Privacy Impact Assessment – Distribution Channel Management (DCM)
DCM System Overview:
Distribution Channel Management was created to fulfill the requirement of Section 2001(b) of the IRS Restructuring and Reform Act of 1998 (RRA '98). In December of 1998, the Assistant Commissioner for Electronic Tax Administration published a strategy for growth to meet RRA '98. The strategy identifies the Distribution Channel Management system as one of seven initiatives to be developed.
System of Records Number(s):
Treasury/IRS 22.062 Electronic Filing Records
Treasury/IRS 34.037 IRS Audit Trail and Security Records System
Data in the System
1. Description of Data on Distribution Channel Management
1a Taxpayer Information
Distribution Channel Management (DCM) Activity Reporting System was created to give Wage and Investment Division (W&I) program owners, managers and executive’s statistical information about electronic filings. To that end, the system is populated with Electronic Return Originators (ERO) information and not individual taxpayer information.
1b Employee Information
Distribution Channel Management is not designed to store information on IRS employees, except information on the employees who access Distribution Channel Management. All authorized employees gain access to the system through an identification and authentication log on process.
1c Audit Trail Information
Audit trail information is collected on authorized IRS analysts who access the system (login ids, passwords, date and time entry, objects viewed and objects downloaded.).
1d. Other Information
Statistical Electronic Return Originator (ERO) information is stored on the Distribution Channel Management (DCM) system. Currently, that data is gathered by utilizing information from the Electronic Tax Administration Research and Analysis System (ETARAS) (1544), Third Party Data Store (TPDS), Individual Master File (IMF) 701 Extract, PTIN/SSN Cross-Reference File, and SPEC-Taxpayer-Assistance-Reporting-System (STARS).
2. Sources of Data on Distribution Channel Management
Data Currently available on DCM (IMF)
ELF1544 Data – The ELF1544 file is queried from the ETARAS system three times a year.
TPDS Data – The TPDS data is transferred to Distribution Channel Management through a weekly FTP process initiated by the Enterprise Computing Center-Martinsburg (ECC-MTB).
IMF 701 Data – The IMF 701 data is transferred to the Distribution Channel Management three times a year via FTP process initiated by National Office IMF 701 personnel.
PTIN/SSN Cross Reference File – The PTIN/SSN Cross-Reference file is transferred to Distribution Channel Management from the IBM mainframe three times a year via FTP process initiated by National Office PTIN/SSN personnel. The PTIN/SSN cross-reference file is used in conjunction with the EFIN/SIDN to ensure the information about a particular tax preparer or tax preparation sites is linked.
EFIN/SIDN Cross Reference File – The EFIN/SIDN Cross-Reference file is transferred to Distribution Channel Management from the STARS system in Atlanta three times a year.
2a. What IRS files and databases are used
The IRS files used for the Distribution Channel Management are mentioned above. The Distribution Channel Management uses Microsoft’s SQL Server 2000.
2b & 2c What information will be collected from the taxpayer/employee
No individually identifiable taxpayer information is collected. The data collected is statistical information on numbers, types of forms and filings, and acceptance and rejection rates based on the submissions of tax preparers. Only audit trail information is collected on authorized employees who access the system
2d, 2e & 2f What Federal agencies, State & Local agencies are providing data for use in the system
No Outside, Federal, State or Local Agencies provide data to Distribution Channel Management. No other third party data sources are used other than the sources referenced above.
3a. How will data be collected from sources other than IRS records and the taxpayer be verified for accuracy.
N/A, all data comes from internal sources within IRS.
3b. How will data be checked for completeness
The data is checked for completeness by comparing the record counts to actual results via SQL query analyzer. The PTIN/SSN cross-reference file is used to ensure the information collected on a particular tax preparer is correct information.
3c. Is the data current? How do you know?
We receive three extracts per year according to the 52 week (ECC-MTB) posting cycle schedule. The first extract takes place in cycle 17, the second takes place in cycle 30, and the third takes place in cycle 43 of every current year. The IMF 701 Extract data is extracted from IMF master file, and the 1544 data comes directly from the service center, which we rely on to be current data.
4. Are the data elements described in detailed document? If yes, what is the name of the document?
Yes, all data elements are detailed in various documents:
ELF1544 Data – The ELF1544 data elements are available in the Distribution Channel Management FSP (7.50.00.00).
TPDS Data – TPDS definitions are available in the Distribution Channel Management FSP.
IMF 701 Data – The IMF 701 data elements are defined in the Distribution Channel Management FSP.
PTIN/SSN Cross Reference File – The PTIN/SSN Cross reference data elements are detailed in the Distribution Channel Management FSP.
STARS Data – The EFIN/SIDN Cross Reference data elements are detailed in the Distribution Channel Management FSP.
Access to the Data on DCM
1. Who will have access to the data in the system?
Access to Distribution Channel Management is limited to IRS marketing analysts who have a need to conduct research about various electronic filing initiatives. They apply via the online 5081 system. Access is restricted to the web site only. There is also a restriction on the duration of the access. Once the duration for access has expired, the account is disabled and analyst must use 5081 process to gain new password. All developers of the system have access as well to allow for quick problem research or resolution.
2. How is access to the data by a user determined?
Access to Distribution Channel Management is determined by the user’s need to know. Users apply via the online 5081 system based on the applicant’s manager’s approval. Access to the system is granted via online 5081 (OL5081). Access to the system is also granted to IRS employees conducting research on different types of projects at the request of W&I. These employees are granted “view only” access to those portions of the data pertinent to their projects.
3. Will users have access to all data on the system or will the user’s access be restricted? Explain.
The Distribution Channel Management level of access is determined by the need-to-know of the user. Web site users only can see (and not edit or amend) what the web site displays for them. File Transfer Protocol (FTP) users who need access to the system to provide data to the system only have access to certain directories with “change” privileges. Microsoft Structured Query Language (SQL) users are granted access to the Microsoft SQL databases, based on a need-to-know the data in these databases. Users are given read access only in order to maintain the levels of access, which control misuse of data. The developer/system administrators of DCM get RWC access. System Administrators are given full access to the Distribution Channel Management system to monitor potential abuses and to allow for a better management of user logins.
4. What controls are in place to prevent the misuse of data by those having access?
The System Administrator (SA) of Distribution Channel Management tightly controls the level of access. In FTP cases, users who provide data to the system only have access to certain directories with “change” privileges. User account logs are monitored on a weekly basis for any unauthorized activities. Web site users only can see what the web site displays for them and not change it.. The system incorporates the use of session cookies to track designated usage through the IRS Intranet system. These session cookies are not stored at the end of the web session. The system uses standard IRS Intranet banners on appropriate use and access to this site.
5a. Do other systems share data or have access to data in this system? If yes, explain.
No, currently no other system shares data or has access to Distribution Channel Management.
5b. Who will be responsible for protecting the privacy rights of the taxpayers and employees affected by the interface?
Currently, The IRS receives annual training on the Taxpayer Browsing Act of 1997 regarding unauthorized taxpayer account access. Employees are required to annually sign an Unauthorized Access (UNAX) awareness certification form. Furthermore, SQL Maintains logs of users and user actions as described in question 1. c in order to identify any misuse or UNAX violations. Persons identified as having unauthorized access are immediately removed from system'
6a. Will other agencies share data or have access to data in this system?
There is no access to Distribution Channel Management or its databases outside the IRS.
6b. How will the data be used by the agency?
The data will be used to track the progress of Electronic Return Originators (Electronic Return Originator’s). The data will be used to track quality/quantity of returns filed with the IRS. The data is checked for quality and statistical information is gathered by the DCM system to help the tax preparers file more accurately in the future.
6c. Who is responsible for assuring proper use of the data?
The Business owner and the System Administrator work in conjunction to maintain proper usage of the data.
6d. How will the system ensure that agencies only get information they are entitled to under IRC 6103? N/A
Attributes of the Data
1. Is the use of the data both relevant and necessary to the purpose for which the system is being designed?
The data available on Distribution Channel Management (DCM) is not only relevant but it also serves as the only source of information for W&I to monitor Electronic Return Originator (ERO) activities.
2a. Will the system derive new data or create previously unavailable data about an individual through aggregation from the information collected?
The system is not used to derive or create new information on taxpayers by matching taxpayer records and no additional information is placed in any taxpayer or employee record. The system does allow IRS to identify issues on the use, acceptance and error rates of forms filed down to the tax preparer level.
2b. Will the new data be placed in the individuals record (taxpayer or employee)?
No. No information on individual practioners will be placed in any practitioner file.
2c. Can the system make determinations about taxpayers or employees that would not be possible without the new data?
This system cannot make determinations about taxpayers or employees. Determinations are made about quality of the submissions and quantities in order to determine marketing strategies.
2d. How will the new data be verified for relevance and accuracy?
Refer to question 3c under “Data in the System”
3a. If data is being consolidated, what controls are in place to protect the data from unauthorized access or use?
At this time no processes are being consolidated
3b. If processes are being consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain?
At this time no processes are being consolidated.
4. How will the data be retrieved? Can it be retrieved by personal identifier? If yes, Explain.
The data is retrieved via the Distribution Channel Management intranet web site. The web application was designed using Active Server Pages and using SQL statements to retrieve information from the SQL database. The data resides in a SQL database within DCM that is updated on a weekly basis. It can be retrieved by Name, EFIN, SSN or ZIP Code of an Electronic Return Originator (ERO). Before the data is displayed, the PTIN/SSN and EFIN/SIDN cross-reference files are used to match an appropriate Electronic Return Originator (ERO) based on their EFIN.
What are the potential effects on the due process rights of taxpayers and employees of:
This system is not used to make determinations about taxpayers or employees.
4a. Consolidation and linkage of files and systems: N/A
4b. derivation of data: N/A
4c. accelerated information processing and decision making: N/A
4d. Use of new Technologies: N/A
Maintenance and Administrative Controls
1a. Explain how the system and its use will ensure equitable treatment of taxpayers and employees.
Since the system does not support compliance activities, the system has no effect on taxpayer treatments.
1b. If the system is operated in more than one site, how will consistent use of the system and data be maintained in all sites?
Since the system is operated in only one location, data consistency is not an issue. Operating the system in one location and feeding it out to users ensures that data remains consistent. There are no local procedures or requirements that can vary from location to location.
1c. Explain any possibility of disparate treatment of individuals or groups. N/A
2a What are the retention periods of data in this system?
Data retention on the system is four years (1 Current & 3 prior) as requested by the customer. The DCM retention period is generated from IRM 1.15.17 records control schedule for IT.
2b What are the procedures for eliminating the data at the end of the retention period? Where are the procedures documented?
The Distribution Channel Management Technical Help Guide documents the deletion of a snapshot year when the retention time is expired. A SQL command is manually run to delete the snapshot.
2c. While the data is retained in the system, what are the requirements for determining if the data is still sufficiently accurate, relevant, timely and complete to ensure fairness in making determinations?
There are no requirements for this, once the data is available via the Distribution Channel Management system, it never changes and the user has the ability to select the relevant snapshot year they want to view.
3a. Is the system using technologies in ways the IRS has not previously employed?
Distribution Channel Management does not use any new or emerging technologies in ways the IRS has not previously employed.
3b. How does the use of this technology affect taxpayer/employee privacy? N/A
4a. Will this system provide the capability to identify, locate and monitor individuals? If yes, explain?
Yes., the Distribution Channel Management system does not specifically monitor taxpayers, but monitors the volumes, types and rejection rates of tax practioners.
4b. Will this system provide the capability to identify, locate and monitor groups of people? If yes, explain?
Yes, the Distribution Channel Management system is designed to monitor Electronic Return Originators (EROs). The system gives W&I personnel the ability to monitor Electronic Return Originators with regard to quality and quantity on filing Electronic Returns for individuals. Statistical information is accumulated based on Electronic Return Originators (EROs).
4C. What controls will be used to prevent unauthorized monitoring?
Employees are required to sign an annual Unauthorized Access (UNAX) awareness certification. Furthermore, SQL maintains logs of users and users’ actions in order to identify any misuse or UNAX violations. Any person identified as unauthorized will immediately be removed from system
5a. Under which system of records notice (SORN) does this system operate? Provide number and name?
The following systems should be listed based upon the explanation of DCM in the PIA.
Treasury/IRS 22.062 Electronic Filing Records (for TPDS, STARS, and ELF 1544 data and related records)
Treasury/IRS 34.037 IRS Audit Trail and Security Records System (for the audit log that tracks who accesses DCM)
Distribution Channel Management falls under the 22.062 Statement of System of Record for Electronic Tax Administration.
b. If the system is being modified, will the SORN require amendment or revision? Explain. N/A
|
