Overview of the Statutory and Regulatory Scheme
IRC section 7216 makes it a misdemeanor punishable by up to a year’s imprisonment and $1,000 fine for a tax return preparer to knowingly or recklessly disclose any information obtained in connection with preparing a client’s tax return (or to use that information other than for preparing a tax return, but “use” is outside the scope of this article).
The civil equivalent, IRC section 6713, has no intent requirement and carries a fine of $250 for each wrongful disclosure, up to $10,000 per calendar year.
Comprehensive Treasury Regulations provide definitions and explanatory examples (§ 301.7216-1) and set out exceptions (§ 301.7216-2). Then, Treasury Regulations section 301.7216-3, with which this column is concerned, provides that, unless IRC section 7216 or Treasury Regulations section 301.7216-2 specifically permit, a tax return preparer must obtain a client’s consent prior to disclosing the taxpayer’s tax return information to anyone else. Section 301.7216-3 prescribes the contents of a consent, and Revenue Procedure 2013-14 provides additional mandatory requirements for consents from taxpayers who file returns in the 1040 series.
Definitions are broad. A “tax return preparer” is any person engaged in the business of preparing or assisting in preparing a tax return, including developing software for that use, and any person engaged in the business of providing auxiliary services in connection with the preparation of tax returns [Treasury Regulations § 301.7216-1(b)(2)]. An overseas recipient of tax return information outsourced by a U.S. return preparer is therefore itself a tax return preparer.
“Tax return information” is any information furnished to a tax return preparer for or in connection with the preparation of a tax return [Treasury Regulations § 301.7216-1(b)(3)]. Disclosure of tax return information is the act of making that information known to any person in any manner [§ 301.7216-1(b)(4)].
“Auxiliary services” are not defined but may be significant for outsourced projects related to—but not specifically for—tax return preparation. A 2006 IRS notice of proposed rulemaking stated that “analysis of data for purposes of monitoring the tax return preparer’s business for fraud prevention and provision of data services” and “similar services” are typical of auxiliary services [Notice of Proposed Rulemaking, Reg-137243-02, 70 Fed. Reg. 72954-72964 (Jan. 17, 2006)]. An example of auxiliary services is obtaining tax return information under a contract to provide, maintain, test, or procure equipment or software used in tax return preparation [Treasury Regulations §§ 301.7216-1(b)(2) and 301.7216-2(d)(2)].
Consents Required for All Disclosures to Third Parties
Treasury Regulations section 301.7216-3(a)(3)(i) prescribes the form and content for all consents to disclose taxpayers’ tax return information:
- ▪ They must contain the names of the tax return and the taxpayer [§ 301.7216-3(a)(3)(i)(A)].
- ▪ They must identify the intended purpose of the disclosure and identify the recipient of the tax return information [§ 301.7216-3(a)(3)(i)(B)].
- ▪ They must specify the tax return information to be disclosed to or used by the receiving tax return preparer [§ 301.7216-3(a)(3)(i)(C)].
- ▪ They must be signed and dated by the taxpayer [§ 301.7216-3(a)(3)(i) (E)]. If a consent does not specify its duration, it will be effective for one year from the date of the taxpayer’s signature [§ 301.7216-3(b)(5)].
There can be no retroactive consent after a completed tax return has been provided to the taxpayer for signature [§ 301.7216-3(b)(1)]. A taxpayer may, however, consent ahead of time to disclosure of all information contained in a return, but that consent must state that the taxpayer can request “more limited disclosure of tax return information as the taxpayer may direct” [Treasury Regulations § 301.7216-3(c)(2)].
A taxpayer may consent to multiple disclosures in one document [§ 301.7216-3(a)(3)(B)] but, for a taxpayer filing a return in the 1040 series, that document must “specifically and separately identify each disclosure” [§ 301.7216-3(c)(1)].
Taxpayer Consents for Disclosing Tax Return Information Outside the United States
Consents from non-1040 taxpayers.
A consent to disclose a non-1040 taxpayer’s tax return information may be in any format, including part of an engagement letter, so long as the consent complies with the requirements above [§ 301.7216-3(a)(3)(i)].
The consent should include a statement that the taxpayer authorizes the U.S. tax return preparer to disclose the taxpayer’s tax return information to a specifically identified tax return preparer outside of the United States for the purpose of assisting the U.S. preparer in preparing the return. This consent should also include a statement that the taxpayer acknowledges that its tax return information will be disclosed to a tax return preparer located abroad [§ 301.7216-3(a)(3)(iv), Example 2]. In addition, the “disclosing and receiving tax return preparers [must] have procedures in place that are consistent with good business practices and designed to maintain the confidentiality of the disclosed tax return information” [§ 301.7216-2(p)(2)].
Consents from 1040 taxpayers—history regarding disclosure of Social Security numbers.
Treasury regulations promulgated in January 2008 completely prohibited sending Social Security numbers outside the United States. [TD 9375, 73 Federal Register 1067 (Jan. 3, 2008), https://www.irs.gov/pub/irs-drop/td_9375.pdf]. Under this regulation, a tax return preparer sending tax return information overseas “must redact or otherwise mask the taxpayer’s SSN before the tax return information is disclosed outside of the United States” [§ 301.7216-3(b)(4)].
This regulation was amended in December 2008, however, to provide a “limited exception” [TD 9437, 73 Federal Register 76216, “Supplementary Information” (Dec. 16, 2008), https://tinyurl.com/4zum3w9z], allowing a tax return preparer to obtain consent to disclose a taxpayer’s Social Security number to a tax return preparer outside of the United States if the tax return preparer uses an “adequate data protection safeguard as defined by the Secretary and verifies the maintenance of the adequate data protection safeguards in the request for the taxpayer’s consent” [§ 301.7216-3(b)(4)(ii)]. This “limited exception” may have largely swallowed the rule, however, as more adequate data security protection safeguards have become available. Some tax return preparers still choose to mask Social Security numbers, depending upon the scope of the outsourced work.
Revenue Procedure 2013-14
Revenue Procedure 2013-14 sets out “mandatory statements” to be included in all 1040 taxpayer consent to disclosures of tax return information to third party tax return preparers. Tax return preparers may chafe under this requirement, but the revenue procedure’s mandatory language is just that—mandatory—so it is not advisable to modify it. The only very minor variation allowed is to substitute the tax return preparer’s name for “we” or “our” [§ 5.05(1)].
Revenue Procedure 2013-14 even specifies the size of paper and font to be used (§ 5.02); sets out requirements for the size and contrast of text on computer screens (§ 5.03); and provides detailed rules for a valid electronic consent (§ 6).
The mandatory language is too lengthy to include verbatim here, but there is language specific to a consent to disclosure in a context other than tax return preparation or auxiliary services [§ 5.04(1)(a)], and a more detailed consent to disclosure in the context of tax preparation or auxiliary services [§ 5.04(1)(b)].
Consents to disclose tax return information in a context other than tax return preparation or auxiliary services require the following statements in this sequence: 1) the consent form must be provided to the taxpayer; 2) the tax return preparer cannot, unless authorized by law, disclose tax return information for purposes other than the preparation and filing of the taxpayer’s tax return without the taxpayer’s consent; 3) if the taxpayer consents to disclosure, federal law may not protect the taxpayer’s tax return information from further use or distribution; 4) the taxpayer is not required to sign the form to engage the preparer’s tax return preparation services; 5) if the preparer obtains the taxpayer’s signature by conditioning tax return preparation services on consent, the consent is invalid; and 6) if the taxpayer does not specify the duration of the consent, it will be valid for a year from the date of signature. All consents must also advise the taxpayer that if they believe their tax return information has been disclosed or used improperly, they may contact the Treasury Inspector General for Tax Administration (TIG-TA) [§ 5.04(1)(d)].
Consents to disclosure for tax preparation or related auxiliary services must also state, in addition to the above: “Because our ability to disclose your tax return information to another tax return preparer affects the tax preparation service(s) that we provide to you and its (their) cost, we may decline to provide tax preparation services or change the terms (including the cost) of the tax preparation services we provide to you if you do not sign the form.”
Outside the Country
For disclosures outside the country that do not include a Social Security number, a simple additional statement is required: “This consent to disclose may result in information being disclosed to a tax return preparer located outside the United States.” [Revenue Procedure 2013-14 § 5.04(1)(e)(i)].
If a consent involves disclosure of a Social Security number, it must include more detailed language, following the above language with: 1) an underlined statement that information which may be disclosed includes “your personally identifiable information such as your Social Security Number;” 2) a statement that both the disclosing tax return preparer in the United States and the preparer outside the United States maintain an “adequate data protection safeguard” as required by section 7216’s regulations; and 3) a notice that federal agencies may not be able to enforce U.S. laws protecting the privacy of tax return information against the tax return preparer outside of the United States [Revenue Procedure 2013-14 § 5.04(1)(e)(ii)].
Explaining Revenue Procedure 2013-14 Consents to Taxpayers
While many taxpayers sign consent forms without question, some are troubled by the revenue procedure’s required language, especially in connection with disclosures overseas. Simply confirming that the exact language of the consent form is required by law may alleviate concerns for some taxpayers. Preparers can explain that, by signing the form, the taxpayer allows more streamlined workflow and keeps the cost of tax preparation down. Taxpayers may not be aware that outsourcing has been flourishing safely for quite some time and that data protection safeguards are now extremely robust. This can be explained in a cover letter to the consent form, or in an engagement letter that attaches the form.
“Adequate Data Protection Safeguard”
Revenue Procedure 2013-14 includes the Secretary’s guidance about “an adequate data protection safeguard” referenced in Treasury Regulations section 301.7216-3(b)(4)(ii) [Revenue Procedure 2013-14 § 5.07]. Revenue Procedure 2013-14 lists six adequate privacy or data security frameworks. The most relevant today is probably: “The requirements of the AICPA/CICA Privacy Framework” [§ 5.07(4)]. Other frameworks described are generally only available to members of an organization of large banks or other institutions [§§ 5.07(2) and (3)]; and IRS Publication 1075 [§ 5.07(5)] is very specifically concerned with the cybersecurity of IRS information.
The AICPA/CICA Privacy Frame-work, revised as Generally Accepted Privacy Principles (GAPP), was updated and renamed in 2020 as the Privacy Management Framework (PMF). The PMF requires organizations to implement access controls to prevent malicious attacks, unauthorized deletion of data, misuse, and unauthorized alteration or disclosure of company information. A CPA firm is advised to have a written plan implementing these controls.
The AICPA also developed SOC 2 (Systems and Organizations Controls 2), a voluntary compliance standard for data protection service providers based on Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy (the privacy criterion may correlate with the PMF). The main data safeguard technology providers are SOC 2 compliant, but a CPA should always request a copy of a provider’s SOC 2 report.
Additional Safety Requirements
Tax return preparers must also abide by the Federal Trade Commission’s (FTC) Safeguards Rule under the Gramm-Leach-Bliley Act, because tax return preparers are “financial institutions” subject to the act (tax return preparers with fewer than 5,000 individual customers are exempt from a few, but not all, requirements of the FTC Safeguards Rule). CPAs must of course also abide by the AICPA Code of Professional Conduct and any state equivalents. These various standards may overlap in some respects—the PMF may equate to a written plan under the Safeguards Rule—but differ in others.
