Privacy Impact Assessment – National Account Profile (NAP)

NAP System Overview

The NAP project enables IRS caseworkers to have the most current and complete taxpayer entity information by providing users on-line access to Taxpayer Identification Numbers.

System of Records Number(s) 

Treasury/IRS 24.046 CADE Business Master File (BMF)
Treasury/IRS 24.030 CADE Individual Master File (IMF)
Treasusry/IRS 26.016 Returns Compliance Programs
Treasury/IRS 34.037 IRS Audit Trail and Security Records System

Data in the System

1. Describe the information (data elements and fields) available in the system in the following categories:

A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)

A. Taxpayer: The NAP contains entity data (Taxpayer Identification Numbers, name, address, etc.) Entity data, in addition to the Taxpayer Identification Number, name and address as stated above, may include a company name, a change of address indicator, what date the address change was made, District/Area Office, etc. 

B.  Employee: none

C.  Audit Trail Information: none contained within the NAP application. Audit trail functionality is provided by the host platform (i.e., IDRS).

NAP is an application that is accessed through other applications. Those other applications are responsible for ensuring an appropriate audit trail is maintained.

D.  Other: none 

2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.

A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)

A. IRS: NAP data is obtained from the master files and TIN assignment files.

B. Taxpayer: NAP does not obtain data directly from the taxpayer.

C. Employee: none. Employees logon to host platforms (i.e., IDRS) which provide authentication and authorization functionality.

D. Social Security Administration (DM-1)
E. See A
F. See A

3.  Is each data item required for the business purpose of the system?  Explain.

Yes, NAP is used to verify the taxpayer is correctly identified. Changes of address are reflected, but that is part of identifying the correct taxpayer.

4. How will each data item be verified for accuracy, timeliness, and completeness?

NAP is refreshed weekly to remain in synch with master file and SSA data.  NAP assures that the data received from the Master File and SSA is authoritative and current.

5. Is there another source for the data?  Explain how that source is or is not used.

Nap is a compilation of entity data from a number of sources and provided in a single repository to enhance case worker accuracy and productivity.

6. Generally, how will data be retrieved by the user? 

IRS employees access NAP data through a host platform (i.e. IDRS). The host platform provides authentication and authorization services, as well as audit trail functionality. Users must have an account established with appropriate managerial authorization. Each user’s account profile determines what data that user may access, and these permissions are granted on a “need to know” basis.

7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier? 

NAP data is retrieved for specific taxpayers by taxpayer identification number (TIN).

Access to the Data

8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?

Business Operating Division employees (Customer Service Representatives, Revenue Agents, Tax Examining Assistors, etc) have access to the data in order to perform their assigned duties. Authorized IRS personnel, oversight auditors, contract developers, as well as IRS organizations developing managerial and statistical reports may have access to the data.

9. How is access to the data by a user determined and by whom? 

Data access is granted on a need to know basis. A potential user must submit a request for access (F5081). Users are not permitted access without approval by an authorized management official.

10. Do other IRS systems provide, receive, or share data in the system?  If YES, list the system(s) and describe which data is shared.  If NO, continue to
Question 12.

NAP receives SSN and EIN data from master files (IMF, BMF, EPMF), TIN assignment files (ATIN, ITIN), payment systems (EFTPS, RPS), Partnership Control, and Tax Refund Offset systems.  DM-1 files are from SSA.

IRS business systems accessing NAP data include:
Correspondence Letter System
Duplicate Direct Deposit
National Change of Address
Dependent Database
Processing systems (IMF, BMF, IRMF, FTD, ELF, MeF, ISRP, GMF)
Compliance systems (ACS, AUR, IAIS, QRP, RGS, IIP, IDS, BWH, QSF, ATFR)
Online access systems (SCAP, SCOP, SIA, SACS, IDRS, LAP)

11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?

The platforms that provide the processing and storage capabilities for the tax processing systems are tested and certified by the IRS Security Certification Office. In order for each of the individual applications to certified as applications running on a certified platform, they are required to perform a privacy impact assessment.

12.  Will other agencies provide, receive, or share data in any form with this system?

NAP receives data from the Social Security Administration.

Administrative Controls of Data

13.  What are the procedures for eliminating the data at the end of the retention period?

Not applicable.  NAP data is a copy of master file data.  As data is added to or deleted from the master files, these changes are reflected in NAP. 

NAP is updated weekly from its data sources. Those data sources retire data at the end of its retention period. If data is not on the data source, it is not on NAP.  The NAP data is continuously overwritten by data received from the Master file and SSA.

14.  Will this system use technology in a new way?  If "YES" describe.  If "NO" go to Question 15. No.

15.  Will this system be used to identify or locate individuals or groups?  If so, describe the business purpose for this capability.

Yes. NAP is designed to assist IRS tax administration employees in the performance of their duties. In order to provide quality service to the taxpaying public, it is important that various data stored in the master files be attributable to the correct taxpayer. To this end, NAP provides a certain amount of on-line research capabilities.

16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.  No.

17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently?  Explain.  No.

18.  Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?  N/A

19.  If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?  N/A.