11.3.39. Computer Matching and Privacy Protection Act

(1) One of the forces driving the Privacy Act of 1974 into existence was congressional concern about the government’s use of computer systems in which to keep records about individuals. The Act's preamble points out the possibility of automated record keeping greatly magnifying the potential harm to record subjects.

(2) Due to the steady automation of government programs, automated records play a significant and pervasive role in federal record keeping. The CMPPA is the first amendment to the Privacy Act to address the concern of automated records impacting individual privacy by establishing protections, including public and individual notice, when information an individual provides to one government agency is matched with records from another agency for a different purpose.

(1) The following statutes contain laws that relate to or impact the CMPPA:

• Privacy Act of 1974 (5 U.S.C. 552a), as amended by the Computer Matching and Privacy Protection Act of 1988 (PL 100-503)

• 26 U.S.C. 6103, commonly referred to as Internal Revenue Code IRC 6103, is the primary law governing the authority for disclosure of federal tax information (FTI).

• The Freedom of Information Act (5 U.S.C. 552)

• Paperwork Reduction Act of 1995

• Federal Information Security Modernization Act of 2014

(1) Before September 30, 1997, computer matching programs (inter- and intra-agency) subject to the CMPPA were programs administered by Governmental Liaison and Disclosure.

(2) The Chief Privacy Officer (CPO) is responsible for representing the IRS as a member of the Treasury Data Integrity Board (DIB) and is the executive director responsible for the IRS Privacy Program, including statutory oversight of IRS security and confidentiality requirements for federal and state agencies receiving federal tax return and return information, collectively referred to as federal tax information (FTI).

(3) Privacy Policy and Compliance (PPC) is responsible for Privacy Act oversight, ensuring the IRS implements sound policies designed to protect the identity and privacy of employees and taxpayers.

(4) Governmental Liaison, Disclosure and Safeguards (GLDS) is responsible for overseeing the computer matching provisions of the CMPPA, ensuring FTI is appropriately disclosed and ensuring FTI provided to federal, state and local agencies remains confidential. Through its functions, GLDS provides administration, guidance, support and technical assistance to the IRS Business and Functional Operating Division (BOD/FOD), as owner of the records, in the development of computer matching programs, agreements, notices and reports.

1. Data Services is responsible for administering the IRS matching programs covered by the CMPPA and will coordinate all activities associated with initiating and continuing matching programs subject to the CMPPA provisions within the IRS, including matches that involve internal records, including personnel records, that are subject to the CMPPA.

2. Governmental Liaison is responsible for facilitating the exchange of data and fostering partnerships with federal, state and local government agencies to improve tax administration, in accordance with IRM 1.2.1.11.13, Policy Statement 11-98 (Formerly P-6-14), FedState Relations.

3. Disclosure is responsible for providing guidance and technical assistance in determining if matching programs are subject to the computer matching provisions, and if so, provide guidance in the technical review of required documents, notices and reports.

4. Safeguards is responsible for ensuring that agencies and their contractors, who have access to FTI from the IRS maintain adequate safeguards for the protection of such information.

(5) Business and Functional Operating Division (BOD/FOD), as owner of the records, is responsible for contacting Data Services, via e-mail at GLDS.CMPPA@irs.gov, to coordinate and prepare notices and reports required and appropriate for CMPPA matching program participation.

(6) Due to the increase in the number of records systems being developed, and as IRS moves towards more cooperative activities with state and local agencies, the potential has increased that matches with non-federal agencies at the area and territory levels will also be subject to the CMPPA provisions. It is incumbent on Disclosure field personnel to become familiar with the provisions of the CMPPA so they can advise and assist with achieving compliance with the CMPPA when a covered match is identified.

(1) Data Exchange and Quality Initiatives (DEQI), under Data Services, is responsible for program management, including operation and maintenance. A senior data analyst within DEQI is assigned to manage the program and coordinate all required activities with internal and external stakeholders. Program activities include, but are not limited to:

• Draft the computer matching agreement (CMA) language.

• Obtain the necessary reviews and approvals.

• Ensure each agency obtains approval from its respective Data Integrity Board (DIB) for matching agreements at the federal level.

• Review existing and proposed matching programs periodically to determine if they are subject to and in compliance with the CMPPA.

• Complete the requirements for covered matching programs as cited in 5 U.S.C. 552a(o) Matching Agreements; (p) Verification and opportunity to contest findings and (r) Report on new systems and matching programs.

• Prepare and coordinate program costs and reimbursement from external agencies.

• Prepare and deliver regular program reports.

• Provide technical support.

• Support the CPO by preparing program documentation, assessments, reports, and briefings for submission to the DIB.

(2) The senior data analyst will review output reports through Control-D, as well as reports received directly from IT programmers, and account for disclosures made to federal, state, and local agencies participating in one or more computer matching programs throughout each calendar year. Annual accounting reports will be made available to the IRS Safeguards for agency reviews and for IRS reporting to the Joint Committee on Taxation.

(1) Data Services regularly reports program status through the Director, Governmental Liaison, Disclosure, and Safeguards to the IRS CPO through weekly briefings, quarterly operation reviews, and required annual reporting.

(2) The senior data analyst within DEQI will conduct a servicewide review annually of that year’s CMPPA covered matching program activities and prepare an annual report of the matching programs for the IRS. The annual report will be submitted by the CPO to the Department of Treasury Senior Agency Official for Privacy to be included in Treasury’s annual report to OMB.

(3) An annual matching review and report is required per OMB Circular A-108. The report will include a list of each matching program in which the agency participated during the year. For each matching program, the report will include:

1. A brief description of the matching program, including the names of all participating Federal and non-Federal agencies.

2. Links to the matching notice.

3. An account of whether the agency has fully adhered to the terms of the CMA.

4. An account of whether all disclosures of agency records for use in the matching program continue to be justified.

5. An indication of whether a cost-benefit analysis was performed, the results of the cost-benefit analysis, and an explanation of why the agency proceeded with any matching program for which the results of the cost-benefit analysis did not demonstrate that the program is likely to be cost effective.

6. A description of any CMA that the DIB disapproved and the reasons for the disapproval.

7. A description of any violations of matching agreements that have been alleged or identified, and a discussion of any action taken in response.

(1) The following table provides acronyms that are used throughout this IRM section:

(1) IRM 1.1.27, Organization and Staffing, Privacy, Governmental Liaison and Disclosure (PGLD)

(2) IRM 1.2.2.12.2, Delegation Order 11-2

(3) IRM 1.10.1, Office of the Commissioner of Internal Revenue, Correspondence Manual

(4) Computer Matching Programs: https://home.treasury.gov/footer/privacy-act/computer-matching-programs

(5) National Archives and Records Administration (NARA), IRS Records Control Schedules (RCS): https://www.archives.gov/records-mgmt/rcs/schedules/index.html

(6) Office of Management and Budget (OMB) Circular No. A-108, Federal Agency Responsibilities for Review, Reporting and Publication under the Privacy Act: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A108/omb_circular_a-108.pdf

(7) Office of Management and Budget (OMB) Circular No. A-130, Managing Information as a Strategic Resource: https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf

(8) Privacy Act Directives: https://home.treasury.gov/footer/privacy-act/privacy-directives

(9) Privacy Act Reports: https://home.treasury.gov/footer/privacy-act/privacy-reports

(10) The Privacy Act Handbook: https://www.treasury.gov/privacy/Pages/handbook.aspx

(11) System of Records Notices (SORNs): https://home.treasury.gov/footer/privacy-act/system-of-records-notices-sorns

(1) Certain matching programs are exempt from the requirements of the CMPPA. For disclosure purposes, the most pertinent exemptions are those which exclude matches done for the purposes of:

• Tax refund offset

• Tax administration

• IRC 6103(d)

(2) Although the CMPPA exempts matches performed for tax administration purposes, OMB final guidance on implementing the provisions of the CMPPA expressly states that matches for management of the IRS workforce are not included in the Act’s exemption of matching program requirements for tax administration purposes.

(3) The CMPPA does not exclude matches conducted by an agency using only records from systems of records maintained by that agency, if the purpose of the match is not to take any adverse financial, personnel, disciplinary, or other adverse action against federal personnel.

(4) Matches involving federal employees conducted by Treasury Inspector General for Tax Administration (TIGTA) are exempt from the CMPPA under the Inspector General Act of 1978, as amended by the Inspector General Empowerment Act of 2016 (PL 114-317).

(5) See 5 U.S.C. 552a(a)(8)(B) for the complete list of exempt matches.

(1) Pursuant to 5 U.S.C. 552a(o) Matching Agreements, no record which is contained in a system of records may be disclosed for use in a computer matching program except pursuant to a CMA between the agencies.

(2) The IRS frequently conducts the same matching program for several different agencies; the match for each agency is considered a single matching program, thus requiring a CMA with each agency.

(3) The type of CMA must be determined in accordance with OMB Circular A-108 and identified in IRM 11.3.39.2.

1. Establishment

2. Renewal

3. Re-establishment

4. Modification

(4) Data Services will coordinate with the BOD/FOD to appropriately draft and negotiate the CMA language with the other agency or other IRS function. According to the CMPPA, the CMA must specify the following:

1. Purpose and legal authority for conducting the program.

2. Justification for the program and anticipated results, including a specific estimate of any savings.

3. Description of the records that will be matched, including each data element that will be used, the approximate number of records that will be matched, and the projected starting and completion dates of the matching program.

4. Procedures for providing individualized notice to applicants for and recipients of financial assistance or payments under federal benefits programs and applicants for and holders of positions as federal personnel at the time of the application, and notice periodically thereafter.

5. Procedures for verifying information produced in the matching program.

6. Procedures for the retention and timely destruction of identifiable records created by a recipient agency or non-federal agency in the matching program.

   Note: Each agency shall provide a detailed description of their record retention time frames. Refer to Document 12990, IRS Records Control Schedules (RCS), Schedule 8, Administrative and Organizational Records, Item 52, Requests for Return and Return Information Files (NARA RCS Job No. N1-058-05-2, Division of Governmental Liaison and Disclosure Records Item 52). Although many of the records covered by Schedule 8 are created and maintained by the Office of the Commissioner of the Internal Revenue Service, and specified current and predecessor offices, this schedule is intended to be functional in nature and can be used by other IRS functions.

7. Procedures for ensuring the administrative, technical and physical security of the records matched and the results of the program.

8. Prohibitions on duplication and redisclosure of records provided by the source agency within or outside the recipient agency or the non-federal agency, except where required by law or essential to the conduct of the matching program.

9. Information on assessments that have been made on the accuracy of the records that will be used in such a matching program.

10. The Comptroller General may have access to all records of a recipient agency or a non-federal agency that the Comptroller General deems necessary in order to monitor or verify compliance with the agreement.

(5) After each party to the CMA concurs with the agreement language, the final draft will be signed by the responsible official for each agency, at least 180 days prior to scheduled implementation of the matching program. The responsible official is considered the system manager or the head of the organizational unit who has delegated authority to perform Privacy Act activities in accordance with Treasury Directive 25-04.

1. See IRM 1.10.1, Office of the Commissioner of Internal Revenue, Correspondence Manual, regarding the IRS Signature Package Procedures.

2. SeeIRM 1.2.2.12.2, Delegation Order 11-2, regarding delegated authority to permit the disclosure of FTI.

(6) Data Services will submit the CMA, signed by each party to the agreement, to the Treasury DIB, via e-mail to Privacy@treasury.gov for review and approval by the Board. In accordance with Treasury Directive 25-06, the Board will:

1. Review and approve or deny the CMA for receipt or disclosure of records for matching programs to ensure compliance with all relevant statutes, regulations, and OMB guidance, including 5 U.S.C. 552a(o) Matching Agreements; and

2. Approve or deny the CMA no later than 60 calendar days after receipt of the CMA and submit to Data Services any questions by day 30 of the 60-day period.

(7) Upon the Board’s approval, the Treasury DIB Chairperson will sign the CMA and the Treasury DIB Liaison will return the CMA to Data Services.

(8) Data Services will coordinate with Treasury to report the matching program to Congress and OMB, if required and per OMB Circular A-108 guidance.

(9) When preparing the CMA, Data Services and the BOD/FOD must consider the systems of records to be used in the matching program. The routine use cited in the existing system notice must encompass the proposed matching program. If not, the system notice must be republished to modify the routine use statement prior to submitting the CMA for review by the Treasury DIB.

(10) In addition, the data resulting from the matching program must be considered. If the data match results in a new system of records, then a new system notice must also be published.

(11) The initial CMA will remain in effect for a period not to exceed 18 months. During the last 90 days of the existing CMA, the parties to the CMA will approve a one-time renewal, not to exceed 12 months. The renewal CMA does not require notice and reports to Congress and OMB and publication in the Federal Register.

(12) Upon expiration of the initial CMA and one-time renewal CMA, a re-establishment CMA must be secured to continue the matching program. A re-establishment CMA must be fully executed within the last 90 days of the original CMA, or renewal CMA, if applicable. The re-establishment CMA requires the same notice, reporting and publication requirements as the initial CMA. The format for the initial CMA must be used for the re-establishment CMA.

(1) Agencies participating in matching programs that are subject to CMPPA are required to publish a matching notice in the Federal Register at least 30 days prior to the establishment, re-establishment, or significant modification of the matching program. Examples of significant modifications are cited in OMB Circular A-108.

1. Generally, the recipient federal agency (or the source federal agency in a match conducted with a non-federal agency) is responsible for publishing notice of the matching program in the Federal Register. However, in matching programs involving only federal agencies, the agencies will assign responsibility. In the case of matching programs conducted with a non-federal agency, the federal agency is responsible for publishing.

2. Notice is not required for the one-year renewal of a matching program by the agency’s DIB.

(2) Agencies are required to report to OMB and Congress any proposal to establish, re-establish, or significantly modify a matching program at least 30 days prior to the submission of the notice to the Federal Register for publication.

1. If the agency is re-establishing a matching program and continuing the program past the expiration of the current CMA (including any one-year renewal approved by the DIB), the agency must report the proposal to re-establish the matching program at least 60 days prior to the expiration of the existing CMA.

2. OMB will have 30 days to review the proposal to establish, re-establish, or significantly modify a matching program and provide any comments to the agency. Advance notice to OMB and Congress is required by subsection (r) of the Privacy Act.

3. Submission of the report to OMB will officially start the 30-day advance review period.

   Note: OMB’s 30-day review period is separate from and will not run concurrently with the publication period in the Federal Register.

4. The report of an established, re-established, or significantly modified matching program includes a transmittal letter, a narrative statement, a draft Federal Register notice, a CMA, and any supplementary documents.

(1) When the IRS is the recipient agency (or federal agency when the matching program is conducted with a non-federal agency), the IRS will notify records subjects in one of two ways, either by constructive notice or direct notice.

1. Constructive Notice - the IRS will coordinate with Treasury to publish constructive notice of the matching program in the Federal Register informing record subjects of the proposed matching program and in accordance with 5 U.S.C. 552a(e) and OMB Circular A-108, and in the format prescribed by the Federal Register Document Drafting Handbook.

2. Direct Notice - the IRS will provide to each individual in the match population a direct notice of the match. This will be accomplished by a statement on an application form or by separate document. In most instances, amending the Privacy Act statement on an application form will meet CMPPA requirements.

(2) For the IRS matching programs designed to detect fraud and/or illegal acts of agency employees, the IRS will ensure that direct notice is provided to each record subject. While Document 12011, Internal Revenue Service Ethics Handbook, universally prohibits fraud or inappropriate actions on the part of its employees, a specific notice to each record subject regarding the matching program will be provided prior to the implementation of the matching program and, at the least, an annual notice during the period the matching program is authorized.

(3) Notice published in the Federal Register must contain the following information:

1. Name of participating agency or agencies.

2. Purpose of the match.

3. Authority for conducting the match.

4. Categories of records and individuals covered.

5. Inclusive dates of the matching program.

6. Address for receipt of public comment or inquiries.

(4) The IRS must publish notices of the establishment, re-establishment or modification of a matching program in the Federal Register at least 30 days prior to conducting the matching program.