access using proper site, folder, file, or other permissions.

(2) Collaborative environment owners also must ensure their users follow rules and protect privacy.

(3) Most IRS collaborative environments no longer require separate PCLIAs beyond those for their underlying systems. If you use a collaborative environment for a complex processing system using custom code and connecting to other systems, it might become a system that requires a separate system PCLIA. Contact *Privacy to ask if you need a system PCLIA.

(4) For more information, refer to IRM 10.5.2, Privacy Compliance and Assurance (PCA) Program, the Privacy Compliance in Collaborative Environments and the System PCLIAs sections.

(5) For more information, refer to IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance (the SC-15 Collaborative Computing Devices and Applications and the SC-28 Protection of Information at Rest sections), and IRM 2.25.20, Integrated Enterprise Portal-Web Services - SharePoint.

(1) Before contracting for cloud services, address the necessary privacy, records management, and security policies.

(2) PGLD must approve all procurements of cloud computing services that include SBU data (including PII and tax information) via the Privacy and Civil Liberties Impact Assessment (PCLIA) process (required by the ELC and OneSDLC). For more information about OneSDLC, refer to IRM 2.31.1, Lifecycle Management - One Solution Delivery Life Cycle Guidance, or the OneSDLC site.

(3) The IRS PCLIA process addresses privacy concerns for IRS systems with SBU data (including PII and tax information) using cloud computing. These issues include, but are not limited to:

• Who is the Cloud Service Provider (CSP)?

• Who has access to the information at the Cloud Service Provider?

• Do other CSPs service this CSP (subcontract with), such as performing updates, maintenance, or other services?

• What is the Cloud Service Provider’s Federal Risk and Authorization Management Program (FedRAMP) compliance status?

• What deployment model (private, hybrid, etc.)?

• Where does the information go?

• Where is it stored, transmitted?

• How is it secured? What security categorization (Low, Moderate, High)?

• How reliable and secure is the audit trail?

• How will monitoring be done and how often?

• Does the CSP contract include all required privacy and security contract clauses, including those for protecting SBU data (including PII and tax information)?

• How long must the data be kept? When will it be destroyed?

(4) Except for systems principally supporting overseas Federal/Treasury personnel and/or activities, Treasury systems must be located and operated within the U.S. [TD P 85-01, control SA-4_T.193]

(5) PGLD and COR must provide written notification to the contractor when the contractor is allowed to keep Government data at a location outside the U.S.

(6) Failure to follow privacy and security policies and processes might require contract modifications.

(7) For more information on cloud computing issues and cloud deployment models, refer to IRM 10.8.24. Information Technology (IT) Security, Cloud Computing Security Policy, and IRM 10.8.1, Information Technology (IT) Security, Policy and Guidance.

(1) The IRS e-signature principles and federally mandated authentication controls describe how the IRS protects an individual’s identity and assures that only authorized signers are completing the transaction.

(2) For more information, refer to the internal e-Signature site. For any further questions, contact the *PGLD IA eSignature mailbox.

(3) For detailed information on the e-signature program, refer to IRM 10.10.1, Identity Assurance, IRS Electronic Signature (e-Signature) Program.

(1) The Identity Assurance IRM 10.10.2, Authentication Risk Assessments in Non-Digital Channels, details this policy, owned by PGLD’s IA as part of their Omni Channel approach to authentication and authorization for all interactions.

(2) For electronic interactions, this policy defers to the DIRA process (see IRM 10.5.1.7.9, Digital Identity Risk Assessment (DIRA)) for electronic interactions. For all other interactions, this policy applies to assessing the risk in the authentication process of telephone, in-person, and correspondence exchanges of sensitive information with individuals in authenticated customer contact channels.

(3) For more information, refer to the internal NDARA site.

(4) For questions, email *PGLD IA Omni-Innovations

(1) Use of SSNs is acceptable when any of these options mandates such use:

• Law/statute.

• Executive orders.

• Federal regulations.

• Business need (e.g., the inability to alter systems, processes, or forms due to costs or unacceptable level of risk).

(1) SSN ER compliance requires owners of forms, notices, letters, and systems to apply the following SSN necessary-use criteria to determine whether SSN use is justifiable and necessary:

1. Apply the SSN Necessary-Use Criteria
   Based on the definition of the necessary and/or acceptable use of SSNs:
   1. Provide an accurate and complete citation of what authority (legislative mandate, regulation, or executive order) justifies SSN usage.
   2. Consider how we use the SSN throughout the information lifecycle (reviewing all forms, notices, letters, and systems), and consider the following about SSN data:
   - Acquisition/collection
   - Conversion/use and display
   - Migration/transmission
   - Storage
   - Deletion/disposal
   3. Determine whether the SSN is a critical component to the business process, which we cannot perform or achieve without the use of the SSN. The owner must describe in detail those existing operational dependencies.

   Note: Step c contains procedures for completing and submitting Form 14132, Social Security Number Retention Justification for Forms, Letters, Notices, and Systems.

2. Identify SSN Elimination and Reduction Solutions
   After identifying potential areas to reduce or eliminate SSN use, collaborate with business unit stakeholders to explore and identify feasible short- and long-term mitigation solutions, and submit a written mitigation plan to IPP by email to *PGLD SSN Reduction.

3. Develop a Mitigation Strategy for Existing Inventories
   Whether SSN use is determined to be necessary or unnecessary, develop and provide to PGLD/IPP a mitigation strategy for existing forms, notices, and letters inventories on Form 14132.

4. When Creating New Forms, Notices, Letters, and Systems
   Business/system owners must practice due diligence when creating new forms, notices, letters, and systems to ensure they apply the necessary-use criteria.

For New...	The Process Is...
Forms	W&I Media and Publications will ask form owners to consider the necessary use of SSNs on newly created forms. You must provide justification for all forms requiring an SSN. The justification will become part of the form history folder. (For required Privacy Act Notification information, refer to IRM 10.5.6, the Privacy Notices section.)
Notices/Letters	The Office of Taxpayer Correspondence will ask owners to consider use of SSNs on all newly created notices/letters. These questions and answers will become part of the interview file and maintained for documentation purposes.
Systems	Owners must complete a Privacy and Civil Liberties Impact Assessment (PCLIA) for any system that will contain any personally identifiable information, including SSNs. The purpose of a PCLIA is to demonstrate that program/project managers and system owners and developers have consciously incorporated privacy and civil liberties protections throughout the entire lifecycle of a system. The Privacy Impact Assessment Management System will maintain the justification for SSN usage.

5. Manage Inventory
   PGLD will use completed Forms 14132 to manage the SSN ER Program and report progress to Treasury and IRS executive leadership.

6. Reassess Periodically
   Once every three years, business/systems owners must reassess any forms, notices, letters, or systems to determine if conditions have changed that allow for the elimination or masking the SSN on their products. Business/system owners must inform the SSN ER Program of updated statuses on each product.

(1) The IRS must provide information on IRS.gov/privacy to enable individuals to have access to the elements of their personally identifiable information that the IRS collects, as governed by the applicable laws and regulations. [NIST SP 800-53] [OMB M-21-04]

(2) The privacy concerns are that individuals have access to the information that the IRS has on them, as governed by the applicable laws and regulations.

(3) Implementation guidance: The IRS implements this control by publishing SORNs and PCLIAs and handling requests for information under the Privacy Act, IRC, and FOIA.

(4) In this IRM, PGLD policies on the individual access control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2.9, Access, Correction, and Redress

2. IRM 10.5.1.6.16, Online Data Collection and Privacy Notices

(5) PGLD and IRS also address the individual access control in the following:

1. IRM 10.5.2: PCLIAs on IRS.gov

2. IRM 10.5.6: Privacy Act SORNs; Privacy Act Requests for Non-Tax Records

3. IRM 11.3.13: throughout, and specifically FOIA and Routine Established Agency Procedures for other types of requests (including tax information)

4. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide

(1) This is a joint security and privacy control about literacy training and awareness. For the full text of the control, see the AT-2 Literacy Training and Awareness section of IRM 10.8.1.

(2) The privacy concerns are keeping personnel current on privacy training and awareness.

(3) Implementation guidance: The IRS implements this control by requiring annual mandatory briefings on security and privacy. PGLD contributes to the content of the mandatory briefings, incorporating lessons learned or issues of concern. PGLD employs awareness techniques such as all-employee communications, awareness events, and ad-hoc sessions.

(4) In this IRM, PGLD policies on the literacy training and awareness control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

(5) PGLD and IRS also address the literacy training and awareness control in the sections listed in the AT-1 references, IRM 10.5.1.8.2

(1) This is a joint security and privacy control about role-based training. For the full text of the control, see the AT-3 Role-Based Training section of IRM 10.8.1.

(2) The privacy concerns are keeping personnel current on privacy training and awareness.

(3) Implementation guidance: The IRS implements this control by requiring role-based privacy training for roles with specialized privacy responsibilities.

(4) In this IRM, PGLD policies on the role-based training control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

(5) PGLD and IRS also address the role-based training control in the sections listed in the AT-1 references, IRM 10.5.1.8.2

(1) Provide all personnel with access to PII with initial and annual training in the employment and operation of personally identifiable information processing and transparency controls. [NIST SP 800-53]

(2) The privacy concerns are that all personnel processing PII understand how to protect privacy.

(3) Implementation guidance: The IRS implements this control by requiring annual mandatory role-based briefings on security and privacy.

(4) In this IRM, PGLD policies on the processing personally identifiable information control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

(5) PGLD and IRS also address the processing personally identifiable information control in the sections listed in the AT-1 references, IRM 10.5.1.8.2

(1) This is a joint security and privacy control about training records. For the full text of the control, see the AT-4 Training Records section of IRM 10.8.1.

(2) The privacy concerns are tracking the training records to ensure that all personnel are current on privacy training and awareness.

(3) Implementation guidance: The IRS implements this control by keeping and reviewing records that personnel have taken the annual mandatory briefings on security and privacy.

(4) In this IRM, PGLD policies on the training records control include, but are not limited to, the sections listed in the AT-1 references, IRM 10.5.1.8.2.

(5) PGLD and IRS also address the training records control in the sections listed in the AT-1 references, IRM 10.5.1.8.2.

(1) This is a joint security and privacy control about event logging. For the full text of the control, see the AU-2 Event Logging section of IRM 10.8.1.

(2) The privacy concerns are that logging events (audit logs, audit trails, event logs, etc.) can reveal information about individuals.

(3) Implementation guidance: The IRS implements this control by requiring systems limit the SBU data (including PII and FTI) in audit logs to only that needed for its intended use, grant access only on a need-to-know basis, and document the justification for information collected and shared.

(4) In this IRM, PGLD policies on the event logging control include, but are not limited to, the section IRM 10.5.1.6.14.3, Monitoring Individuals.

(5) PGLD and IRS also address the event logging control in the following:

1. IRM 10.5.2: Determining SharePoint PIA Requirement

2. IRM 10.5.5: Background

3. IRM 10.5.8: Security controls applicable to non-production data

4. IRM 1.15.6: Creation, Use, and Maintenance of Unstructured Electronic Data

5. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide

(1) Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: Minimum necessary PII identified in the PCLIA. [NIST SP 800-53]

(2) The privacy concerns are that "Limiting personally identifiable information in audit records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system."

(3) Implementation guidance: The IRS implements this control by requiring systems limit PII in audit records to the minimum necessary.

(4) In this IRM, PGLD policies on the limit personally identifiable information elements control include, but are not limited to, the sections:

1. IRM 10.5.1.2.8, Need To Know

2. IRM 10.5.1.3.2, IRS Privacy Principles (Minimizing Collection, Use, Retention, and Disclosure; Strict Confidentiality)

3. IRM 10.5.1.6.14.3, Monitoring Individuals

(5) PGLD and IRS also address the limit personally identifiable information elements control in the following:

1. IRM 10.5.5: throughout, and specifically Servicewide Roles and Responsibilities for Administering the IRS UNAX Program

2. IRM 10.5.8: Security controls applicable to non-production data

3. IRM 1.2.1: Mission of the Service, Taxpayer Privacy Rights

4. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide

(1) This is a joint security and privacy control about audit record retention. For the full text of the control, see the AU-11 Audit Record Retention section of IRM 10.8.1.

(2) The privacy concerns are that the IRS retains audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions for the proper period to maintain transparency.

(3) Implementation guidance: The IRS implements this control by adhering to the IRS records managements requirements.

(4) In this IRM, PGLD policies on the audit record retention control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2.3, Minimizing Collection, Use, Retention, and Disclosure

2. IRM 10.5.1.4.4, Systems Owners

3. IRM 10.5.1.7.7, Records and Information Management (RIM)

(5) PGLD and IRS also address the audit record retention control in the following:

1. IRM 1.15.6: Retention and Disposition of Electronic Records

2. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide

(1) This is a joint security and privacy control about control assessments. For the full text of the control, see the CA-2 Control Assessments section of IRM 10.8.1.

(2) The privacy concerns are to ensure controls operate as intended, sufficiently ensure compliance with applicable privacy requirements, and manage privacy risks.

(3) Implementation guidance: The IRS implements this control by assessing privacy controls.

(4) In this IRM, PGLD policies on the control assessments control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

(5) PGLD and IRS also address the control assessments control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

(1) This is a joint security and privacy control about plan of action and milestones (POA&Ms). For the full text of the control, see the CA-5 Plan of Action and Milestones section of IRM 10.8.1.

(2) The privacy concerns are to monitor privacy on POA&Ms.

(3) Implementation guidance: The IRS implements this control by requiring System Owners monitor and address privacy risks identified on the PCLIA in a POA&M.

(4) In this IRM, PGLD policies on the plan of action and milestones control include, but are not limited to, the section IRM 10.5.1.4.4, System Owners.

(5) PGLD and IRS also address the plan of action and milestones control in IRM 10.5.2: Roles and Responsibilities.

(1) This is a joint security and privacy control about authorization. For the full text of the control, see the CA-6 Authorization section of IRM 10.8.1.

(2) The privacy concerns are to address privacy requirements before authorization to operate.

(3) Implementation guidance: The IRS implements this control by including privacy in the ELC (specifically PCLIAs) or OneSDLC (across the life cycle).

(4) In this IRM, PGLD policies on the authorization control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

(5) PGLD and IRS also address the authorization control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

(1) This is a joint security and privacy control about continuous monitoring. For the full text of the control, see the CA-7 Continuous Monitoring section of IRM 10.8.1.

(2) The privacy concerns are to maintain ongoing awareness of developing vulnerabilities.

(3) Implementation guidance: The IRS implements this control by following the Pub 5499, IRS Privacy Program Plan.

(4) In this IRM, PGLD policies on the continuous monitoring control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

(5) PGLD and IRS also address the continuous monitoring control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

(1) This is a joint security and privacy control about risk monitoring. For the full text of the control, see the CA-7 Continuous Monitoring section of IRM 10.8.1.

(2) The privacy concerns are to monitor and address privacy risks.

(3) Implementation guidance: The IRS implements this control by monitoring risks identified in PCLIAs, BPRAs, POA&Ms, and other assessment practices.

(4) In this IRM, PGLD policies on the risk monitoring control include, but are not limited to, the sections listed in the CA-1 references, IRM 10.5.1.8.4.

(5) PGLD and IRS also address the risk monitoring control in the sections listed in the CA-1 references, IRM 10.5.1.8.4.

(1) This is a joint security and privacy control about impact analyses. For the full text of the control, see the CM-4 Impact Analyses section of IRM 10.8.1.

(2) The privacy concerns are determining how potential changes to a system create new risks to the privacy of individuals and the ability of implemented controls to mitigate those risks.

(3) Implementation guidance: The IRS implements this control by reviewing Major Change Determinations (MCDs) and updating PCLIAs.

(4) In this IRM, PGLD policies on the impact analyses control include, but are not limited to, the sections listed in the CA-1 references.

(5) PGLD and IRS also address the impact analyses control in the sections listed in the CA-1 references.

(1) This is a joint security and privacy control about incident response training. For the full text of the control, see the IR-2 Incident Response Training section of IRM 10.8.1.

(2) The privacy concerns are that IRS personnel need to know who to call or how to recognize an incident or a breach.

(3) Implementation guidance: The IRS implements this control by providing mandatory training on Incident Management that is updated annually, and IM conducts a tabletop annually per OMB M-17-12.

(4) In this IRM, PGLD policies on the incident response training control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

(5) PGLD and IRS also address the incident response training control in the following:

1. IRM 10.5.4: Awareness Training and Education

2. If/Then Guide for Reporting Incidents and Breaches

(1) Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach. [NIST SP 800-53]

(2) The privacy concerns are that IRS personnel need to know who to call or how to recognize a breach involving PII.

(3) Implementation guidance: The IRS implements this control by providing mandatory training that includes information on how to identify and respond to a breach. The training includes links to how to respond to a breach.

(4) In this IRM, PGLD policies on the breach control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

(5) PGLD and IRS also address the breach control in the following:

1. IRM 10.5.4: Awareness Training and Education; Reporting Losses, Thefts and Disclosures

(1) This is a joint security and privacy control about incident response testing. For the full text of the control, see the IR-3 Incident Response Testing section of IRM 10.8.1.

(2) The privacy concerns are that IRS personnel test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies.

(3) Implementation guidance: The IRS implements this control by testing the breach response plan annually in compliance with OMB M-17-12.

(4) In this IRM, PGLD policies on the incident response testing control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

(5) PGLD and IRS also address the incident response testing control in the following:

1. IRM 10.5.4: Responsibilities

2. Document 13347, Data Breach Response Playbook: Section 4.2, Tabletop Exercises: Testing the Plan

3. Document 13347-A, IRS Data Breach Response Plan: Section 10.1, Tabletop Exercises

(1) This is a joint security and privacy control about incident handling. For the full text of the control, see the IR-4 Incident Handling section of IRM 10.8.1.

(2) The privacy concerns are the IRS has the capability to handle all types of incidents consistent with the incident response plan.

(3) Implementation guidance: The IRS implements this control by coordinating incident handling with IM, Cyber, CSIRC, and other business units as needed.

(4) In this IRM, PGLD policies on the incident handling control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

(5) PGLD and IRS also address the incident handling control in the following:

1. IRM 10.5.4: Responsibilities

2. Document 13347, Data Breach Response Playbook: Section 5

(1) This is a joint security and privacy control about incident monitoring. For the full text of the control, see the IR-5 Incident Monitoring section of IRM 10.8.1.

(2) The privacy concerns are the IRS tracks and documents incidents.

(3) Implementation guidance: The IRS implements this control by using a tracking system.

(4) In this IRM, PGLD policies on the incident monitoring control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

(5) PGLD and IRS also address the incident monitoring control in the following:

1. IRM 10.5.4: PGLD/Incident Management Intake

2. Document 13347, Data Breach Response Playbook: Section 2.0, Breach Response Team (BRT); Section 3.0, Data Breach Response Process

3. Document 13347-A, IRS Data Breach Response Plan: Section 11.1, Tracking and Documenting the Response to a Breach

(1) This is a joint security and privacy control about incident reporting. For the full text of the control, see the IR-6 Incident Reporting section of IRM 10.8.1.

(2) The privacy concerns are that the IRS reports incidents or breaches.

(3) Implementation guidance: The IRS implements this control by requiring all personnel report when an incident or breach occurs.

(4) In this IRM, PGLD policies on the incident reporting control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

(5) PGLD and IRS also address the incident reporting control in the following:

1. IRM 10.5.4: Reporting Losses, Thefts and Disclosures; PGLD/Incident Management Intake

(1) This is a joint security and privacy control about incident response assistance. For the full text of the control, see the IR-7 Incident Response Assistance section of IRM 10.8.1.

(2) The privacy concerns are that IRS provides a support resource that offers advice and assistance to personnel for the handling and reporting of incidents.

(3) Implementation guidance: The IRS implements this control by offering a hotline.

(4) In this IRM, PGLD policies on the incident response assistance control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

(5) PGLD and IRS also address the incident response assistance control in the following:

1. IRM 10.5.4: Responsibilities; Related Resources; Inadvertent Unauthorized Disclosures and Losses or Thefts of IT Assets, BYOD Assets and Hardcopy Records/Documents; PGLD/Incident Management Intake

(1) This is a joint security and privacy control about incident response plan. For the full text of the control, see the IR-8 Incident Response Plan section of IRM 10.8.1.

(2) The privacy concerns are that IRS develop and implement a coordinated approach to incident response.

(3) Implementation guidance: The IRS implements this control by following Document 13347, Data Breach Response Playbook, and Document 13347-A, IRS Data Breach Response Plan.

(4) In this IRM, PGLD policies on the incident response plan control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

(5) PGLD and IRS also address the incident response plan control in the following:

1. IRM 10.5.4: Responsibilities

2. Document 13347, Data Breach Response Playbook

3. Document 13347-A, IRS Data Breach Response Plan

(1) Include the following in the Incident Response Plan for breaches involving personally identifiable information:

1. A process to determine if notice to individuals or other organizations, including oversight organizations, is needed;

2. An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms;

3. Identification of applicable privacy requirements.

(2) The privacy concerns are that IRS develop and implement a coordinated approach to incidents.

(3) Implementation guidance: The IRS implements this control by following Document 13347, Data Breach Response Playbook, and Document 13347-A, IRS Data Breach Response Plan.

(4) In this IRM, PGLD policies on the breaches control include, but are not limited to, the sections listed in the IR-1 references, IRM 10.5.1.8.6.

(5) PGLD and IRS also address the breaches control in the following:

1. IRM 10.5.4: Reporting Losses, Thefts and Disclosures; PGLD/Incident Management Risk Assessment

2. Document 13347, Data Breach Response Playbook

3. Document 13347-A, IRS Data Breach Response Plan

(1) This is a joint security and privacy control about media sanitization. For the full text of the control, see the MP-6 Media Sanitization section of IRM 10.8.1.

(2) The privacy concerns are preventing the disclosure of information to unauthorized individuals when such media is reused or released for disposal.

(3) Implementation guidance: The IRS implements this control by requiring compliance with media sanitization requirements.

(4) In this IRM, PGLD policies on the media sanitization control include, but are not limited to, the sections:

1. IRM 10.5.1.6.10, Disposition and Destruction

2. IRM 10.5.1.7.7, Records and Information Management (RIM)

(5) PGLD and IRS also address the media sanitization control in the following:

1. IRM 10.5.6: Requirements of the Privacy Act

2. IRM 1.15.6: Retention and Disposition of Electronic Records

(1) Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: Minimum necessary PII. [NIST SP 800-53]

(2) The privacy concerns are that limiting PII elements in visitor access records when such information is not needed for operational purposes helps reduce the level of privacy risk.

(3) Implementation guidance: The IRS implements this control by collecting only minimum necessary information in visitor access records.

(4) In this IRM, PGLD policies on the limit personally identifiable information elements control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2, IRS Privacy Principles (Purpose Limitation; Minimizing Collection, Use, Retention, and Disclosure; Security )

(5) PGLD and IRS also address the limit personally identifiable elements control in the following:

1. IRM 10.5.6: Requirements of the Privacy Act

(1) This is a joint security and privacy control about system security and privacy plan. For the full text of the control, see the PL-2 System Security and Privacy Plan section of IRM 10.8.1.

(2) The privacy concerns are that privacy needs to be incorporated into the system development lifecycle.

(3) Implementation guidance: The IRS implements this control by following the ELC or OneSDLC, completing the PCLIA process, and including privacy requirements in the system security and privacy plans.

(4) In this IRM, PGLD policies on the system security and privacy plan control include, but are not limited to, the sections listed in the PL-1 references, IRM 10.5.1.8.9.

(5) PGLD and IRS also address the system security and privacy plan control in the sections listed in the PL-1 references, IRM 10.5.1.8.9.

(1) This is a joint security and privacy control about rules of behavior. For the full text of the control, see the PL-4 Rules of Behavior section of IRM 10.8.1.

(2) The privacy concerns are that all personnel with access to PII understand and follow the IRS internal Rules of Behavior.

(3) Implementation guidance: The IRS implements this control by using an IRS-approved access control system [such as Business Entitlement Access Request System (BEARS)] to communicate and document acknowledgement of the IRS System Security Rules.

(4) In this IRM, PGLD policies on the rules of behavior control include, but are not limited to, the section IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities.

(5) PGLD and IRS also address the rules of behavior control in the following:

1. IRM 10.5.5: IRS Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) Program

2. IRM 11.3.1: Disclosure Code, Authority and Procedure (CAP)

3. Document 12011, IRS Ethics Handbook

(1) This is a joint security and privacy control about social media and external site/application usage restrictions. For the full text of the control, see the PL-4 Rules of Behavior section of IRM 10.8.1.

(2) The privacy concerns are that all personnel with access to PII understand and follow the internal Social Media Guidelines site and the IRS internal Rules of Behavior.

(3) Implementation guidance: The IRS implements this control by using an IRS-approved access control system (such as BEARS) to communicate and document acknowledgement of the IRS System Security Rules.

(4) In this IRM, PGLD policies on the social media and external site/application usage restrictions control include, but are not limited to, the sections:

1. IRM 10.5.1.6.11.2, Location Services

2. IRM 10.5.1.6.17, Social Media

(5) PGLD and IRS also address the social media and external site/application usage restrictions control in the following:

1. IRM 10.5.2: Social Media PCLIA

2. IRM 11.1.3: Media Responsibilities

3. IRM 11.3.21: Use of Social Networking and Other Internet Sites by IRS Employees for Compliance Research or for Other Purpose

4. IRM 1.15.6: Use of Social Media

5. Document 12011, IRS Ethics Handbook

(1) This is a joint security and privacy control about security and privacy architecture. For the full text of the control, see the PL-8 Security and Privacy Architecture section of IRM 10.8.1.

(2) The privacy concerns are that privacy needs to be incorporated into the system development lifecycle.

(3) Implementation guidance: The IRS implements this control by following the ELC or OneSDLC, completing the PCLIA process, and including privacy requirements in the system security and privacy architecture.

(4) In this IRM, PGLD policies on the security and privacy architecture control include, but are not limited to, the sections listed in the PL-1 references, IRM 10.5.1.8.9.

(5) PGLD and IRS also address the security and privacy architecture control in the sections listed in the PL-1 references, IRM 10.5.1.8.9.

(1) This is a joint security and privacy control about central management. For the full text of the control, see the PL-9 Central Management section of IRM 10.8.1.

(2) The privacy concerns are to support privacy continuous monitoring and risk-based decision-making within the organization.

(3) Implementation guidance: The IRS implements this control by managing the control assessment through the Enterprise FISMA Compliance program.

(4) In this IRM, PGLD policies on the central management control include, but are not limited to, the sections listed in the PL-1 references, IRM 10.5.1.8.9.

(5) PGLD and IRS also address the central management control in the sections listed in the PL-1 references, IRM 10.5.1.8.9.

(1) This is a joint security and privacy control about information security and privacy resources. For the full text of the control, see the PM-3 Information Security and Privacy Resources section of IRM 10.8.1.

(2) The privacy concerns are that privacy programs have the resources needed to manage federal information resources that involve PII.

(3) Implementation guidance: The IRS implements this control by requiring senior management and executives ensure their programs and policies allocate sufficient resources to comply with IRS privacy policies and procedures.

(4) In this IRM, PGLD policies on the information security and privacy resources control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2, IRS Privacy Principles (Accountability)

2. IRM 10.5.1.4, IRS-Wide Roles and Responsibilities (Senior Management/Executives)

(5) PGLD and IRS also address the information security and privacy resources control in the following:

1. IRM 1.1.27: Roles and Responsibilities, Program and Planning Support

2. Pub 5499, IRS Privacy Program Plan

(1) This is a joint security and privacy control about plan of action and milestones. For the full text of the control, see the PM-4 Plan of Action and Milestones section of IRM 10.8.1.

(2) The privacy concerns are to reduce privacy risk by documenting and tracking planned remediations on POA&Ms.

(3) Implementation guidance: The IRS implements this control by requiring that System Owners include privacy risks identified on the PCLIA are in a POA&M.

(4) In this IRM, PGLD policies on the plan of action and milestones control include, but are not limited to, the section, IRM 10.5.1.4.4, System Owners.

(5) PGLD and IRS also address the plan of action and milestones control in IRM 10.5.2: Roles and Responsibilities.

(1) Establish, maintain, and update annually an inventory of all systems, applications, and projects that process personally identifiable information. [NIST SP 800-53]

(2) The privacy concerns are the IRS uses this inventory to ensure that systems only process the PII for authorized purposes and that this processing is still relevant and necessary for the purpose specified therein.

(3) Implementation guidance: The IRS implements this control by reviewing the PCLIA inventory at least annually.

(4) In this IRM, PGLD policies on the inventory of personally identifiable information control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2, IRS Privacy Principles (Purpose Limitation, Security)

(5) PGLD and IRS also address the inventory of personally identifiable information control in the following:

1. IRM 10.5.2: throughout, and specifically, Privacy Reporting

2. IRM 10.5.6: SORN Responsibilities

(1) This is a joint security and privacy control about measures of performance. For the full text of the control, see the PM-6 Measures of Performance section of IRM 10.8.1.

(2) The privacy concerns are to measure the effectiveness or efficiency of the privacy programs and the controls employed.

(3) Implementation guidance: The IRS implements this control by measuring privacy performance on the internal PGLD - All Internal and External Reports site.

(4) In this IRM, PGLD policies on the measures of performance control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2, IRS Privacy Principles (Purpose Limitation, Security)

(5) PGLD and IRS also address the measures of performance control in the following:

1. IRM 10.5.2: FISMA Reporting

2. IRM 10.5.4: Program Management and Review; Timeliness of the Data Breach Notification

3. IRM 11.3.13: FOIA Reporting

4. IRM 11.3.39: Annual Matching Activity Review and Report

(1) This is a joint security and privacy control about enterprise architecture. For the full text of the control, see the PM-7 Enterprise Architecture section of IRM 10.8.1.

(2) The privacy concerns are to ensure that privacy considerations are addressed throughout the system development life cycle and are explicitly related to the organization’s mission and business processes.

(3) Implementation guidance: The IRS implements this control by requiring compliance with Enterprise Architecture’s standards.

(4) In this IRM, PGLD policies on the enterprise architecture control include, but are not limited to, the sections:

1. IRM 10.5.1.3, Key Privacy Concepts

2. IRM 10.5.1.7.10, Enterprise Life Cycle (ELC) and One Solution Delivery Life Cycle (OneSDLC)

(5) PGLD and IRS also address the enterprise architecture control in the following:

1. IRM 10.5.2: Background, System PCLIAs, Reconciliation with As-Built Architecture (ABA)

(1) This is a joint security and privacy control about critical infrastructure plan. For the full text of the control, see the PM-8 Critical Infrastructure Plan section of IRM 10.8.1.

(2) The privacy concerns are the IRS address privacy issues in critical infrastructure, assets, resources, and processes in the mission life cycle.

(3) Implementation guidance: The IRS implements this control by embedding data protection through the life cycle of critical infrastructure, assets, resources, and processes.

(4) In this IRM, PGLD policies on the critical infrastructure plan control include, but are not limited to, the sections:

1. IRM 10.5.1.2.1, Privacy Lifecycle

2. IRM 10.5.1.2.2, Sensitive But Unclassified (SBU) Data

(5) PGLD and IRS also address the critical infrastructure plan control in the following:

1. IRM 10.5.2: PCLIA’s Relevance to Privacy Compliance

2. IRM 10.6.1: Responsibilities

(1) This is a joint security and privacy control about risk management strategy. For the full text of the control, see the PM-9 Risk Management Strategy section of IRM 10.8.1.

(2) The privacy concerns are that the IRS manage privacy risk to individuals resulting from the authorized processing of PII.

(3) Implementation guidance: The IRS implements this control by:

1. Implementing a risk management framework consistent with OMB guidance.

2. Assessing regularly for risks based on the privacy controls.

3. Developing and monitoring mitigation projects to minimize privacy risks.

(4) In this IRM, PGLD policies on the risk management strategy control include, but are not limited to, the sections:

1. IRM 10.5.1.2, Key Privacy Definitions [Sensitive But Unclassified (SBU) Data, Personally Identifiable Information (PII), Federal Tax Information (FTI)]

2. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities (including System Owners, Authorizing Officials)

3. IRM 10.5.1.3.1, Privacy Controls

4. IRM 10.5.1.3.2, IRS Privacy Principles (Accountability, Minimizing Collection, Use, Retention, and Disclosure, Strict Confidentiality)

5. IRM 10.5.1.6.1.1, Deciding Risk Levels for SBU Data

6. IRM 10.5.1.6.18.4, Cloud Computing

7. IRM 10.5.1.7.2, Privacy and Civil Liberties Impact Assessment (PCLIA)

8. IRM 10.5.1.7.3, Business PII Risk Assessment (BPRA)

9. IRM 10.5.1.7.9, Digital Identity Risk Assessment (DIRA)

10. IRM 10.5.1.7.13.2, Non-Digital Authentication Risk Assessment (NDARA)

(5) PGLD and IRS also address the risk management strategy control in the following:

1. IRM 10.5.2: Privacy and Civil Liberties Impact Assessment (PCLIA), Major Change Determination (MCD) for PCLIA, Business PII Risk Assessment (BPRA), Responsibilities, BPRA Roles and Responsibilities

2. IRM 10.5.4: PGLD/Incident Management Risk Assessment

3. IRM 10.5.5: Servicewide Roles and Responsibilities for Administering the IRS UNAX Program,

4. IRM 10.5.6: OMB Privacy Act Guidance; Agency Review Requirements

5. IRM 10.5.8: Security controls applicable to non-production data

6. Pub 5499, IRS Privacy Program Plan

(1) This is a joint security and privacy control about authorization process. For the full text of the control, see the PM-10 Authorization Process section of IRM 10.8.1.

(2) The privacy concerns are to address privacy requirements before authorization to operate.

(3) Implementation guidance: The IRS implements this control by including privacy in the ELC (specifically PCLIAs) or OneSDLC (across the life cycle).

(4) In this IRM, PGLD policies on the authorization process control include, but are not limited to, the sections:

1. IRM 10.5.1.2, Key Privacy Definitions [Sensitive But Unclassified (SBU) Data, Personally Identifiable Information (PII), Federal Tax Information (FTI)]

2. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities (including System Owners, Authorizing Officials)

3. IRM 10.5.1.3.1, Privacy Controls

4. IRM 10.5.1.3.2, IRS Privacy Principles

5. IRM 10.5.1.6.18.4, Cloud Computing

6. IRM 10.5.1.7.2, Privacy and Civil Liberties Impact Assessment (PCLIA)

7. IRM 10.5.1.7.3, Business PII Risk Assessment (BPRA)

8. IRM 10.5.1.7.9, Digital Identity Risk Assessment (DIRA)

9. IRM 10.5.1.7.13.2, Non-Digital Authentication Risk Assessment (NDARA)

(5) PGLD and IRS also address the authorization process control in the following:

1. IRM 10.5.2: Privacy and Civil Liberties Impact Assessment (PCLIA), Major Change Determination (MCD) for PCLIA, Business PII Risk Assessment (BPRA), Responsibilities, BPRA Roles and Responsibilities

2. IRM 10.5.4: PGLD/Incident Management Risk Assessment

3. IRM 10.5.5: Servicewide Roles and Responsibilities for Administering the IRS UNAX Program,

4. IRM 10.5.6: OMB Privacy Act Guidance; Agency Review Requirements

5. IRM 10.5.8: Security controls applicable to non-production data

(1) This is a joint security and privacy control about mission and business process definition. For the full text of the control, see the PM-11 Mission and Business Process Definition section of IRM 10.8.1.

(2) The privacy concerns are the IRS protects privacy in systems and safeguards privacy in everyday business processes supporting the IRS mission.

(3) Implementation guidance: The IRS implements this control by requiring a privacy culture, wherein all personnel think about privacy before acting. The mission of the service requires the IRS safeguard privacy and protect privacy rights.

(4) In this IRM, PGLD policies on the mission and business process definition control include, but are not limited to, the sections:

1. IRM 10.5.1.1.1, Purpose of the Program

2. IRM 10.5.1.3.2, IRS Privacy Principles

3. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities (Employees/Personnel)

4. IRM 10.5.1.5, Privacy Culture [Privacy in Practice (PiP)]

(5) PGLD and IRS also address the mission and business process definition control in the following:

1. IRM 10.5.2: Business PII Risk Assessment (BPRA)

2. IRM 10.5.6: Responsibilities, IRS Privacy Principles

3. IRM 11.3.1: Disclosure Code, Authority and Procedure (CAP)

4. IRM 1.1.27: Roles and Responsibilities

5. IRM 1.2.1: Policy Statement 1-1, Mission of the Service, Taxpayer Privacy Rights

(1) This is a joint security and privacy control about security and privacy workforce. For the full text of the control, see the PM-13 Security and Privacy Workforce section of IRM 10.8.1.

(2) The privacy concerns are the IRS develop and institutionalize the core privacy capabilities of personnel needed to protect organizational operations, assets, and individuals.

(3) Implementation guidance: The IRS implements this control by defining and developing privacy training for PGLD and other privacy-minded personnel.

(4) In this IRM, PGLD policies on the security and privacy workforce control include, but are not limited to, the sections:

1. IRM 10.5.1.1.2, Audience

2. IRM 10.5.1.3.2, IRS Privacy Principles (Privacy Awareness and Training)

(5) PGLD and IRS also address the security and privacy workforce control in the following:

1. IRM 10.5.2: PCLIA Roles and Responsibilities

2. IRM 10.5.6: Privacy Act Training

3. IRM 1.1.27: Roles and Responsibilities

4. Pub 5499, IRS Privacy Program Plan

(1) This is a joint security and privacy control about testing, training, and monitoring. For the full text of the control, see the PM-14 Testing, Training, and Monitoring section of IRM 10.8.1.

(2) The privacy concerns are that the IRS coordinates the training for personnel with access to PII and the testing of privacy controls.

(3) Implementation guidance: The IRS implements this control by reviewing testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

(4) In this IRM, PGLD policies on the testing, training, and monitoring control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2, IRS Privacy Principles (Privacy Awareness and Training)

2. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities (including Employees/Personnel, Management, Senior Management/Executives, System Owners, Personnel Engaged in Procurement Activities)

3. IRM 10.5.1.6.1, Protecting and Safeguarding SBU Data

4. IRM 10.5.1.6.15, Contractors

5. IRM 10.5.1.7.6, Mandatory Briefings

(5) PGLD and IRS also address the testing, training, and monitoring control in the following:

1. IRM 10.5.2: Program Scope and Objectives, Privacy and Civil Liberties Impact Assessment (PCLIA)

2. IRM 10.5.4: Program Scope and Objectives; Responsibilities; Awareness Training and Education

3. IRM 10.5.5: throughout, and specifically Servicewide Roles and Responsibilities for Administering the IRS UNAX Program, Manager UNAX Responsibilities, IRP UNAX Program Team Roles and Responsibilities

4. IRM 10.5.6: Privacy Act Training

5. IRM 10.5.8: Security controls applicable to non-production data

6. IRM 11.3.1: Roles and Responsibilities

7. IRM 1.15.1: Responsibilities of the IRS Records Officer, Responsibilities of the RIM Records Specialist

8. IRM 1.1.27: Roles and Responsibilities

9. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide

(1) This is a joint security and privacy control about security and privacy groups and associations. For the full text of the control, see the PM-15 Security and Privacy Groups and Associations section of IRM 10.8.1.

(2) The privacy concerns are the IRS maintain ongoing contact with security and privacy groups and associations in an environment of rapidly changing technologies and threats.

(3) Implementation guidance: The IRS implements this control by encouraging participation in appropriate groups, such as Federal Privacy Council (FPC), International Association of Privacy Professionals (IAPP), etc.

(4) In this IRM, PGLD policies on the security and privacy groups and associations control include, but are not limited to, the sections:

1. IRM 10.5.1.7.1, IRS Privacy Council

2. Exhibit 10.5.1-2, References

(5) PGLD and IRS also address the security and privacy groups and associations control in the following:

1. IRM 1.1.27: Responsibilities

2. Pub 5499, IRS Privacy Program Plan

(1) This is a joint security and privacy control about protecting controlled unclassified information (CUI) on external systems. For the full text of the control, see the PM-17 Protecting Controlled Unclassified Information on External Systems section of IRM 10.8.1.

(2) The privacy concerns are that all sensitive information is protected on external systems.

(3) Implementation guidance: The IRS implements this control by requiring that contractors and external partners protect all SBU data (including PII and tax information), which means all IRS acquisitions and agreements contain proper language holding contractors and other service providers accountable for following federal and IRS privacy policies and procedures, such as privacy clauses in contracts, PCLIAs for contracted IT, security and privacy controls, and defining contractors as IRS personnel in this IRM with all the same responsibilities for data protection.

(4) In this IRM throughout, and specifically, PGLD policies on the protecting controlled unclassified information/SBU data on external systems control include, but are not limited to, the sections:

1. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities (Personnel Engaged in Procurement Activities)

2. IRM 10.5.1.6.15, Contractors

3. IRM 10.5.1.6.18.4, Cloud Computing

4. IRM 10.5.1.7.11, Governmental Liaison (GL)

5. IRM 10.5.1.7.17, Safeguards

(5) PGLD and IRS also address the protecting controlled unclassified information/SBU data on external systems control in the following:

1. IRM 10.5.2: System PCLIAs, Survey PCLIA, Shared Storage PIAs

2. IRM 10.5.4: Reporting Losses, Thefts, and Disclosures

3. IRM 10.5.5: throughout, and specifically Employee and Contractor UNAX Responsibilities

4. IRM 10.5.6: Responsibilities, Privacy Act Training, Privacy Act Contract Requirements

5. IRM 11.3.24: throughout, and specifically Requirements

6. IRM 11.3.36: throughout, and specifically Legal Requirements

7. IRM 11.4.1: throughout, and specifically Data Exchange Agreements

8. IRM 1.15.1: Responsibilities of all IRS Employees and Contractors

9. Document 13347, Data Breach Response Playbook: Section 5.4, External Third-Party Incidents

10. Document 13347-A, IRS Data Breach Response Plan: Section 2.5, Contractors

(1) Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:

1. Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;

2. Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;

3. Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;

4. Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;

5. Reflects coordination among organizational entities responsible for the different aspects of privacy; and

6. Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and

(2) Update the plan every three years or more frequently to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments. [NIST SP 800-53]

(3) The privacy concerns are that the IRS formally documents its privacy program.

(4) Implementation guidance: The IRS implements this control by publishing the Pub 5499, IRS Privacy Program Plan.

(5) In this IRM, PGLD policies on the Privacy Program Plan control include, but are not limited to, the sections:

1. IRM 10.5.1.1, Program Scope and Objectives

2. IRM 10.5.1.3.1, Privacy Controls

(6) PGLD and IRS also address the Privacy Program Plan control in the following:

1. IRM 10.5.6: OMB Privacy Act Guidance

2. Pub 5499, IRS Privacy Program Plan

(1) Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program. [NIST SP 800-53]

(2) The privacy concerns are that the IRS has a senior official responsible for ensuring that IRS implements sound policies to protect SBU data (including PII and tax information).

(3) Implementation guidance: The IRS implements this control by designating a Chief Privacy Officer (CPO); Treasury appoints the senior agency official for privacy (SAOP).

(4) In this IRM, PGLD policies on the privacy program leadership role control include, but are not limited to, the sections:

1. IRM 10.5.1.1.1, Purpose of the Program

2. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities (including Senior Management/Executives)

3. IRM 10.5.1.7.1, IRS Privacy Council

(5) PGLD and IRS also address the privacy program leadership role control in the following:

1. IRM 10.5.6: Responsibilities, OMB Privacy Act Guidance

2. IRM 1.1.27: Roles and Responsibilities

(1) Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that:

1. Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy;

2. Ensures that organizational privacy practices and reports are publicly available; and

3. Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

(2) The privacy concerns are that people have a way to see privacy policies and contact the IRS regarding concerns.

(3) Implementation guidance: The IRS implements this control by maintaining the IRS.gov Privacy Policy page https://www.irs.gov/privacy and giving the email privacy@treasury.gov.

(4) In this IRM, PGLD policies on the dissemination of privacy program information control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2, IRS Privacy Principles

2. IRM 10.5.1.6.16, Online Data Collection and Privacy Notices

(5) PGLD and IRS also address the dissemination of privacy program information control in the following:

1. IRM 10.5.2: PCLIAs on IRS.gov

2. IRM 10.5.6: Privacy Act Publication and Reporting Requirements, Privacy Act Access and Amendment of Records

3. IRM 11.3.13: throughout, and specifically FOIA and Routine Established Agency Procedures for other types of requests (including tax information)

(1) Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that:

1. Are written in plain language and organized in a way that is easy to understand and navigate;

2. Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and

3. Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.

(2) The privacy concerns are the public can make an informed decision about sharing their information.

(3) Implementation guidance: The IRS implements this control by both maintaining the IRS.gov Privacy Policy page https://www.irs.gov/privacy and a link to that page for all external facing online services.

(4) In this IRM, PGLD policies on the privacy policies on websites, applications, and digital services control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2.4, Openness and Consent

2. IRM 10.5.1.6.16, Online Data Collection and Privacy Notices

(5) PGLD and IRS also address the privacy policies on websites, applications, and digital services control in the following:

1. IRM 10.5.6: Online Privacy Policy Notices, Privacy Act Recordkeeping Restrictions

(1) Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:

1. Date, nature, and purpose of each disclosure; and

2. Name and address, or other contact information of the individual or organization to which the disclosure was made;

(2) Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and

(3) Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request. [NIST SP 800-53]

(4) The privacy concerns are to allow individuals to learn to whom their PII has been disclosed.

(5) Implementation guidance: The IRS implements this control by requiring that employees authorized to make disclosures of non-tax Privacy Act records must account for such disclosures.

(6) In this IRM, PGLD policies on the accounting of disclosures control include, but are not limited to, the section IRM 10.5.1.2.7, Privacy Act Information.

(7) PGLD and IRS also address the accounting of disclosures control in the following:

1. IRM 10.5.6: Privacy Act Accounting for Disclosures

2. IRM 11.3.37: Accounting System

(1) Develop and document organization-wide policies and procedures for:

1. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;

2. Correcting or deleting inaccurate or outdated personally identifiable information;

3. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and

4. Appeals of adverse decisions on correction or deletion requests.

(2) The privacy concerns are to confirm the accuracy and relevance of PII throughout the information life cycle.

(3) Implementation guidance: The IRS implements this control by requiring accuracy, completeness, and timeliness of PII to ensure fair treatment of all individuals. IRS personnel will collect information, to the greatest extent practical, directly from the individual to whom it relates.

(4) In this IRM, PGLD policies on the personally identifiable information quality management control include, but are not limited to, the sections:

1. IRM 10.5.1.2.1, Privacy Lifecycle

2. IRM 10.5.1.3.2, IRS Privacy Principles (Data Quality, Verification and Notification)

3. IRM 10.5.1.6.14, Civil Liberties

(5) PGLD and IRS also address the personally identifiable information quality management control in the following:

1. IRM 10.5.2: Privacy and Civil Liberties Impact Assessment (PCLIA)

2. IRM 10.5.6: Program Scope and Objectives; Privacy Act General Provisions; Requirements of the Privacy Act; Privacy Act Recordkeeping Restrictions; Privacy Act Requirement to Maintain Accurate, Relevant, Timely, and Complete Records

(1) This is a joint security and privacy control about data governance body. For the full text of the control, see the PM-23 Data Governance Body section of IRM 10.8.1.

(2) The privacy concerns are that data, including PII, is effectively managed and maintained following applicable laws, executive orders, directives, regulations, policies, standards, and guidance.

(3) Implementation guidance: The IRS implements this control by using the Cybersecurity & Privacy Management Level Governance Board to establish policies, procedures, and standards that facilitate data governance.

(4) In this IRM, PGLD policies on the data governance body control include, but are not limited to, the sections:

1. IRM 10.5.1.1.6, Authority

2. IRM 10.5.1.7, Privacy-Related Programs

(1) Establish a Data Integrity Board to:

1. Review proposals to conduct or participate in a matching program; and

2. Conduct an annual review of all matching programs in which the agency has participated.

(2) The privacy concerns are the IRS monitor the agency’s matching activities.

(3) Implementation guidance: The IRS implements this control by having the CPO representing the IRS as a member of the Treasury Data Integrity Board.

(4) In this IRM, PGLD policies on the data integrity board control include, but are not limited to, the sections:

1. IRM 10.5.1.6.1.2, Limiting Sharing of SBU Data

2. IRM 10.5.1.7.12, Data Services

(5) PGLD and IRS also address the data integrity board control in the following:

1. IRM 10.5.6: Annual Matching Activity Review and Report

2. IRM 11.3.39: throughout, and specifically Program Scope and Objectives

(1) Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research;

(2) Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes;

(3) Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and

(4) Review and update policies and procedures every three years or if there is a significant change. [NIST SP 800-53]

(5) The privacy concerns are that the use of PII in testing, research, and training increases the risk of unauthorized disclosure or misuse of such information.

(6) Implementation guidance: The IRS implements this control by requiring the SBU Data Use process for non-production environments.

(7) In this IRM, PGLD policies on the minimization of personally identifiable information used for testing, training, and research control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2.3, Minimizing Collection, Use, Retention, and Disclosure

2. IRM 10.5.1.7.19, SBU Data Use for Non-Production Environments

(8) PGLD and IRS also address the minimization of personally identifiable information used for testing, training, and research control in the following:

1. IRM 10.5.8: throughout, and specifically all security controls applicable to non-production data

(1) Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes:

1. Mechanisms that are easy to use and readily accessible by the public;

2. All information necessary for successfully filing complaints;

3. Tracking mechanisms to ensure all complaints received are reviewed and addressed within 20 business days;

4. Acknowledgement of receipt of complaints, concerns, or questions from individuals within 20 business days if the IRS will not be responding with the response within 20 days; and

5. Response to complaints, concerns, or questions from individuals within 20 business days.

(2) The privacy concerns are to respond to concerns that members of the public might have about their privacy.

(3) Implementation guidance: The IRS implements this control by having a Privacy Complaints section on https://www.irs.gov/privacy.

(4) In this IRM, PGLD policies on the complaint management control include, but are not limited to, the sections:

1. IRM 10.5.1.1.1, Purpose of the Program

2. IRM 10.5.1.6.16, Online Data Collection and Privacy Notices

(5) PGLD and IRS also address the complaint management control in the following:

1. IRM 10.5.2: Section 803 Reporting

2. IRM 10.5.4: Caller Indicates He or She is a Victim of Identity Theft as a Result of an IRS Data Breach

3. IRM 10.5.6: Responsibilities, Section 803 Reports about Privacy Act Complaints

4. Pub 5499, IRS Privacy Program Plan

(1) Develop all required privacy reports listed in the latest spreadsheet for internal and external reports on the internal PGLD - All Internal and External Reports site and disseminate to:

1. the appropriate oversight bodies in the Distribution Level(s) column to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and

2. the appropriate officials in the Groups Responsible column and other personnel with responsibility for monitoring privacy program compliance; and

(2) Review and update privacy reports on the frequency listed in the Due Date column. [NIST SP 800-53]

(3) The privacy concerns are to promote accountability and transparency in organizational privacy operations.

(4) Implementation guidance: The IRS implements this control by complying with established reporting activities.

(5) In this IRM, PGLD policies on the privacy reporting control include, but are not limited to, the section IRM 10.5.1.7.4, Privacy Reporting.

(6) PGLD and IRS also address the privacy reporting control in the following:

1. IRM 10.5.2: Reporting

2. IRM 10.5.4: Measures and Reports; Inadvertent Unauthorized Disclosures and Losses or Thefts of IT Assets, BYOD Assets and Hardcopy Records/Documents [Treasury Government Security Operations Center (GSOC)]; High-Risk Data Breaches

3. IRM 10.5.5: Servicewide Roles and Responsibilities for Administering the IRS UNAX Program

4. IRM 10.5.6: Privacy Act Publication and Reporting Requirements, including the section Privacy Act Reports

5. IRM 11.3.13: FOIA Reporting

6. IRM 11.3.37: Disclosure Accounting Report to the Joint Committee on Taxation (JCT)

7. IRM 11.3.39: Matching Program Notice and Reporting Requirements

8. internal PGLD - All Internal and External Reports site

9. Document 13347-A, IRS Data Breach Response Plan: Section 11, Reports

(1) This is a joint security and privacy control about risk framing. For the full text of the control, see the PM-28 Risk Framing section of IRM 10.8.1.

(2) The privacy concerns are that privacy considerations inform risk assessment, risk response, and risk monitoring activities.

(3) Implementation guidance: The IRS implements this control by conducting PCLIAs, BPRAs, and other risk assessment, response, and monitoring activities and sharing results with the CPO.

(4) In this IRM, PGLD policies on the risk framing control include, but are not limited to, the sections:

1. IRM 10.5.1.1.5, Background

2. IRM 10.5.1.3.2, IRS Privacy Principles

3. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities (Management, Senior Management/Executives, System Owners, System Developers, Authorizing Officials, Personnel Engaged in Procurement Activities)

4. IRM 10.5.1.6.1, Protecting and Safeguarding SBU Data and PII

5. IRM 10.5.1.6.1.1, Deciding Risk Levels for SBU Data and PII

6. IRM 10.5.1.6.1.2, Limiting Sharing of SBU Data and PII

7. IRM 10.5.1.6.8, Email

8. IRM 10.5.1.7.2, Privacy and Civil Liberties Impact Assessment (PCLIA)

9. IRM 10.5.1.7.3, Business PII Risk Assessment (BPRA)

10. IRM 10.5.1.7.9, Digital Identity Risk Assessment (DIRA)

(5) PGLD and IRS also address the risk framing control in the following:

1. IRM 10.5.2: Privacy and Civil Liberties Impact Assessment (PCLIA), Business PII Risk Assessment (BPRA)

2. IRM 10.5.4: Background; Responsibilities; PGLD/Incident Management Intake, Risk Assessment and Notification

3. IRM 10.5.8: Security controls applicable to non-production data

4. IRM 10.10.1: Oversight Procedure

5. Pub 5499, IRS Privacy Program Plan

6. Document 13347, Data Breach Response Playbook

7. Document 13347-A, IRS Data Breach Response Plan

(1) This is a joint security and privacy control about continuous monitoring strategy. For the full text of the control, see the PM-31 Continuous Monitoring Strategy section of IRM 10.8.1.

(2) The privacy concerns are to conduct continuous monitoring to support organizational risk management decisions in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies.

(3) Implementation guidance: The IRS implements this control by following the Pub 5499, IRS Privacy Program Plan.

(4) In this IRM, PGLD policies on the continuous monitoring strategy control include, but are not limited to, the sections:

1. IRM 10.5.1.2, Key Privacy Definitions [Sensitive But Unclassified (SBU) Data, Personally Identifiable Information (PII), Federal Tax Information (FTI)]

2. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities (including System Owners, Authorizing Officials)

3. IRM 10.5.1.3.1, Privacy Controls

4. IRM 10.5.1.3.2, IRS Privacy Principles

5. IRM 10.5.1.6.18.4, Cloud Computing

6. IRM 10.5.1.7.2, Privacy and Civil Liberties Impact Assessment (PCLIA)

7. IRM 10.5.1.7.3, Business PII Risk Assessment (BPRA)

8. IRM 10.5.1.7.9, Digital Identity Risk Assessment (DIRA)

9. IRM 10.5.1.7.13.2, Non-Digital Authentication Risk Assessment (NDARA)

(5) PGLD and IRS also address the continuous monitoring strategy control in the following:

1. IRM 10.5.2: Privacy and Civil Liberties Impact Assessment (PCLIA), Major Change Determination (MCD) for PCLIA, Business PII Risk Assessment (BPRA), Responsibilities, BPRA Roles and Responsibilities

2. IRM 10.5.4: PGLD/Incident Management Risk Assessment

3. IRM 10.5.5: Servicewide Roles and Responsibilities for Administering the IRS UNAX Program

4. IRM 10.5.6: OMB Privacy Act Guidance, Agency Review Requirements

5. IRM 10.5.8: Security controls applicable to non-production data

6. Pub 5499, IRS Privacy Program Plan

(1) This is a joint security and privacy control about access agreements. For the full text of the control, see the PS-6 Access Agreements section of IRM 10.8.1.

(2) The privacy concerns are that all personnel with access to PII understand the IRS internal Rules of Behavior through access agreements.

(3) Implementation guidance: The IRS implements this control by using an IRS-approved access control system (such as BEARS) to communicate and document acknowledgement of the IRS System Security Rules (which serves as the access agreement).

(4) In this IRM, PGLD policies on the access agreements control include, but are not limited to, the sections listed in the PS-1 references, IRM 10.5.1.8.11.

(5) PGLD and IRS also address the access agreements control in the PS-1 references, IRM 10.5.1.8.11.

(1) Determine and document the Internal Revenue Code (IRC), Privacy Act, or other legal authority that permits the processing of personally identifiable information; and

(2) Restrict the processing of personally identifiable information to only that which is authorized. [NIST SP 800-53]

(3) The privacy concerns are that the IRS processes PII only for authorized purposes.

(4) Implementation guidance: The IRS implements this control by following the IRS Privacy Principle of Purpose Limitation and documenting authority – before information collection – in SORNs, privacy policies and notices, PCLIAs, Privacy Act statements, CMAs and notices, contracts, ISAs, MOUs, and other required documentation and restricting unauthorized processing through policies and access controls.

(5) In this IRM, PGLD policies on the authority to process personally identifiable information control include, but are not limited to, the sections:

1. IRM 10.5.1.1, Program Scope and Objectives (Authority), which lists primary authorities for processing PII

2. IRM 10.5.1.2, Key Privacy Definitions, including the Authorization section

3. IRM 10.5.1.3.2, IRS Privacy Principles

4. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities

5. IRM 10.5.1.6.1, Protecting and Safeguarding SBU Data

(6) PGLD and IRS also address the authority to process personally identifiable information control in the following:

1. IRM 10.5.2: Authority, Privacy and Civil Liberties Impact Assessment (PCLIA)

2. IRM 10.5.5: throughout, and specifically Program Scope and Objectives

3. IRM 10.5.6: Authorities, Privacy Act General Provisions, Privacy Act Publication and Reporting Requirements, Privacy Act Notification Programs, Privacy Act Recordkeeping Restrictions

4. IRM 11.3.1: Disclosure Code, Authority and Procedure (CAP)

5. IRM 1.2.1: Policy Statement 1-1, Mission of the Service

(1) Identify and document the legitimate IRS purposes, namely tax administration and other authorized purposes for processing personally identifiable information;

(2) Describe the purpose(s) in the public privacy notices and policies of the organization;

(3) Restrict the processing of personally identifiable information to only that which is compatible with the identified purpose(s); and

(4) Monitor changes in processing personally identifiable information and implement the Privacy Compliance and Assurance team’s processes to ensure that any changes are made in accordance with this IRM and the IRS Privacy Principles. [NIST SP 800-53]

(5) The privacy concerns are that PII is processed only for identified purposes.

(6) Implementation guidance: The IRS implements this control by requiring that personnel consult with PGLD to ensure any new purposes that arise from changes in processing are compatible with the purpose for which the information was collected. If the new purpose is not compatible, consult with PGLD to implement approaches following defined requirements to allow for the new processing, if appropriate. Approaches might include obtaining consent from individuals, revising SORNs, updating PCLIAs, or other measures to manage privacy risks that arise from changes in PII processing purposes.

(7) In this IRM, PGLD policies on the personally identifiable information processing purposes control include, but are not limited to, the sections:

1. IRM 10.5.1.2, Key Privacy Definitions

2. IRM 10.5.1.3.2, IRS Privacy Principles

3. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities

(8) PGLD and IRS also address the personally identifiable information processing purposes control in the following:

1. IRM 10.5.2: Privacy and Civil Liberties Impact Assessment (PCLIA)

2. IRM 10.5.6: Privacy Act General Provisions, Privacy Act Publication and Reporting Requirements, Privacy Act Notification Programs, Privacy Act Recordkeeping Restrictions

3. IRM 10.5.8: Privacy Authorities

4. IRM 11.3.1: Disclosure Code, Authority and Procedure (CAP)

5. IRM 1.2.1: Policy Statement 1-1, Mission of the Service

(1) Implement appropriate mechanisms (ability to provide information voluntarily or opt in) for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making. [NIST SP 800-53]

(2) The privacy concerns are that individuals participate in making decisions about the processing of their information and provide consent as required by applicable laws.

(3) Implementation guidance: The IRS implements this control by:

1. Organization-level: Implied consent. The fact that the entire IRS tax administration system and employment process is based on voluntary compliance where taxpayers and personnel have implied consent by providing their information.

2. System-level: Opt-in consent. For a system that interacts with the public, the online notices require the individual to opt in (voluntarily providing information or giving consent) to access the system.

(4) In this IRM, PGLD policies on the consent control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2.4, Openness and Consent

2. IRM 10.5.1.6.16, Online Data Collection and Privacy Notices

(5) PGLD and IRS also address the consent control in the following:

1. IRM 10.5.2: External Surveys

2. IRM 10.5.6: Online Privacy Policy Notices, Privacy Act Recordkeeping Restrictions

(1) Provide notice to individuals about the processing of personally identifiable information that:

1. Is available to individuals upon first interacting with an organization, and subsequently at every major entry point to an IRS internet website or application, as well as on any page collecting substantial personal information from the public.

2. Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language (an overview of IRS privacy practices);

3. Identifies the authority that authorizes the processing of personally identifiable information;

4. Identifies the purposes for which personally identifiable information is to be processed; and

5. Includes a unique privacy notice when system-level website or application information collected is more specific than what IRS.gov privacy policy says.

(2) The privacy concerns are that the IRS informs individuals about how their PII is processed.

(3) Implementation guidance: The IRS implements this control by: providing notice with the required elements to individuals before collecting or processing information.

1. Organization-level: See IRM 10.5.1.6.16.1, IRS.gov Privacy Policy Notice.

2. System-level: See IRM 10.5.1.6.16.2, Online Data Collection Website or Application Privacy Policy Notice.

(4) In this IRM, PGLD policies on the privacy notice control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2.4, Openness and Consent

2. IRM 10.5.1.6.16, Online Data Collection and Privacy Notices

(5) PGLD and IRS also address the privacy notice control in the following:

1. IRM 10.5.2: External Surveys

2. IRM 10.5.6: throughout, and specifically Privacy Act Notification Programs [including Notice to Individuals Asked to Supply Information (Privacy Act Notice), Online Privacy Policy Notices]

3. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide

(1) Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals. [NIST SP 800-53]

(2) The privacy concerns are that the IRS complies with the Privacy Act and informs individuals about how their PII is being processed.

(3) Implementation guidance: The IRS implements this control by providing notice with the required elements to individuals before collecting or processing information.

(4) In this IRM, PGLD policies on the Privacy Act statements control include, but are not limited to, the sections:

1. IRM 10.5.1.3.2.4, Openness and Consent

2. IRM 10.5.1.6.16, Online Data Collection and Privacy Notices

(5) PGLD and IRS also address the Privacy Act statement control in the following:

1. IRM 10.5.2: External Surveys

2. IRM 10.5.6: throughout, and specifically Privacy Act Notification Programs [including Notice to Individuals Asked to Supply Information (Privacy Act Notice), Online Privacy Policy Notices]

3. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide

(1) For systems that process information that will be maintained in a Privacy Act system of records:

1. Draft system of records notices in accordance with OMB guidance and submit new and significantly modified system of records notices to the OMB and appropriate congressional committees for advance review;

2. Publish system of records notices in the Federal Register; and

3. Keep system of records notices accurate, up-to-date, and scoped in accordance with policy.

(2) The privacy concerns are that IRS has the public-facing notice of the categories, authorities, purposes, and routine uses of the PII that the IRS collects.

(3) Implementation guidance: The IRS implements this control by the publication and updating of SORNs following the SORN SOPs.

(4) In this IRM, PGLD policies on the system of records notice control include, but are not limited to, the section IRM 10.5.1.2.7, Privacy Act Information.

(5) PGLD and IRS also address the system of records notice control in the following:

1. IRM 10.5.2: PCLIA Roles and Responsibilities

2. IRM 10.5.6: throughout, and specifically Privacy Act Publication and Reporting Requirements

3. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide

(1) Review all routine uses published in the system of records notice on a continuous basis, at a minimum once every year to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected. [NIST SP 800-53]

(2) The privacy concerns are that the routine uses control is compatible with the purpose for which the information was originally collected.

(3) Implementation guidance: The IRS implements this control by reviewing PCLIAs and SORNs periodically on their appropriate cycles to ensure that routine uses continue to be compatible with the purpose for which the information was collected.

(4) In this IRM, PGLD policies on the routine uses control include, but are not limited to, the section IRM 10.5.1.2.7, Privacy Act Information.

(5) PGLD addresses the routine uses control in the section Agency Review Requirements in IRM 10.5.6.

(1) Review all Privacy Act exemptions claimed for the system of records on a continuous basis, at a minimum once every year to ensure they remain appropriate and necessary in accordance with law, that they have been promulgated as regulations, and that they are accurately described in the system of records notice. [NIST SP 800-53]

(2) The privacy concerns are that the exemption rules control remain appropriate and necessary.

(3) Implementation guidance: The IRS implements this control by reviewing PCLIAs and SORNs periodically to ensure that exemptions remain appropriate.

(4) In this IRM, PGLD policies on the system of records notice control include, but are not limited to, the section IRM 10.5.1.2.7, Privacy Act Information.

(5) PGLD and IRS also address the exemption rules control in the following:

1. IRM 10.5.6: Agency Review Requirements

2. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide

(1) Apply all relevant IRS privacy policy protections for specific categories of personally identifiable information. [NIST SP 800-53]

(2) The privacy concerns are that some categories are particularly sensitive or raise privacy risks.

(3) Implementation guidance: The IRS implements this control by addressing different categories of PII based on sensitivity and context. Organizations consult with the senior agency official for privacy and legal counsel regarding any protections that may be necessary.

(4) In this IRM, PGLD policies on the specific categories of personally identifiable information control include all of IRM 10.5.1, and specifically IRM 10.5.1.2, Key Privacy Definitions.

(5) PGLD and IRS also address the specific categories of personally identifiable information control in the following:

1. IRM 10.5.2: Civil Liberties

2. IRM 10.5.5: throughout, and specifically IRS Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) Program

3. IRM 10.5.6: throughout, and specifically Privacy Act Recordkeeping Restrictions

4. IRM 11.3 series: All discussion of tax information under the IRC

5. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide

(1) When a system processes Social Security numbers:

1. Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier;

2. Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and

3. Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

(2) The privacy concerns are that social security numbers are particularly sensitive or raise privacy risks.

(3) Implementation guidance: The IRS implements this control by:

1. Eliminating the unnecessary use of SSNs.

2. Not denying any right, benefit, or privilege. This does not apply when the SSN is required by federal statute, as it is in IRC 6109 and 5 USC.

3. Informing taxpayers and personnel that their SSN is mandatory under tax or employment law, and how we will use it.

(4) In this IRM, PGLD policies on the social security numbers control include, but are not limited to, the sections:

1. IRM 10.5.1.4, IRS-Wide Privacy Roles and Responsibilities

2. IRM 10.5.1.7.18, Social Security Number Elimination and Reduction (SSN ER)

(5) PGLD and IRS also address the social security numbers control in the following:

1. IRM 10.5.5: throughout, and specifically IRS Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) Program

2. IRM 10.5.6: Notice to Individuals Asked to Disclose Their Social Security Number

3. Privacy & Civil Liberties Impact Assessment (PCLIA) Reference Guide