Privacy Impact Assessment – CQRS Insider Website

CQRS System Overview

The website will be used to communicate DCI (data collecting instrument) coding decisions made by Centralized Quality Review System (CQRS) management, directives given by Product line Analysts and Business Operating Division Analysts, and also meeting minutes that clarify said decisions. The site also will be used to communicate call schedules which employees are required to follow on a daily basis. Due to Centralized Quality having four operating locations, it is imperative that all locations have access to the same information. 

System of Records Number(s) 

Treasury/IRS 34.037, IRS Audit Trail and Security Records System
Treasury/IRS 36.003, General Personnel and Payroll Records

Data in the System

1. Describe the information (data elements and fields) available in the system in the following categories:

A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)

No taxpayer information (SSN, name) will be included on the web site. Employee names will be listed as the author of documents posted to the website. The website has been set up to require authentication via SEID for access. Only CQRS employees are to access the site unless authorized by the CQRS Site manager.

2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.

A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)

No taxpayer or employee personal information such as payroll records, TINs or medical records will be posted on the website. 

3.  Is each data item required for the business purpose of the system?  Explain.  N/A

4. How will each data item be verified for accuracy, timeliness, and completeness? 
N/A

5. Is there another source for the data?  Explain how that source is or is not used.

No other source is available to distribute the information due to CQRS having several locations Nationwide. The website is the best vehicle to distribute this information.

6. Generally, how will data be retrieved by the user? 

The user will access the website via the url, and click links to subject material needed to perform their assignments.

7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier? 

No. The website is user authenticated by SEID. This was set up by MITS to allow only CQRS employees access to website due to the sensitivity of the SOI plan.

Access to the Data

8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?

All CQRS employees, and in the future TIGTA. They may need access during audits performed on CQRS.

9. How is access to the data by a user determined and by whom? 

Access is predetermined by SEID.

10. Do other IRS systems provide, receive, or share data in the system?  If YES, list the system(s) and describe which data is shared.  If NO, continue to Question 12.  No

11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?  N/A

12.  Will other agencies provide, receive, or share data in any form with this system?  No

Administrative Controls of Data

13.  What are the procedures for eliminating the data at the end of the retention period?

The website is reevaluated at the end of each fiscal and redesigned. A back up copy of the website is archived.

14.  Will this system use technology in a new way?  If "YES" describe.  If "NO" go to Question 15. No

15.  Will this system be used to identify or locate individuals or groups?  If so, describe the business purpose for this capability.  No

16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.  No

17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently?  Explain.  No

18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?

Yes. Decisions posted to the website site are approved by CQRS management before inclusion.

19.  If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?

Cookies will not be used.