The Internal Revenue Service released long-anticipated final rules concerning the privacy of taxpayer information held by tax return preparers on January 3, 2008. (These rules are available at and were published in the Federal Register on January 7, 2008.)

The rules were issued five days before the U.S. Government Accountability Office (GAO) released a report that was exceedingly critical of the IRS's security systems for the protection of the very same tax data. See "Information Security: IRS Needs to Address Pervasive Weaknesses," GAO-08-211 (January 8, 2008), available at on the GAO site.

While the IRS may seem an unlikely place for privacy initiatives to arise, the new IRS rules represent some of the most stringent privacy rules affecting corporate America. Moreover, the IRS rules have broken new ground in two important areas: application to off-shoring and the possibility that the IRS will even preclude an individual from giving consent to certain disclosures of information.

Applicability & Effective Date

These rules most directly affect those in the tax preparation business. They also apply to—and create strict compliance obligations for—many companies providing services to companies in the tax preparation business, which may not realize that they are covered. These rules also will have a direct impact on companies wishing to outsource tax preparation services, particularly for high-income or expatriate employees. More broadly, these policy developments are well worth watching, even for those companies not directly affected.

The new rules—which take effect on January 1, 2009, at the start of the new tax year—represent the IRS's efforts to "modernize" existing privacy rules first issued in the 1970s. Although the IRS rationale for these new rules focuses on recent developments in the tax return preparation business related to electronic processing of tax data, the rules affect all aspects of the tax preparation business—including essentially all information that is gathered from a taxpayer or gathered in connection with the processing of a tax return. Accordingly, the stringent tax privacy provisions apply not only to sensitive financial information, but also to the basic contact information for a taxpayer.

Source of Immediate Criticism

The rules have generated significant controversy, with the IRS claiming they protect taxpayers and advocacy groups charging that they do not. According to the accompanying IRS press release, the new rules give "taxpayers greater protection and control over their tax return information held by tax return preparers." These rules "update disclosure and privacy laws related to preparers for the first time in more than 30 years and bring taxpayer consent requirements into the electronic age." Also, according to the IRS, the final rules "affirm a general rule in place for more than three decades that taxpayers, not the IRS, control their own tax return information held by preparers and, within appropriate limits and safeguards, taxpayers are able to direct preparers to disclose tax return information as taxpayers see fit."

Taxpayer advocates have expressed a much different view. "Congress needs to take action to guarantee confidentiality of taxpayer records because the IRS not only refused to do so, but widened existing loopholes," according to Ed Mierzwinski of U.S. PIRG. "Make no mistake, while this un-privacy rule appears to be full of high-sounding consumer consent protections, it gives tax preparers the right to collect and share detailed taxpayer dossiers with third-party marketers, as well as with affiliated companies."

The National Consumer Law Center also objects to the new rules. "Any consent form will end up as another document in the stack of papers thrust upon taxpayers during the tax preparation session," warned Chi Chi Wu of the National Consumer Law Center. "Taxpayers told to 'just sign here and here' by their tax preparers may unknowingly consent to giving up their most sensitive financial information to marketers." (See the press release available at

Key Provisions

The IRS rules address a full range of issues affecting taxpayer information. Among the key provisions are the following:

  • Generally, preparers must obtain taxpayer consent before tax return information may be disclosed to any third party or used for any purpose other than filing the return.
  • If the taxpayer consents to the disclosure and use of his information, the consent must identify the intended purpose of the disclosure, identify the recipients and describe the particular authorized disclosure or use of the information.
  • Mandatory language informs individual taxpayers that they are not required to sign the consent; that if they sign the consent, federal law may not protect their information from further disclosure; and that if they sign the consent, they can set a time period for the duration of that consent. If taxpayers fail to set a time period, the consent is valid for a maximum of one year.
  • To prevent consent requests made to individual taxpayers from being buried in fine print, the rules require the paper consent documents to be in 12-point type on 8½-by-11 inch paper and require electronic consent requests to be in the same type as the website's standard text, in order to prevent consent requests from being too difficult to read for individual taxpayers.
  • If a taxpayer declines to provide consent for an unrelated tax preparation disclosure or use, the preparer cannot make a similar consent request. The intent is to protect taxpayers from being pressured with repeated consent requests regarding the same issue.
  • In most situations where limited disclosures can be made without specific taxpayer consent, the recipient of the information will be bound by contract or law from further disclosing this information for other purposes. (This provision turns many third-party service providers into "tax preparers" under these rules.)

Restriction on "Off-Shoring"

Beyond these core provisions, two key provisions stand out. First, for perhaps the first time, there are now specific federal restrictions on the "off-shoring" of personal information. Obviously, the overall question of off-shoring has been a hot-button political topic, and one where a wide range of legislative and regulatory proposals have been made to restrict or prevent the off-shoring of personal information. Nevertheless, for the most part, no restrictions have been put into place as legal requirements, although companies certainly are well advised to conduct significant due diligence before sending sensitive information off-shore.

The new IRS rules do impose a significant restriction on off-shoring of taxpayer information. Specifically, mandatory consent from taxpayers is required if the tax information is going to be disclosed to a tax preparer or service provider located outside the United States. Absent this affirmative consent, no off-shoring may take place. While the effects of this rule will play out over the next several years, this requirement may have the effect of prohibiting the off-shoring of taxpayer information. To off-shore lawfully, companies will need to have two separate channels, one off-shore (assuming anyone consents to information going off-shore) and one domestic, for the people who do not consent. Presumably, this will create substantial economic disincentives to engage in off-shoring relationships.

Proposal to Restrict "RALs"

Next, in the context of an "Advance Notice of Proposed Rulemaking" issued at the same time as the final rule (and available at, the IRS is seeking public comment on a fascinating new proposal. The IRS is considering implementing a rule addressing "Refund Anticipation Loans," loans issued to taxpayers based on anticipated tax refunds, as well as certain similar products.

Rather than try to regulate these loans directly (because the IRS believes that it has no authority to ban these products, although it has warned consumers to avoid preparers offering loans in anticipation of refunds), the IRS is examining whether to effectively prevent their issuance through a prohibition on individuals consenting to having their information used in connection with one of these loans.

According to the proposal, the IRS is so concerned about these loans that it wants to prevent individuals from giving consent to the marketing of these loans. This unprecedented step seems to turn the general idea of individual consent on its head—instead of giving individuals control over the use and disclosure of their information, the IRS would prevent exactly this choice.

At this point, the IRS merely is "considering a proposal that tax return preparers be prohibited from disclosing or using taxpayer return information for the purpose of selling products such as RALs and similar products." Following a public comment period on this notice, the IRS will evaluate a formal proposal concerning these products.