Privacy Impact Assessment - Form 637 Registration Web Page

Form 637 Registration System Overview

The Excise Tax Application will provide a means to verify a company's 637 registration status through the irs.gov website.  Through a web page interface in the SBSE section of the site, a user will be able to check the Excise registration status of a given company by entering the company's registration number and activity letter.  The data entered into the system will be validated against the IRS Form 637 registration database, ExTRAS (Excise Tax Registration Authentication System).  If there is an exact match, only the relevant record will be displayed.  In the event of a mismatch or no data found, a response page will be returned to the user stating no records were found.  
 
System of Records Number(s)

Treasury/IRS 34.037 IRS Audit Trail and Security Records System.
Treasury/IRS 24.046 CADE Business Master File (BMF)

 Data in the System

1. Describe the information (data elements and fields) available in the system in the following categories:

Taxpayer
Employee
Audit Trail Information (including employee log-in info)
Other (Describe)

Audit Trail Information
Other – Excise Tax Registration information.
Form 637 Registration Number
Activity Letter
Company Name
“Doing Business As” Name
Registration Status
Status Date

2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.

A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)

A.  IRS.  Data is obtained from the Excise Tax Registration Authentication System (ExTRAS) – The ExTRAS database is an XXXXX database that houses nationwide Form 637 registration information.

3.  Is each data item required for the business purpose of the system?  Explain.

Yes, to identify the validity of a potential trading partner’s authorization to participate in tax-free transactions. Trading partner is not a formal term, but is used often to refer to a "buyer or seller."  Here, seller wants to verify that the buyer is tax exempt and seller does not need to collect tax.  Seller is liable for tax if buyer is not tax exempt and no tax is collected.

4. How will each data item be verified for accuracy, timeliness, and completeness?

The system is query only.  The data are supplied to participants via written notification and this is used to affect query.  No modification to the data is made through this system.

5. Is there another source for the data?  Explain how that source is or is not used.  No.

6. Generally, how will data be retrieved by the user? 

Participants will access IRS.gov and enter a registration number and activity letter.  A response screen will provide confirmation of registration status.

7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier? No. 

Access to the Data

8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?

Participants, System Administrators, and Developers.  In the event of a system audit, GAO or TIGTA may have access.

9. How is access to the data by a user determined and by whom? 

The Office of Chief Counsel has determined that the information is public and that disclosure is consistent with the "effective administration" of Excise Taxes per IRC Section 6103(k)(7). 

10. Do other IRS systems provide, receive, or share data in the system?  If YES, list the system(s) and describe which data is shared.  If NO, continue to Question 12.

Yes, the data is loaded from ExTRAS.  This system is referenced in item 2.  No other IRS systems provide, receive, or share data in the system.

11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?  Yes.

12.  Will other agencies provide, receive, or share data in any form with this system?  No.

Administrative Controls of Data

13.  What are the procedures for eliminating the data at the end of the retention period?

N/A.  This is a query only system whose data are refreshed from ExTRAS on a daily basis.  Data are overwritten on each refresh and no “stale” data is retained.

14.  Will this system use technology in a new way?  If "YES" describe.  If "NO" go to Question 15.  No.

15.  Will this system be used to identify or locate individuals or groups?  If so, describe the business purpose for this capability.  No. 

16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.  No.

17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently?  Explain.  No.

18.  Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?

N/A – The system will not provide determinations.

19.  If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?

The system is web-based and no, there is no session tracking or persistent cookies.  There is a privacy notice.