Privacy Impact Assessment – Remittance Strategy for Paper Check Conversion (RS-PCC)

RS-PCC System Overview:
 
The purpose of Remittance Strategy for Paper Check Conversion (RS-PCC) project is to enable the Consolidated Campuses, Taxpayer Assistance Centers (TACs) and Revenue Officers (ROs) to electronically process paper remittances at the point of receipt. 

Using equipment at these locations, the employee will scan the check and the payment voucher.  The equipment will capture the image and necessary data on each document to a unique server.  The server forwards the data to a Federal Reserve payment system for immediate deposit.   Confirmations are returned, enabling the subsequent accounting actions to occur, including the withdrawal of the check amount and crediting payments to the taxpayer’s account.   Once the original documents enter the RS-PCC system, no access to the data is possible and no further human intervention occurs.

System of Records Number(s): 

Treasury/IRS CADE Business Master File 24.030
Treasury/IRS Audit Trail & Security Records System 34.037

Data in the System

1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)

A. The following remittance data is captured from the Taxpayer’s check:  Account Number, Routing Number, and Dollar Amount.

B. Employee uses taxpayer’s case information (acquired from IDRS):  Name Control, Taxpayer Identification Number (TIN) and Transaction Date, to submit with the payment to ensure proper processing and crediting of the payment.

C. RS-PCC user id and/ or SEID.  Standard audit trail information will be collected at employee login and used as mandated to meet security guidelines for IRS systems.

2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)

A.  Data elements provided by the IRS include: Master File Tax Code (MFT), Document Locator Number (DLN), Tax Period, Name Control, Taxpayer Identification Number (TIN) and Received Date.

B.  Data elements provided by the Taxpayer include: Check Data (Account Number, Routing Number, and Dollar Amount).

C. Data elements provided by the Employee via the scanner and/or personal computer: Check Image and Voucher Information.

D. Data elements provided by the Federal Reserve Bank (FRB) include: Deposit Ticket Number, Deposit Amount and the Item Reference Number (IRN).

3.  Is each data item required for the business purpose of the system?  Explain.

Yes, all data items are required to accurately apply or correct payments that are posted to a taxpayer’s account.

4. How will each data item be verified for accuracy, timeliness, and completeness?

Data comes directly from the taxpayer or authoritative IRS systems (IDRS).  The transaction data from the remittance and the voucher will be verified to correlate with each other before the data is sent to the server.

5. Is there another source for the data?  Explain how that source is or is not used.

This data comes directly from the original source and owner of the data, the taxpayer.  As a taxpayer presents a payment to be processed, the remittance is scanned and the data is immediately captured and processed.

6. Generally, how will data be retrieved by the user? 

Data is not retrievable by users/employees.  Once the data is captured, it is processed in a closed system with no further human intervention.

7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier? 

No, it is not retrievable at all within this system.

Access to the Data

8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?

System Administrators will have casual access to the raw data on the server as part of their administrative duties, but no changes to the data are possible.  System Administrators may be IRS employees or contractors having NACIC High Risk security clearances.

9. How is access to the data by a user determined and by whom?

Users will not have direct access to the data once it is on the server.

10. Do other IRS systems provide, receive, or share data in the system?  If YES, list the system(s) and describe which data is shared.  If NO, continue to Question 12.

The Integrated Data Retrieval System (IDRS) – IDRS is accessed to provide the RS-PCC user with any additional information about the taxpayer in order to enter the Posting Data and populate the taxpayer user screen, but this is done prior to payment processing, and is outside the confines of the RS-PCC system.

The Integrated Collection System (ICS) –ICS will assign cases to the Revenue Officers and provide access to the RS-PCC application, but this is done prior to payment processing, and is outside the confines of the RS-PCC system.

The Remittance Transaction Research (RTR) System - RTR will store remittance transaction data and images for payments processed through RS-PCC.

11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment? Yes.

12.  Will other agencies provide, receive, or share data in any form with this system?

Treasury Systems:
Central Image Research Archive (CIRA)/ Electronic Verification and Imaging System (ELVIS) – The RS-PCC system will send remittance transaction data and images to ELVIS after a payment has been processed.  CIRA/ ELVIS provides a deposit ticket and IRN information to the RS-PCC system.

Electronic Federal Tax Payment System (EFTPS) – EFTPS will assign a DLN, but does not debit the taxpayer bank account. 

Administrative Controls of Data

13.  What are the procedures for eliminating the data at the end of the retention period?

Every transaction submitted to the server from the workstations will have a timestamp on the record in the database. Data successfully or unsuccessfully transmitted is automatically purged via SQL scripts from the server and workstation at different intervals.   Paper copies of checks and vouchers are destroyed within 14 business days.

14.  Will this system use technology in a new way?  If "YES" describe.  If "NO" go to Question 15. No.
 
15.  Will this system be used to identify or locate individuals or groups?  If so, describe the business purpose for this capability.  No.

16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring. Not applicable.

17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently?  Explain.  Not applicable.

18.  Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?  Not applicable.

19.  If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?  Not applicable.