Privacy Impact Assessment – Garnishments (GARNISH)
GARNISH System Overview
Garnishments (GARNISH) is a database driven reporting function used to track all hard copy incoming documents in relation to court-ordered garnishments for IRS employees. The database driven reporting function can produce reports indicating the status of IRS employee wages for individuals that owe a liability (any debt owed outside of taxes). The application runs on a Windows NT 4.0 server with Service Pack 6a. GARNISH has a limited number of internal users who input data into the database through forms created in Microsoft ACCESS. All information within the Form record is input manually by employees of the Special Processing Branch. It provides total incoming caseload and pending case status reports. Reporting functions allow management to review case numbers for status of wages garnished.
Systems of Records Number(s)
Treasury/IRS 36.003 General Personnel and Payroll Records
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. N/A
B. During an employee garnishment proceeding, the following employee case information is recorded and stored for each case:
* Last Name
* First Name
* Social Security Number
* Grade
* EE (Employee) Job Series
* Court Case Number
* Case ID
* SON number (Submitting Office Number)
* Garnishment Type
* Received Data
* Type (i.e., Type of Garnishment: New, Modification, Termination, etc.)
* Special Alert - *see below
* Specialist Assigned to/Name, Extension
* Dates (i.e., for various events)
* Year Inactive, Re-Activated
* Archive, Remarks, History and Case Notes
* Year closed
* Amount owed
* Name of organization that sent the processing fee
Other stored data includes:
* Cash Amount
* Check Number
* Check
* Check Amount
* Amount Owed on Order
C. For authentication and auditing data, users of GARNISH must enter the following credentials to access the system:
* Username
* Password
Additional audit data is also used by GARNISH to record updates, deletions, or insertions to the database table. Only successful events are logged in the audit table. Unsuccessful events trigger a system generated response.
Recorded audit items include:
* Case ID
* Who did it (i.e., user ID of the individual whom executed an event)
* When (i.e., time and date stamp)
* What (i.e., type of event performed such as a table update, delete, or insert)
* Audit Number
D. Court and Court related data from documents provided to the court from individuals (e.g., creditors, and attorneys) (see question 6).
Other data items from a previous version of GARNISH currently reside in the database although those items are not used and are only available to GARNISH users on a read-only basis. Those data include:
* Various Time and Date Stamps
* Clerk Assigned to
* Office Code
* Region Code
* Case ID2
* Special Alert – is a check box within the database that is used to reflect “questionable” garnishments. It is checked manually by IRS employee who works the case in situations to be marked as a “difficult” case. For example, receiving a Chapter 13 bankruptcy that has multiple last names for the customer on the court order and those last names are not reflected within the IRS’ payroll system. It is used for internal purpose only and is not sent outside the Special Processing Branch office.
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A. Data collected includes items listed in sections 1A and 1B above. These data elements are collected from hardcopy files. Users manually enter data into the GARNISH Microsoft ACCESS Form record.
B. N/A
C. IRS employees undergoing Garnishment proceedings may return forms or other correspondence through the mail to the IRS. The Treasury Integrated Management Information System (TIMIS) is used to research salary information of employees, then a hard copy is printed to manually input needed information into the GARNISH database.
D. Federal courts provided data concerning IRS employee court-ordered garnishment status and supporting information that Special Processing Branch users must manually enter into the GARNISH system.
E. N/A
F. Third party sources of data are received from the Courts.
3. Is each data item required for the business purpose of the system? Explain.
Yes. Data items are required for the business purpose of the system.
4. How will each data item be verified for accuracy, timeliness, and completeness?
ALERTS will perform the following validations on the incoming transactions from GARNISH:
1. Validate that the Employee’s SSN is on TIMIS (TAPS)
2. Validate that the source-id (Court Case Number) does not already exist on ALERTS
3. That Issue1 (required) is populated and is valid
4. That if Issue2 and/or Issue3 (optional) are populated, that they are valid.
A GARNISH Quality Control Reviewer reviews 10% of each Specialist’s work monthly. Other than that, data verification and review is completed manually.
5. Is there another source for the data? Explain how that source is or is not used.
No. GARNISH users must manually input data from court ordered documents, legal documents, TIMIS records, and any other court-related documents and hardcopy correspondence from individuals (e.g., creditors, attorneys and courts).
6. Generally, how will data be retrieved by the user?
Only authorized GARNISH users may access the database and audit table. Data is retrieved through Microsoft ACCESS Forms via search criteria (i.e., to retrieve a specific record or a set of records). ALERTS personnel can retrieve GARNISH data through the extract file that is transmitted on a bi-weekly basis.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
GARNISH data is housed in a Microsoft ACCESS database and can technically be retrieved (via user-defined search criteria) by any field available field on the Form. Typically users may retrieve records by Social Security Number or Case ID. Audit table data can also be retrieved by Case ID.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Authorized Special Processing Branch users will have access to the GARNISH system. Currently, GARNISH has a limited number of internal users who can input data into the database through Microsoft Access Forms. Only Administrators are authorized to alter the structure of the database and modify configuration settings. The Microsoft ACCESS internal security function manages all restrictions to the application and the workgroup information file ensures that the access permissions granted to users are implemented correctly.
9. How is access to the data by a user determined and by whom?
Only users who have been selected by system owner are given access to the GARNISH application. GARNISH users are granted a unique username and password combination upon being identified by management as an individual requiring access to GARNISH to perform their work function. Administrators grant permissions on a “need to know” basis with least privilege as a top priority. All users must then authenticate prior to using the functionality offered by GARNISH.
Two groups exist for GARNISH: “Users” and “Administrators”. Users are only permitted to update, insert, and delete data that resides within the tables through Forms created by Administrators. Only Administrators can make changes to tables, reports, queries, and data; as well as assigning database, user, and group permissions within GARNISH.
When a user or administrator no longer requires access to GARNISH or upon termination; the system owner initiates the prescribed process to remove that person’s account from the application on or within several days after the employee no longer requires access.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Employee garnishment data is received from hardcopy files. Court Ordered Garnishment case information is manually keyed in the appropriate Microsoft ACCESS Form record by Special Processing Branch employees. Hardcopy files are contained within a locked file cabinet and in a locked room.
The GARNISHMENT Office reviews the transactions and flags those that are to be forwarded to HCO ALERTS. Then the GARNISHMENT Office runs a process that creates an extract file of transactions flagged for ALERTS. GARNISH users send these reports to the ALERTS application via FTP on a bi-weekly basis (i.e., on the Monday of the first week in a pay period). The following transmitted data include:
* Social Security Number
* Court Case Number
* Interface Header data
The following criteria are used to send information to ALERTS (i.e., the ALERTS box is checked in GARNISH):
* IRS employees who are Revenue Agents (RA) with a "new" commercial garnishment
* IRS employees who are Revenue Officers (RO) with a "new" commercial garnishment
* Criminal Investigations (CI) with a "new" commercial garnishment
* Whenever Federal, State, or Local debts are involved (e.g., taxes, federally secured student loans)
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
The ALERTS application received a Certification on June 24, 2005 with an IATO (Interim Authorization To Operate).
The ALERTS application received an approved PIA on March 3, 2005.
12. Will other agencies provide, receive, or share data in any form with this system?
Data may be shared, in accordance with the business purpose of the system, with Federal Court System, State Courts, Child Support Agencies, and Family Support Agencies.
There are no systemic interconnections between GARNISH and systems that are external to the IRS.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
Internal Revenue Manual 1.15.3.1-1 in the Record Disposition Handbook establishes how long various types of records must be retained.
However, no procedures are maintained in regards to GARNISH data elimination. The hardcopy retention period is 6 years. Hardcopy files are contained within a locked file cabinet and in a locked room.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15.
No. The GARNISH system is not using technology in a new way.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
Yes. The GARNISH database allows users to determine/locate if a court-order garnishment has been served against an IRS employee’s wages.
Individuals can be located using data retrieved from GARNISH for business purposes and due process purposes only. Individuals can be identified by name and SSN. The employee’s grade and series may also be used as supplemental identifying information.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
No. The GARNISH system cannot be used to track individuals. GARNISH only monitors the status of the court ordered employee garnishments.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. Utmost confidentially and sensitivity is used by those with GARNISH access to assure Employee privacy rights are protected.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
Yes. However, pursuant to Title 5 Code of Federal Regulations, Part 581, Appendix A, the Special Processing Branch is responsible, by law, to supply what information is available to us upon request. Hence, affected parties (e.g., potentially garnished employees) may not have the ability to respond or correct information prior to the release of requested records.
In order for a garnished IRS employee to modify or correct personal information or garnishment status, they must supply a valid court order or legal document (e.g., state compliance official, state child support office, etc.) to change the status of an employee Garnishment case.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
No. GARNISH is not a web-based system.
|
