Privacy Impact Assessment - Individual Master File (IMF)
IMF System Overview
IMF is the Individual Master File, which consists of a series of runs, data records and files that are in production with links to many of the other IRS systems located at MCC, TCC, DCC, and Campuses. The IMF receives individual tax submissions in electronic format and processes them through a pre-posting phase, posts the transactions, analyzes the transactions and produces output in the form of Refund data, Notice data, Reports, and information feeds to other entities.
System of Record Number(s)
Treasury/IRS 24.030 CADE Individual Master File (IMF), (Formerly: Individual Master File (IMF)
Treasury/ IRS 34.037 IRS Audit Trail and Security Records System
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. Taxpayer: Tax data and related information pertaining to individual taxpayers are posted to the Individual Master File. Each taxpayer account has an entity module and one or more tax modules. The entity module contains data which describes the taxpayer as an entity and contains groups of data including Taxpayer Identification Number(s) (TIN), name, address, etc. A tax module contains records of tax liability and accounting information pertaining to the income tax for one tax period. Each tax module contains groups of data including assessed tax liability, payments and other credits, balance due amounts, refund checks sent, and other accounting information relating to a specific tax period.
B. Employee: None.
C. Audit Trail Information: Master files by definition do not have an audit trail. They are defined as having interfaces to systems that maintain their own audit trails. There is no direct access to IMF data. All access is through batch files. The data viewed by authorized IRS employees is a copy of the IMF data loaded into any of a number of other systems that have a user interface. These systems maintain the authentication and authorization required, including the use of audit trail information.
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
The data is reported by the taxpayer on various forms and schedules in the 1040 Individual Income Tax family of returns. After the initial filing of the tax return, any changes or updates (adjustments) to a taxpayer account, whether initiated by the taxpayer or the IRS, is submitted as a transaction to post to the master file so that the file reflects a continuously updated and current record of each taxpayer’s account.
3. Is each data item required for the business purpose of the system? Explain.
Yes. The name, TIN, and address are required to identify the taxpayer’s account. The income, deductions, credits, etc. reported on the tax return, as well as any payments received, are required to settle the taxpayer’s account, and maintain a record of taxes assessed, abated and collected.
4. How will each data item be verified for accuracy, timeliness, and completeness?
The front-end input systems (Integrated Submission and Remittance Processing (ISRP), e-file, Generalized Mainline Framework (GMF), etc) validate and correct data entries. The IMF process reformats this information for processing and storage. The front-end systems adhere to the established (and published) input and posting cycles to ensure that returns received from the taxpayers are processed, validated and posted to the Individual Master File within required time frames.
5. Is there another source for the data? Explain how that source is or is not used. No.
6. Generally, how will data be retrieved by the user?
IMF data is not directly accessible by users. Data is extracted on a weekly basis for reports and for loading into other IRS systems, which provide read-only access to the data (on a need to know basis). The data are extracted by criteria or status. Every case which meets the criteria or status is extracted
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Yes, by name and SSN (or other TIN).
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Authorized IRS personnel and contract program developers, as well as IRS organizations developing managerial and statistical reports.
9. How is access to the data by a user determined and by whom?
Data access is granted on a need to know basis. Potential users must submit requests for access form (5081) to their local management for approval consideration. Users are not permitted access without a signed 5081 form from an authorized management official.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes. All settlements with taxpayers are affected through computer processing of the IMF account and the data therein is used for accounting records, for issuance of refund checks, bill or notices, answering inquiries, classifying returns for audit, preparing reports and other matters concerned with the processing and enforcement activities of the IRS.
Initial inputs to IMF for each tax period are processed by a front-end input system (i.e. ISRP, e-file, etc.). These systems interface with the Generalized Mainline Framework (GMF) which provides the data to the IMF processing system.
Subsequent inputs are transactions that can originate in any number of IRS processing systems. Generally these system interface with the Integrated Data Retrieval System (IDRS)/ Integrated Case Processing (ICP) system processing runs which include End-of-Day (EOD) runs which validates the data before submitting to the IMF for posting.
Any input (initial or subsequent) which is unable to post to the master file for any reason, is returned to the originating system via the Generalized Unpostable Framework (GUF) for correction.
Posted data is replicated for use in other IRS processing systems. The entire IMF is replicated for Corporate Files On-line (CFOL), which provides on-line read-only access for authorized IRS employees. There are several files that contain extracts of entity data that are used in validation for processing or for employee access as a research tool in answering taxpayer inquiries or resolving compliance issues. These include the National Account Profile (NAP), the Taxpayer Index File (TIF) and the Name Search Facility (NSF).
Information Returns Processing (IRP) and MIFTRA processing accesses the IMF directly. Other system that receive IMF data do not access the IMF directly, but receive a file generated either by IMF OUTPUTS or by 701 EXTRACTS. These include IDRS, Automated Collection System (ACS), Audit Information Management System (AIMS) and reports.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
The mainframe system that provides the processing and storage capabilities for the tax processing system, including the Information Returns Processing System (Information Returns Processing; Individual Returns Master File and Payer Master File), as well as Business Master File (BMF), Individual Master File (IMF), is preparing to undergo security testing and is expected to receive certification by November 2003. A PIA was completed 7/03 for IRP, which included subsystems. IRP will need to be recertified in 2006. IDRS/ICP and GUF have PIAs. GMF, CFOL, NAP, TIF, ACS and NSF do not.
12. Will other agencies provide, receive, or share data in any form with this system?
Yes. Financial Management Service (FMS) receives data from IMF for those accounts that have overpaid their liability. FMS provides data to IMF on taxpayers that have other outstanding federal liabilities that can or have been offset by their account overpayment.
Social Security Administration (SSA) provides data that IMF uses to validate and reconcile Social Security Numbers (SSNs) with individual taxpayers.
The Census Bureau receives data from IMF that is used for demographic and other studies.
13. What are the procedures for eliminating the data at the end of the retention period?
Annual end of year processing (Conversion) updates the IMF. An analysis is performed and based on factors such as the current status, the Assessment Expiration Date and Collection Expiration Date entity and tax modules are removed to the retention register.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
Yes. The business purpose is to identify and locate taxpayers who are not in compliance with federal income tax filing and payment requirements. The system accepts queries from other systems based on criteria that may indicate cases at high risk for non-compliance. The data are further analyzed by these other systems, and the results posted back to the master file.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
This system does not itself monitor individuals or groups. Other systems extract data from this repository. Extracts are performed only based on an approved request for information services.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. The master file data allows IRS to ensure that taxpayers are treated fairly and equitably. The automated method of generating notices based on specific criteria eliminates the possibility of one taxpayer receiving preferential treatment over another. The IMF also enables all taxpayers to receive the notifications that are applicable to them when there is a change in tax law, such as the recent changes affecting the child tax credit.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
Yes. The IMF records the issuance of statutory notices. These notices may include math errors on a return, and other procedural notices sent to the taxpayer on initial processing. If another system accesses data in the IMF and subsequent processing by that other system results in a notice to the taxpayer, the notice is recorded on the IMF, which serves as the master repository. The other systems have procedures to ensure due process.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors? n/a
|
