Privacy Impact Assessment – Temporary Scrambled SSN
TMPSSN System Overview:
The TMPSSN project enables IRS employees to assign Internal Revenue Service Numbers (IRSNs) when a Taxpayer Identification Number (TIN) is not available. Research is performed prior to assigning an IRSN in order to locate a valid TIN or IRS Individual Taxpayer Identification Number (ITIN). After issuing the IRSN on the TMPSSN database, the employee establishes the taxpayer account on the Individual Master File (IMF).
The TMPSSN project enables IRS caseworkers to maintain the most current and complete taxpayer entity information. Caseworkers assign IRSNs for a variety of reasons including the following:
a. For payments;
b. For scrambled conditions (same Tax Identification Number (TIN) issued to at least two different taxpayers by the Social Security Administration (SSA));
c. For returns where the tax filer failed to use their TIN.
System of Records Number(s):
Treasury/IRS 24.046 CADE Business Master File (BMF)
Treasury/IRS 24.030 CADE Individual Master File (IMF)
Treasury/IRS 34.037 IRS Audit Trail and Security Records System
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. Taxpayer:
Taxpayer Entity data input from the Temporary Scrambled SSN (TMPSSN) process is used to establish taxpayer accounts on the Individual Master File (IMF). Each taxpayer’s account has an entity module and one or more tax modules. The taxpayer’s entity information contains data such as their Taxpayer Identification Number (TIN), name, address, spouse’ s name and TIN, Filing Status Codes (FSCs), etc.
B. Employee:
The TMPSSN project enables IRS caseworkers to maintain the most current and complete taxpayer entity information. The Entity Control Unit (ECU) receives and processes requests for Internal Revenue Service Numbers (IRSNs). A TMPSSN is assigned only after “complete research” has been conducted on the IRS’s Integrated Data Retrieval System (IDRS) by employees to ensure that no other number (i.e., IRS Individual Taxpayer Identification Number (ITIN), Social Security Number (SSN) or IRSN is available for the individual taxpayer.
C. Audit Trail Information:
Users that are granted access to the TMPSSN application are required to use their name and password. Audit trail functionality is also provided by the host platform. Also, IDRS is reviewed locally by management and IDRS security.
D. Other: None
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A. IRS: Taxpayer Information is obtained from taxpayer-supplied payments, returns, correspondence, W-2s, etc. This information is used to assign the IRSN (if needed) for processing the taxpayer return/payment.
B. Taxpayer: See A
C. Employee: Employees logon to host platforms (i.e., IDRS) which provide authentication and authorization functionality. This information is traced via audit trails on the 5081 system. The audit trails contain the employee’s number, which is used by IDRS to assign tax cases to individual employees and track taxpayer correction processes.
D. Social Security Administration (SSA). IRS receives weekly files that are utilized to update IRS entity records.
E. None.
F. None.
3. Is each data item required for the business purpose of the system? Explain.
Yes. The data elements contained in the TMPSSN are necessary to assign an IRSN, identify the taxpayer, and subsequently establish the taxpayer on IMF. If two taxpayer’s share an SSN, the TMPSSN assists in the continuation/processing of the taxpayer’s return/payment.
4. How will each data item be verified for accuracy, timeliness, and completeness?
The TMPSSN system is used as a pre-cursor to correctly establish/research a taxpayer’s account before establishing the IMF.
The TMPSSN User Guide assists to ensure employee completeness and accuracy levels. Maintaining timeliness is maintained with the Weekly Entity Control Automated Inventory Reporting (WECAIR) Program.
5. Is there another source for the data? Explain how that source is or is not used.
TMPSSN is a compilation of entity data that is maintained in a single repository. Source information. See 4.
6. Generally, how will data be retrieved by the user?
IRS employees can access and print TMPSSN reports and “screen prints” of individual cases. IRS employees access the TMPSSN and are authenticated as users. Users must have an account established with appropriate managerial authorization. Each ECU account profile determines their IDRS access level. Employee access is granted on a “need to know” basis.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
TMPSSN data can be researched by the taxpayer’s TIN, name, address, Date of Birth, etc.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Business Operating Division employees (Customer Service Representatives, Revenue Agents, Tax Examining Assistors, etc.) have access to the IRSN after establishment of the taxpayer’s account on IMF. Authorized IRS personnel, oversight auditors, contract developers, as well as IRS organizations developing managerial and statistical reports have access to the taxpayer’s Entity (when necessary).
9. How is access to the data by a user determined and by whom?
The completion of Form 5081 is required for all TMPSSN users prior to gaining access to the TMPSSN application. In addition, data access on the system and within the application is restricted through the use of permission levels and access controls. Also, audit trails are used to prevent unauthorized monitoring.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes. TMPSSN provides an IRSN that is used to “post” accounts to IMF. The TMPSSN can also be related to the Business Master File (BMF) for specific BMF taxpayer issues.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
Yes. The platforms that provide the processing and storage capabilities for the tax processing systems are tested and certified by the IRS Security Certification Office. In order for the individual applications to be certified (as running on a certified platform), require a Privacy Impact Assessment (PIA).
12. Will other agencies provide, receive, or share data in any form with this system?
Yes. TMPSSN, when used to establish a taxpayer account, supplies and maintains taxpayer entity information. The IRS, in turn, provides the SSA taxpayer address information for taxpayer benefit statements.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
N/A Taxpayer Information is not eliminated on the TMPSSN. If a valid TIN/ITIN is received, the account is updated with the replacement information. However, the TMPSSN, is still available but is replaced by a taxpayer SSN or ITIN.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
Yes. TMPSSN is designed to assist IRS tax administration employees in the performance of their duties. In order to post taxpayer payments/returns, the TMPSSN system assigns the IRSN. The TMPSSN also provides research capabilities for individuals prior to assigning an IRSN.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
Yes. The TMPSSN is used to research and locate an individual’s taxpayer account. Also see 9.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain. No
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action? N/A
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors? N/A
| 
