CCA 201120002: section 6103 controls redisclosure of motor vehicle records obtained for tax administration

Plain-English summary

Chief Counsel Advice addressed whether IRS access to Indiana motor vehicle records would be subject to state-law redisclosure and breach-notification requirements. It advised that once a motor vehicle record is collected by the IRS for tax administration, it becomes return information subject to the confidentiality and disclosure rules of IRC § 6103. The advice concluded that section 6103 preempts conflicting, more general redisclosure safeguards under the Driver Privacy Protection Act and Indiana law. It also concluded that the IRS must follow federal law and OMB guidance for breach notifications, so the state agreement's provision requiring the IRS to pay for all notices was unnecessary. The advice was based on the described government account agreement and did not address unrelated tax consequences.

Ruling snapshot

• Question: Do IRC § 6103 and federal breach-notification rules control IRS use of Indiana motor vehicle records?
• Outcome: Advice given.
• Key authorities: IRC §§ 6103, 7213, 7213A, 7431, and 7803; 18 U.S.C. § 2721; 5 U.S.C. § 552a.

Full text (IRS public release)

Office of Chief Counsel
Internal Revenue Service
Memorandum
Number: 201120002
Release Date: 5/20/2011
CC:PA:07:ALMielke
GL-149712-10

UILC: 6103.01-00

date: February 15, 2011
to: Associate Area Counsel (Indianapolis) (Small Business/Self-Employed)

from: A. M. Gulas
Senior Counsel, Branch 7
(Procedure & Administration)

subject: Tracking the Redisclosure of Personal Information Obtained by the Internal Revenue Service from a State Department of Motor Vehicles

Issues

1. Whether the IRS is subject to the redisclosure provisions within the Driver Privacy Protection Act of 1994 as incorporated into the Indiana Code.

2. Whether paragraph 4 of the standard Government Account Agreement regarding state law notification requirements is necessary in light of the more specific federal authority that governs disclosure and breach notification.

Answers

1. Once an individual’s IN BMV record is collected by the IRS for tax administration purposes, it becomes return information under section 6103 subject to very stringent rules protecting the data from unauthorized access or disclosure. Thus, the specific rules regarding access and disclosure set forth within section 6103 preempt the more general rule set forth in the Driver Privacy Protection Act.

2. The IRS follows federal law and OMB guidance concerning disclosure of breach notifications. As a result, paragraph 4 of the standard Government Account Agreement is unnecessary given that the federal authorities governing breach notification supercede the state law breach notification requirements.
GL-149712-10
2

Facts

Currently, the IRS is working on a Government Account Agreement (Agreement) with the State of Indiana that will allow IRS personnel computer access to the Bureau of Motor Vehicles (IN BMV) computer database. The state’s standard “enhanced” agreement, which allows access to personal information, includes both recordkeeping requirements regarding the redisclosure of such information and consent to an on-site audit of such records.

The IN BMV database contains “Personally Identifiable Information” (PII). The IN BMV is concerned with maintaining the security and privacy of those individuals who have PII in the IN BMV database. The IRS obtains motor vehicle registration and lien information from the IN BMV primarily in the course of performing collection investigations. The information is used to determine whether there is sufficient equity in vehicles to warrant seizure and sale to satisfy outstanding tax liabilities.

The Driver Privacy Protection Act of 1994, 18 U.S.C. § 2721 et seq. (DPPA), provides federally imposed restrictions on state motor vehicle bureaus regarding to whom personal information may be disclosed. The DPPA also imposes restrictions on an authorized recipient’s redisclosure of personal information.

In reviewing the draft Agreement, you have inquired whether the IRS should have in place safeguards to comply with the redisclosure provision of the DPPA. In addition, you have asked whether paragraph 4 of the Agreement regarding Indiana state law notification requirements is necessary given the more specific federal authority that governs disclosure and breach notification.

Because of the concerns raised by these issues, you have requested that we opine on the matter.

Analysis

Section 6103(a) states that returns and return information are confidential and cannot be disclosed except as authorized by Title 26. “Return information” is defined in section 6103(b)(2) as “a taxpayer's identity,1 the nature, source or amount of his income…” and includes any “data, received by, recorded by … furnished to, or collected by the Secretary with respect to … the determination of the existence, or possible existence of liability (or the amount thereof) … of any person under this title for any tax…”.

1
Section 6103(b)(6) defines “taxpayer identity” as “the name of a person with respect to whom a return is filed, his mailing address, his taxpayer identification number …, or a combination thereof.”
GL-149712-10
3

IRS employees may access BMV records for a number of tax administration purposes. For example, they may identify or locate assets to seize to satisfy federal tax liens or identifying assets that would suggest a taxpayer is underreporting the amount of his income. Once the BMV record becomes a part of a tax investigation, i.e., is received by the IRS, it is return information subject to very stringent rules protecting the data from unauthorized access or disclosure.

There are exceptions to the general confidentiality rule authorizing the IRS to disclose return information, but Congress included each of these exceptions within the statute after careful consideration as to the need for the disclosure to implement federal programs or further federal interests. For example, section 6103(h)(2) authorizes the IRS to make disclosures to the Department of Justice for use in tax administration investigations such as grand jury investigations into tax fraud or other Title 26 offenses. The legislative history of section 6103 evidences Congressional intent that “the Justice Department is to continue to receive returns and return information with respect to the taxpayer whose civil or criminal tax liability is at issue.” GENERAL EXPLANATION OF THE TAX REFORM ACT OF 1976, H.R. 10612, 94th Cong. 2d Sess., 320 (JCT Print 1976). Thus, a BMV record collected by an IRS employee, which now has the characterization of return information, might be disclosed to Justice as part of the tax investigation file and be used as evidence to demonstrate unreported income.

Section 6103’s confidentiality requirements are buttressed by criminal and civil sanctions. If an IRS employee knowingly makes an unauthorized access of return information (called a UNAX), that employee can be prosecuted under section 7213A, and, if convicted, face a prison term of up to one year, a fine and loss of employment. An IRS employee who knowingly makes an unauthorized disclosure of return information, if convicted of a violation of section 7213, can face imprisonment of up to 5 years, a fine and loss of employment. In addition, section 7431 creates a cause of action for a taxpayer to sue the United States for damages (including punitive damages) if the taxpayer can prove there was a knowing or negligent unauthorized disclosure of, or access to, his returns or return information.

1. Section 6103 preempts the DPPA to the extent they conflict

The DPPA provides federally imposed restrictions on state motor vehicle bureaus regarding to whom personal information may be disclosed. The DPPA also imposes restrictions on an authorized recipient’s redisclosure of personal information.

18 U.S.C. § 2721 (b) provides, in relevant part in regard to the Service’s activities, that the state may disclose personal information for the following purposes:

(1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.
GL-149712-10
4

….
(4) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court.

Both of these paragraphs contemplate that a federal agency will need to use the BMV records for its official duties. Regarding redisclosure of personal information, 18 U.S.C.
§ 2721 (c) provides as follows:

Any authorized recipient ... that resells or rediscloses personal information covered by this chapter must keep for a period of 5 years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and must make such records available to the motor vehicle department upon request.
(Emphasis added)

(emphasis added). In turn, Indiana has implemented these federal requirements at IND. CODE § 9-14-3.5-13(d) (1996), which provides that “except for a recipient under section 1O(11) of this chapter, a recipient who resells or re-discloses personal information is required to maintain and make available for inspection to the bureau, upon request, for at least five (5) years, records concerning: (1) each person that receives the information; and (2) the permitted use for which the information was obtained.”

The DPPA and IN statute provide restrictions on an authorized recipient’s redisclosure of PII. As noted above, section 6103 provides the general rule with respect to confidentiality and disclosure issues related to tax returns and tax return information. Once an IN BMV record is collected by an IRS employee, it has the characterization of return information, subject to very stringent rules protecting the data from unauthorized access or disclosure, including an accounting for certain redisclosures. See I.R.C.
§ 6103(p)(3). Moreover, once the BMV record becomes part of an IRS file, it is subject to the record-keeping procedures for that file. To the extent that the DPPA and IN statute impose conflicting safeguard or record-keeping procedures for the redisclosure of PII (such as access to IRS records by state employees), those provisions are ineffective.

As a general rule, a precisely drawn, detailed statute, will preempt more general remedies. Jett v. Dallas Indep. School Dist., 491 U.S. 701, 733-34 (1989)(quoting Brown v. General Svcs. Admin., 425 U.S. 820, 834 (1976)). For example, in Hobbs v. U.S., the Fifth Circuit Court of Appeals found that section 6103, which permits disclosure of tax return information in a proceeding pertaining to tax administration, is a more detailed statute and should therefore preempt the conflicting provisions of the Privacy Act, because the Privacy Act provisions are more general. 209 F.3d 401, 412 (5th Cir. 2000). Similarly, in Simichi v. U.S., the court noted that if any individual
GL-149712-10
5

provision of the Privacy Act conflicts with a corresponding provision in section 6103 than the former must yield. 1998 WL 80188, at *5. See Lake v. Rubin, 162 F.3d 113, 115-16 (D.C. Cir. 1998); Cheek v. I.R.S., 703 F.2d 271, 271-72 (7th Cir. 1983).

By analogy, section 6103 contains very strict rules that operate to protect data from unauthorized access or disclosure. In contrast, the DPPA and IN statute, provide more generalized protection procedures with respect to redisclosure of PII. As section 6103 is dedicated entirely to confidentiality and disclosure issues related to tax returns and return information, it will preempt the more general protection provisions offered by the DPPA, and IN statute, at least when, as here, provisions conflict.

If, however, the IN BMV believes that the IRS is misusing IN BMV records, it can report the matter to the Treasury Inspector General for Tax Administration, the office with the authority to perform audits of IRS programs as well as investigate the activities of individual IRS employees. See generally, I.R.C. § 7803(d) and Conference Report to Accompany H.R. 2676, IRS RESTRUCTURING AND REFORM ACT OF 1998, 217-225. “Taxpayer returns and return information are available for inspection by the Treasury IG for Tax Administration pursuant to section 6103(h)(1).” Id., at 224.

2. Federal notification requirements

Paragraph 4 of the standard Indiana Government Account Agreement provides that “if the Subscriber discloses any personal information, the Customer shall pay the cost(s) of the notice(s) of any and all disclosure(s) of the system security breach(es) in addition to any other claims and expenses for which it is liable under the law.” IND CODE § 24- 4.9-3-1. The IRS adheres to federal law, including section 6103 and the Privacy Act, as well as OMB guidelines to determine when an individual should be notified that his/her information may have been breached.2

As a federal agency, the IRS is not permitted to enter into state Government Account Agreements which include a breach notification provision requiring the agency to absorb the cost of notification for all data breaches of PII. Rather, OMB guidance advises federal agencies to consider the risks of identity theft and other adverse effects and to provide notification when an analysis of the factors indicates that notification is appropriate. Office of Mgmt. & Budget, Exec. Office of the President, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, M-07-16 (2007). In response, the IRS has implemented notification procedures that follow and meet the requirements of the OMB guidance.

2
Among those responsibilities is that the agency must, inter alia, only maintain records that are necessary and relevant to accomplish the agency’s purpose; inform the individual of the reason it seeks the information and the agency’s uses for such information; publish a notice of the systems of records maintained on individuals; maintain records that are timely, accurate and complete; and, establish appropriate technical and physical safeguards to ensure the security or integrity or confidentiality of such records. See generally 5 U.S.C. § 552a(e).
GL-149712-10
6

In sum, the IRS has breach notification procedures in place and notifies individuals when there is a risk of identity theft or other adverse effect from data breaches. Moreover, the IRS is required to follow federal authority, such as section 6103 and the Privacy Act, with respect to disclosure and breach notification rather than follow state law procedures.

Please call (202) 622-4570 if you have any further questions.