Privacy Impact Assessment - Integrated Data Retrieval System (IDRS)
IDRS System Overview
The Integrated Data Retrieval System (IDRS) is a mission critical steady state system that consists of databases and operating programs that support Internal Revenue Service employees working active tax cases within each business function across the entire Internal Revenue Service. This system manages data that has been retrieved from the tax Master File allowing Internal Revenue Service employees to take specific actions on taxpayer account issues, track status, and post transaction updates back to the Master File. It provides for systemic review of case status and notice issuance based on case criteria, thereby alleviating staffing needs and providing consistency in case control.
System of Record Number(s)
Treasury IRS – 24.030, CADE Individual Masterfile (IMF)
Treasury IRS – 24.046, CADE Individual Masterfile (BMF)
Treasury IRS – 34.037, IRS Audit Trail and Security Records System
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. Taxpayer
Entity Data: The entity data consists of the taxpayers SSN, address, and Name Control (first four characters of the taxpayers last name)
Tax Module Data: If individual taxpayer consists of the taxpayers Name, SSN, date of birth, address, filing status, exemptions, income, etc, . If Business taxpayer the tax module data consists of corporation or partnership name, Taxpayer Identification Number (TIN), business income, etc.
B. Employee
Information collected consist of employees IDRS user-id and password, IDRS employee number.
C. Audit Trails
Consist of 10 digit assigned unique employee number, 10 digit case number and the tax period, for example, 0602 (indicates a return filed in June of 2002 ). These fields are entered after the employees have entered their user-id and password. Managers receive a computerized listing that indicates what employee is working on what case(s) and this listing would indicate if an employees was reviewing taxpayers information that they had not be assigned. There are other computerized programs that provide both audit trails and statistics as to whether an employee made an unauthorized access (UNAX) of a taxpayers tax data.
D. None
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A. IRS Data: Taxpayer Information File (TIF); Integrated Data Retrieval System consists of 90 TIF Records. These 90 TIF records vary by type/functionality and depending upon their type are used by the Small Business/Self Employed (SB/SE) Operating Division, Large and Mid Size Business (LMSB) Operating Division, Tax Exempt and Government Entities (TE/GE)Operating Division and Wage & Investment (W&I) Operating Division
B. Taxpayer Data: The Integrated Data Retrieval System contain taxpayer data information provided by taxpayers via the information they provided in their tax returns. And includes Entity data, Tax Module data and Integrated Data Retrieval System data.
C. Information is collected from employees who are authorized to log on and work and process requests such as audits, payment and collection activities. This information is tracked via audit trails on the 5081 system; audit trails contain the employees number which is used by IDRS to assign tax cases to a particular employee.
D. The Department of Treasury Financial Management System (FMS) sends the IRS a file known as the “Disposition” file that is fed into the Case Control Activity (CCA) process of IDRS. There are no output files created by the CCA process or any other IDRS process that are sent back to FMS. The Inspector General for Tax Administration (TIGTA) is authorized access to IDRS and may access IDRS in the course of their investigative and audit responsibilities. GAO in the course of their audit responsibilities may be authorized by the disclosure office to receive data from IDRS. In addition as part of the IRS Fed-State program, states receive data from the IDRS for their tax collection activities.
E. The IDRS process does not directly share any data with state or local agencies. Data that is processed by IDRS and then sent to the Master File is however shared with State and Local Governments as part of the Fed-State relations project.
F. No
3. Is each data item required for the business purpose of the system? Explain.
Yes, the IDRS system allows the designated end-users/employees of the Small Business/Self Employed (SB/SE) Operating Division, Large and Mid Size Business (LMSB) Operating Division, Tax Exempt and Government Entities (TE/GE)Operating Division and Wage & Investment (W&I) Operating Division within the IRS who have been assigned a caseload related to their specific function (examination, audit, collection, etc.) to access the data they need to conduct review of requests for their respective functions from the Integrated Data Retrieval System.
4. How will each data item be verified for accuracy, timeliness, and completeness?
The various programs and command codes within the IDRS have built in validity checks to help ensure accuracy. For example, there are validity checks to insure that a SSN/TIN when entered into an on-line application contains all numeric data, validity checks also are in place using the previously mentioned entity data to insure that if multiple taxpayers have the same first and last name that they are properly distinguished one from the other via the entity check information. Product Assurance reviews the data as part of the case processing procedures also help to ensure accuracy, timeliness and completeness. There are a series of test performed on this data such as the Compatibility Test and the Final Integration test which insure the accuracy, timeliness and completeness of all IDRS data prior to its implementation during the annual Filing Season Start-up.
5. Is there another source for the data? Explain how that source is or is not used.
Certain, but not all, elements are available from other systems. Those systems are unique to a particular office function, i.e., Appeals, ACS, or Field collection and are not readily accessible to other office functions. In addition, these systems are not specific to the IDRS cases. The IDRS is specific to maintaining taxpayer information, on the Individual Masterfile (IMF), and the Business Masterfile (BMF). Cases are assigned to IRS employees for collection, examination, etc. activities for each masterfile.
6. Generally, how will data be retrieved by the user?
Data is retrieved and displayed using command codes on standard IDRS screens.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Yes. Data is retrievable by Taxpayer Identification Number, TIF record type, Masterfile Transaction Code, and the Document Locator Number (DLN).
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Only authorized employees in each business unit who as a part of their duties need access, (users, managers, system administrators, developers) and by certain others, such as TIGTA.
9. How is access to the data by a user determined and by whom?
Management determines which employees have access to the IDRS and for what purposes. Form 5081 documents at what levels they may view and use the data as a result of each employee who uses IDRS having a profile that determines this level of access. Employee access is determined by their specific need to access taxpayer data to perform their assigned duties. The Form 5081 is signed by the employee and the employee’s manager. By signing this document the user and manager is accountable for his/her misuse of the system.
Audit trails are produced by the Security & Communications System portions of the system through which all users must pass to get access to the TIF database used by the IDRS.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes, the following systems, all of which are strictly IRS systems and not systems under the purview of any other Federal, State or Local Government entity, provide, and / or receive and / or share data with the IDRS: Electronic Funds Transfer Program System (EFTPS), Generalized Mainline Framework (GMF), Generalized Unpostable Framework (GUF), Error Resolution System (ERS), Federal tax Deposit System (FTD), Remittance Processing System (RPS), State Income Tax Levy Project (SITLP), Inventory Delivery System (IDS), Integrated Collection System (ICS), Audit Information Management System (AIMS), Standardized IDRS Access (SIA) and Underreporter Project (UND), Individual Masterfile (IMF), Business Masterfile (BMF), Employee Plans Masterfile (EPMF), Individual Retirement Account File (IRAF). A of these processes send data to the IDRS program Daily 09 (DLY09) which merges all the data by masterfile and sends that data to its respective TIF. For example all IMF data goes to the ITIF, all BMF data goes to the BTIF and all other project data goes to the ZTIF. Once this information is on its respective TIF it is sorted and distributed to End Of Day (EOD) which send s data back to the respective originating processes.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
Approximately half of the systems have PIAs and Security Certification; several others are in the process. System owner(s) are responsible for assuring their systems and databases are in compliance with all IRS and Government wide mandates, laws, and requirements including Security Certifications and Accreditations, and a Privacy Impact Assessment approval.
12. Will other agencies provide, receive, or share data in any form with this system?
TIGTA is authorized access to IDRS and may access IDRS in the course of their investigative and audit responsibilities. GAO in the course of their audit responsibilities may be authorized by the disclosure office to receive data from IDRS. In addition as part of the IRS Fed-State program, states receive data from the IDRS for their tax collection activities. The Department of Treasury Financial Management System (FMS) sends the IRS a file known as the “Disposition” file that is fed into the Case Control Activity (CCA) process of IDRS. There are no output files created by the CCA process or any other IDRS process that are sent back to FMS.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
The procedures for eliminating the electronic TIF data at the end of the retention period is found in IRM 1.15..2 .
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
Yes. The TIF database records accessed by IDRS contains data that allow designated and authorized IRS employees who have a business need to identify and / or locate individuals or groups. For example, in an instance where a taxpayer applies for and is granted Innocent Spouse Relief the data gleaned from a case where a couple filed their income tax return jointly would then be used to identify and locate the other spouse who is obligated to make the tax payment. Collection activities also use this data to identify and locate taxpayers who have an outstanding tax obligation. Examination also uses this data to identify and locate taxpayers for audit purposes. Appeals uses this data to identify and locate taxpayers who are contesting their tax obligation in US Tax Court.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
Yes, the system tracks the status of a taxpayer's account after it has been assigned as a case for audit, collection, appeal, etc. It is intended to identify and locate individuals or groups. Audit trails exist that determine whether or not an IRS employee is authorized to have access and use of the system. These audit trails are determined by assigned employee numbers, user-ids and passwords.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
Yes, use of the system can allow the IRS to treat taxpayers, employees, or others, differently. However, procedures are in place for taxpayers that allow them to have appeal rights for taxes they feel are unjustly levied against them. In addition, taxpayers may pursue any tax problems stemming from the perceived misuse of or unauthorized access of their tax data by seeking resolution via the Taxpayers Advocate’s office. Employees may be treated differently however, procedures exist that provide protections for the employee so they might not be subject to any unwarranted disciplinary actions. Form 10420, Security Incident Report and Form 11377, Inadvertent Taxpayer Data Access provide protections for those IRS employees who accessed a taxpayer's data which had not been assigned to them as a result of a keying error or inadvertent access.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
Yes. The effects of the IDRS on the due process rights of taxpayers are positive and do not need to be mitigated.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
The IDRS is not Web Based.
| 
