PIA Approval Date: March 29, 2007
(RETREF) System Overview:
The purpose of the Form 3911-3913 application is to allow authorized users the ability to access, research, and update application information that is needed to complete the process commenced by the filing of the respective form or returned refund by a taxpayer. When a Taxpayer returns a Refund Check to the Internal Revenue Service (IRS), a Form 3913 is mailed to the Taxpayer to confirm receipt of the check (Returned Refunds). A Taxpayer submits a Form 3911 to IRS to report that a Refund Check was lost, stolen, destroyed, or not received (Missing Refunds).
System of Records Number(s) (SORN) #:
Treasury/IRS 24.062 Electronic Filing Records
Treasury/IRS 36.003 General Personnel and Payroll Records
Treasury/IRS 34.037 IRS Audit Trail and Security Records System
Data in the System
- Describe the information (data elements and fields) available in the system in the following categories:
- Taxpayer - The taxpayer sensitive but unclassified data that is transmitted includes name, taxpayer identification number, spouse's name, street address, and data that needs to be retrieved from a previous filing authorizing a Power of Attorney. The individual filing the form is also asked to provide the address of their bank and the account number given to them by their financial institution if for direct deposit.
- Employee - Employee information is name, telephone number, and employee identification number. Both Forms 3911 and 3913 generate a control file that maintains a record of all the taxpayer forms sent to any IRS Center. The software then downloads to the Integrated Data Retrieval System (IDRS) and assigns cases to specific tax examiners, and prints a letter to the taxpayer acknowledging the receipt of their Form and listing the name along with a telephone number of the designated tax examiner.
Form 3911 requests SBU information such as the individual's tax identification number, name, address, financial institution and account number if for direct deposit, designated power of attorney (if relevant), type of refund, and the amount requested by the filer of this form. A Form 3913 is generated acknowledging receipt of the individual's returned refund check. The application then establishes a control file to keep a record of all Form 3913's sent to the taxpayer. Each case is assigned to a particular employee number of a designated tax examiner.
- Audit Trail Information (including employee log-in info) - The Informix database also has inherent security features, such as stored procedures and "triggers" that can watch and audit processes as they access the data/application. Also there exists a level of cohesion with the operating system to provide only authorized access to database-related applications and tools. User activity are recorded in the audit logs and reviewed by system administrators.
- Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
- IRS - Nightly Ace programs named “acca13” and “acca11” each create a file of all new records entered that day into the Form 3913 and Form 3911 tables. The outputs are concatenated, written to 9-track tape, delivered to the 2200 Computer Room, and read into the Case Control Activity (CCA01) Application. This process creates an open Case Control record on the Integrated Data Retrieval System (IDRS).
- Taxpayer - The Form 3911-3913 Application is hosted by an IBM Sequent NUMA-Q Enterprise Server running the DYNIX/ptx operating system, Version 4.4.2. The application is executed by an Informix-SQL Database, Version 7.30UC6. The Informix database contains two distinct tables, one to process and track Form 3911 taxpayer submissions, and one to process Form 3913s for mailing to taxpayers.
- Employee - Employee information is name, telephone number, and employee identification number. Both Forms 3911 and 3913 generate a control file that maintains a record of all the taxpayer forms sent. The software then downloads to the Integrated Data Retrieval System (IDRS) and assigns cases to specific tax examiners, and prints a letter to the taxpayer acknowledging the receipt of their Form and listing the name along with a telephone number of the designated tax examiner.
- Other Federal Agencies (List agency) - None
- State and Local Agencies (List agency) - None
- Other third party sources (Describe) - None
- Is each data item required for the business purpose of the system? Explain.
Yes. The purpose of the Form 3911-3913 application is to allow authorized users the ability to access, research, and update application information that is needed to complete the process commenced by the filing of the respective form or returned refund check by a taxpayer.
- How will each data item be verified for accuracy, timeliness, and completeness?
Information is submitted directly from the taxpayer and is assumed to be accurate. The data within the system are vital records, submitted by the taxpayer that must always be considered sensitive, and always subject to stringent security requirements already discussed in earlier segments of this PIA.
- Is there another source for the data? Explain how that source is or is not used.
No. RETREF does not collect data from sources other than IRS records.
- Generally, how will data be retrieved by the user?
Data will be retrieved when the Taxpayer Identification Number is entered as prompted by the Employee Screen appearance. The appropriate users are then granted their assigned level of access and are given permission to the files they need to access in their directory.
- Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Yes. Data will be retrieved when the Taxpayer Identification Number is entered as prompted by the Employee Screen appearance. The appropriate users are then granted their assigned level of access and are given permission to the files they need to access in their directory. Form 3911 requests SBU information such as the individual’s tax identification number, name, address, financial institution and account number if for direct deposit, designated power of attorney (if relevant), type of refund, and the amount requested by the filer of this form.
Access to the Data
- Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
IRS Employees-Production Users, Managers, User Administrators. Users and Managers in the RETREF Units have access to data in the system. Access to the data is determined by the Manager based on a user’s position and need-to-know basis as part of his/her official duties. Every User of the RETREF application must submit a 5081 request for access to RETREF at Enterprise Computing Center - Memphis (Tenn.) ECC- MEM.
RETREF Roles are as follows:
- A Production User or two who will input data into the system each day
- A Lead who oversees the application (and serves as backup for the Clerk), and
- A Manager to review the RETREF reports (and serves as backup for the Lead).
- System Administrators have access to the data, system files, and functions required to carry out their assigned tasks and responsibilities. And, TIGTA and GAO in there official capacities.
- How is access to the data by a user determined and by whom?
Access to the Form 3911-3913 is restricted for security purposes and privacy data propagating through it that affects taxpayer security is treated as such. The protection inherent in the Windows 4.0 NT and the DYNIX/ptx operating systems, and the procedures enforced by the system administrators facilitates the mitigation of potential vulnerabilities.
- Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes. Form 3911-3913 portions of the application perform the function of establishing control files to keep a record of all Forms 3911s received and Forms 3913s generated and sent by the centers. They are downloaded to IDRS. In addition, Form 3911-3913 data is transmitted daily to the CCA01 residing at ECC-MTB.
- Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
Yes.
- Will other agencies provide, receive, or share data in any form with this system?
No. RETREF does not share data with any other agency (international, federal, state, local).
Administrative Controls of Data
- What are the procedures for eliminating the data at the end of the retention period?
In accordance with IRM 1.15.29, data in the system is archived, not eliminated. On a daily basis, Form 3911-3913 data is transmitted to the CCA01 at ECC-MTB.
- Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15.
No.
- Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
No. Capability does not exist to identify or locate individual users as part of a group because users are only assigned individual user accounts.
- Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
No. Capability does not exist to monitor individual users as part of a group because users are only assigned individual user accounts.
- Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. There is no disparate treatment of individuals or groups as Form 3911-3913 application processes information central towards all users attaining the same goal, accurately handling the processing of all tax refund requests and returns.
- Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
No. There are no affects on the due process rights of taxpayers and employees. The Form 3911-3913 application does accelerate the processing of information, allowing the designated tax examiner to make informed and faster decisions that wouldn't be possible without the utilization of this application.
- If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
RETREF is not a web-based system.
|
