Privacy Impact Assessment – Returned Refunds
Returned Refunds System Overview:
This program tracks correspondence received from taxpayers concerning lost, stolen, destroyed or returned refunds. Information from Forms 3911 and 3913 is entered into the application. The software then downloads to the IDRS system, assigns cases to specific tax examiners in the Refund Inquiry Unit, and prints a letter to the taxpayer acknowledging the receipt of their Form and providing contact information for the Examiner assigned the case.
System of Records Number(s):
Treasury/IRS 24.030 CADE Individual Master File
Treasury/IRS 24.046 CADE Business Master File
Treasury/IRS 42.021 Compliance Programs and Project Files
Treasury/IRS 34.037 IRS Audit Trail and Security Records System
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
Taxpayer – sensitive but unclassified (SBU) data includes: name, taxpayer identification number, spouse’s name, street address, financial institution and account number and any “Power of Attorney” information pertinent to the request.
Employee – employee number and user name of a designated tax examiner
Audit Trail – Form 3911-3913 application, provides the ability to identify, locate and monitor IRS users. Users are granted limited access based on their job specification. User activity is recorded in the audit logs and reviewed by system administrators.
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A.) Nightly, Ace programs named “acca13” and acca11” create a file of all new records entered that day. The data is transmitted via FTP to MCC/TCC to the Case Control Activity (CCA01) Application. This creates an open Case Control record on IDRS.
B.) The taxpayer supplies name and contact information on Forms 3911 and 3913.
There is no interaction with other Federal or State Agencies.
3. Is each data item required for the business purpose of the system? Explain.
Yes – data is required to generate letters, establish and create IDRS control files and prepare a document for shipping.
4. How will each data item be verified for accuracy, timeliness, and completeness?
Initial information comes from the taxpayer. Applications with incomplete fields are researched and if information isn’t available in IRS files, the requestor is contacted and asked to complete the request.
5. Is there another source for the data? Explain how that source is or is not used.
No other source of data
6. Generally, how will data be retrieved by the user?
Data will be retrieved by taxpayer name or TIN.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier? Yes.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Only individuals who have been identified in the application’s database table with a “need-to-know” are authorized to access the application. These users are IRS employees responding to taxpayer queries.
Managers, Security Administrators, and developers have access to the data, system files, and functions required to carry out their assigned tasks and responsibilities.
9. How is access to the data by a user determined and by whom?
IRS Form 5081 will be used for proper verification of “need-to-know” in order to gain access to network devices and access to data residing on the application.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes, the “Form 3911-3913” portions of the application perform the function of establishing control files to keep a record of all submitted Forms 3911 and Form 3913.
Data is transmitted daily to the Case Control module of IDRS residing at TCC.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment? Yes.
12. Will other agencies provide, receive, or share data in any form with this system?
No other agencies will be accessing or sharing data residing on the application.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
On a daily basis, form 3911-3913 data is transmitted to Case Control module of IDRS at TCC.
Data in the system is archived in accordance with IRM 1.15.29
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
No. This system exists to coordinate inquiries about lost or misdirected tax refunds about which taxpayers have made inquiries.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring. No.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. This system exists to coordinate inquiries about lost or misdirected tax refunds about which taxpayers have made inquiries
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
No determination is made by using this program. All tax refund requests and returns are treated equally.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
Not web based.
| 
