Privacy Impact Assessment – Individual Retirement Account File (IRAF)
IRAF System Overview
IRAF is the Individual Retirement Account File, which consists of a series of runs, data records and files that are in production with links to many of the other IRS systems located at MCC, TCC, DCC, and Campuses. The IRAF receives individual IRA penalties from form 5329 submissions in electronic format and processes them through a pre-posting phase, posts the transactions, analyzes the transactions and produces output in the form of Notice data, Reports, and information feeds to other entities.
System of Record Number(s)
Treasury/IRS 24.030—CADE Individual Master File(IMF),(Formerly: Individual Master File (IMF))
Treasury/IRS 22.032—Individual Microfilm Retention Register
Treasury/IRS 22.044—P.O.W.-M.I.A. Reference File
Treasury/IRS 22.061—Information Returns Master File (IRMF)
Treasury/IRS 26.008—IRS and Treasury Employee Delinquency
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. Taxpayer: Tax data and related information pertaining to individual taxpayers Retirement penalties are posted to the Individual Retirements Accounts File. Each taxpayer account has an entity module and one or more tax modules. The entity module contains data, which describes the taxpayer as an entity and contains groups of data including Taxpayer Identification Number(s) (TIN), name, address, etc. A tax module contains records of tax liability and accounting information pertaining to the Retirement Account Penalties for one tax period. Each tax module contains groups of data including assessed penalty liability, payments and other credits, balance due amounts, manual refund checks sent, and other accounting information relating to a specific tax period.
B. None
C. Audit Trail Information: There is no direct access to IRAF data. All access is through batch files. The data viewed by authorized IRS employees is a copy of the IRAF data loaded into any of a number of other systems that have a user interface. These systems maintain the authentication and authorization required, including the use of audit trail information.
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
The taxpayer reports the data on forms 5329. After the initial filing of the forms, any changes or updates (adjustments) to a taxpayer account, whether initiated by the taxpayer or the IRS, is submitted as a transaction to post to the master file so that the file reflects a continuously updated and current record of each taxpayer’s account.
3. Is each data item required for the business purpose of the system? Explain.
Yes. The name, TIN, and address are required to identify the taxpayer’s account. The penalties, offsets, etc. reported on the tax return, as well as any payments received, are required to settle the taxpayer’s account, and maintain a record of penalties assessed, abated and collected.
4. How will each data item be verified for accuracy, timeliness, and completeness?
The front-end input systems (Integrated Submission and Remittance Processing (ISRP), e-file, Generalized Mainline Framework (GMF), etc) validate and correct data entries. The IRAF process reformats this information for processing and storage. The front-end systems adhere to the established (and published) input and posting cycles to ensure that forms received from the taxpayers are processed, validated and posted to the Individual Retirements Accounts File within required time frames.
5. Is there another source for the data? Explain how that source is or is not used.
Yes. Institutions offering IRA accounts are required to report events resulting in potential penalty situations (i.e. early withdrawal) to the IRS. These information returns are processed in Information Returns Processing (IRP). The data in IRMF is used for compliance activities, while the IRAF is for voluntary compliance and for recording penalties assessed as the result of IRA compliance activities.
6. Generally, how will data be retrieved by the user?
IRAF data is not directly accessible by users. Data is extracted on a weekly basis for reports and for loading into other IRS systems, which provide read-only access to the data (on a need to know basis).
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Yes, by name and SSN (or other TIN).
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Authorized IRS personnel and contract program developers, as well as IRS organizations developing managerial and statistical reports.
9. How is access to the data by a user determined and by whom?
Data access is granted on a need to know basis. A potential user must submit a request for access form (5081) to their local management for approval consideration. Users are not permitted access without a signed 5081 form from an authorized management official.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 1.
Yes. All settlements with taxpayers are affected through computer processing of the IRAF account and the data therein is used for accounting records, for issuance of refund checks, bill or notices, answering inquiries, preparing reports and other matters concerned with the processing and enforcement activities of the IRS.
Initial inputs to IRAF for each tax period are processed by a front-end input system (i.e. ISRP, e-file, etc.). These systems interface with the Generalized Mainline Framework (GMF), which provides the data to the IRAF processing system.
Subsequent inputs are transactions that can originate in any number of IRS processing systems. Generally these system interface with the Integrated Data Retrieval System (IDRS)/ Integrated Case Processing (ICP) system processing runs which include End-of-Day (EOD) runs which validates the data before submitting to the IRAF for posting.
Any input (initial or subsequent) which is unable to post to the master file for any reason, is returned to the originating system via the Generalized Unpostable Framework (GUF) for correction.
Posted data is replicated for use in other IRS processing systems. There are several files that contain extracts of entity data that are used in validation for processing or for employee access as a research tool in answering taxpayer inquiries or resolving compliance issues. These include the National Account Profile (NAP), the Taxpayer Index File (TIF) and the Name Search Facility (NSF).
MFTRA processing accesses the IRAF directly. Other systems that receive IRAF data do not access the IRAF directly, but receive a file generated by IRAF OUTPUTS. These include IDRS, Automated Collection System (ACS), and reports.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
The mainframe system that provides the processing and storage capabilities for the tax processing system, including the Information Returns Processing System (IRP; IRMF and PMF), as well as Business Master File (BMF), Individual Master File (IMF), and Individual Retirement Accounts File (IRAF) is preparing to under go security testing and is expected to receive certification in November 2003.
12. Will other agencies provide, receive, or share data in any form with this system?
No. Financial Management Service (FMS) receives IRAF data through manual refund processing for those accounts that have overpaid their liability.
13. What are the procedures for eliminating the data at the end of the retention period?
None. There is currently no elimination of data at the end of the retention period.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
Yes. The business purpose is to identify and locate taxpayers who are not incompliance with federal income tax and penalty filing and payment requirements.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
Yes. This capability is the result of maintaining the repository of this data, combined with the ability to perform data extracts. Extracts are performed only based on an approved request for information services.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. The master file data allows IRS to ensure that taxpayers are treated equally. The automated method of generating notices based on specific criteria eliminates the possibility of one taxpayer receiving preferential treatment over another. The IRAF also enables all taxpayer to receive the notifications that are applicable to them when there is a change in IRAF penalty tax law.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
Yes. The IRAF records the issuance of statutory notices.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors? n/a
| 
