Permit Power of Attorney (PoA) to establish an agreement on behalf of the taxpayer

Transcription

1 NOTE: The following reflects the information entered in the PIAMS website. A. SYSTEM DESCRIPTION Authority: Office of Management Budget (OMB) Memorandum (M) 03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 & PVR #10- Privacy Accountability and #21-Privacy Risk Management Date of Approval: Jun 25, 2013 PIA ID Number: What type of system is this? n - FISMA Legacy 1a. Is this a Federal Information Security Management Act (FISMA) reportable system? 2. Full System Name, Acronym, and Release/Milestone (if appropriate): Online Payment Agreement Individual Master File (I, OPA IMF/BMF) 2a. Has the name of the system changed? If yes, please state the previous system name, acronym, and release/milestone (if appropriate): Online Payment Agreement Individual Master File, OPA IMF, milestone 4 3. Identify how many individuals the system contains information on Number of Employees: Number of Contractors: t Applicable t Applicable Members of the Public: 100,000-1,000, Responsible Parties: N/A 5. General Business Purpose of System OPA is an Integrated Customer Communications Environment (ICCE) Web Applications (Web Apps) Web application that has been updated to include additional functionality for the 2009 filing season. The application was developed in response to an increase in the number of requests for Online Payment Agreements and the limited number of resources available. Requesting and complying with a payment agreement generates questions and contacts by phone, mail and walk in but they don t always require human interaction. Taxpayers must be offered a way to request a payment agreement and comply with its terms quickly, privately, and inexpensively during system hours of operation. OPA was designed to alleviate issues with the old payment agreement process and provide taxpayers with a real-time web-based application for performing the following capabilities: Set up and secure approval for payment agreements online Provide a financial analysis tool to target realistic payment amounts Identify and authenticate valid users Enter levy source information (e.g., bank and employer information) Permit Power of Attorney (PoA) to establish an agreement on behalf of the taxpayer Verify address and phone information on record Select method of payment Validate user inputs as specified in the OPA Functional Requirements Provide ability to save sessions before logging out 6. Has a PIA for this system, application, or database been submitted previously to the Office of Privacy Compliance? (If you do not know, please contact *Privacy and request a search)

2 6a. If, please indicate the date the latest PIA was approved: 04/05/2013 6b. If, please indicate which of the following changes occurred to require this update. System Change (1 or more of the 9 examples listed in OMB applies) (refer to PIA Training Reference Guide for the list of system changes) System is undergoing Security Assessment and Authorization 6c. State any changes that have occurred to the system since the last PIA Signficiant Merging- when Agencies adopt or alter business processes so that the government databases holding PII are merged, centralized, matched with other databases, or otherwise significantly manipulated. The system change that prompted the update is the Business Master file (BMF) application will be merged into the existing IMF application. 7. If this system has an Exhibit 53 or Exhibit 300 please provide the Unique Project Identifier (UPI) number (XXX-XX-XX-XX-XX-XXXX-XX). Otherwise, enter the word 'none' or 'NA'. NA B. DATA CATEGORIZATION Authority: OMB M & PVR #23- PII Management 8. Does this system collect, display, store, maintain or disseminate Personally Identifiable Information (PII)? 8a. If, what types of information does the system collect, display, store, maintain or disseminate? 9. Indicate the category that best describes the source that provides or originates the PII collected, displayed, stored, maintained or disseminated by this system. Most common categories follow: Taxpayers/Public/Tax Systems Employees/Personnel/HR Systems Other Other Source: 10. Indicate all of the types of PII collected, displayed, stored, maintained or disseminated by this system. Then state if the PII collected is on the Public and/or Employees. Most common fields follow: TYPE OF PII Collected? On Public? On IRS Employees or Contractors? Name Social Security Number (SSN) Tax Payer ID Number (TIN) Address Date of Birth Additional Types of PII: PII Name On Public? On Employee? Caller Identification Number Bank Name Bank Account Name(s) Entity Establishment year Type of Account

3 Account Address Account Number Routing Number Personal Identification Number Address of Record Optional phone numbers Proposed payment amount Payment option (pay now, IBTF IA, DDIA, Routine IA 10a. Briefly describe the PII available in the system referred to in question 10 above. Employee Identification Number (EIN) is required for authentication and is required to provide the services requested by the taxpayer. There are no possible replacements for the PII data listed. If you answered to Social Security Number (SSN) in question 10, answer 10b, 10c, and 10d. 10b. Cite the authority that allows this system to contain SSN's? (e.g. specific regulations, statutes, etc.) Authority for requesting PII for federal tax administration is generally internal revenue code sections 001, 6011, and 6012(a). Authority for requesting SSN for tax returns and return information is IRC section c. What alternative solution to the use of the SSN has/or will be applied to this system? (e.g. masking, truncation, alternative identifier) There is no possible replacement for the SSN 10d. Describe the planned mitigation strategy and forecasted implementation date to mitigate or eliminate the use of Social Security Numbers on this system? ne at this time 11. Describe in detail the system's audit trail. State what data elements and fields are collected. Include employee log-in information. If the system does not have audit capabilities, explain why an audit trail is not needed. OPA will collect Management Information System (MIS) data related to the taxpayer's use of the application (e.g., how many hits encountered, how many taxpayers' successfully submitted an installment agreement and what links were followed). In addition to MIS, in the current production environment, OPA sends all of its business layer outbound responses to Security Audit and Analysis System (SAAS) through Application Messaging and Data Access Service (AMDAS) on the outbound queue. AMDAS provides a secure communication service between modernized components 11a. Does the audit trail contain the audit trail elements as required in current IRM Audit Logging Security Standards? 12. What are the sources of the PII in the system? Please indicate specific sources: a. IRS files and databases: If, the system(s) are listed below: System Name Current PIA? PIA Approval Date SA & A? Authorization Date Integrated Data Retrieval System (IDRS) 04/05/2013

4 Corporate Files Online (CFOL) 04/05/2013 Integrated Data Retrieval System (IDRS) 04/05/2013 Corporate Files Online (CFOL) 04/05/2013 b. Other federal agency or agencies: If, please list the agency (or agencies) below: c. State and local agency or agencies: If, please list the agency (or agencies) below: d. Third party sources: If yes, the third party sources that were used are: e. Taxpayers (such as the 1040): f. Employees (such as the I-9): g. If, specify: C. PURPOSE OF COLLECTION Authorities: OMB M & Internal Revenue Manual (IRM) , IT Security, Live Data Protection Policy & PVR #16, Acceptable Use 13. What is the business need for the collection of PII in this system? Be specific. All data items collected are for the specific business purpose of providing taxpayers that owe money to the IRS the capability of setting up an installment plan via the web interface offered through OPA. D. PII USAGE Authority: OMB M & PVR #16, Acceptable Use 14. What is the specific use(s) of the PII? To conduct tax administration To provide taxpayer services To collect demographic data For employee purposes If other, what is the use? E. INFORMATION DISSEMINATION Authority: OMB M & PVR #14- Privacy tice and #19- Authorizations 15. Will the information be shared outside the IRS? (for purposes such as computer matching, statistical purposes, etc.) 15a. If yes, with whom will the information be shared? The specific parties are listed below: / Who? ISA OR MOU**?

5 Other federal agency (-ies) State and local agency (-ies) Third party sources ** Inter-agency agreement (ISA) or Memorandum of Understanding (MOU) 16. Does this system host a website for purposes of interacting with the public? 17. Does the website use any means to track visitors' activity on the Internet? If yes, please indicate means: Persistent Cookies Web Beacons Session Cookies YES/NO AUTHORITY If other, specify: F. INDIVIDUAL CONSENT Authority: OMB M & PVR #15- Consent and #18- Individual Rights 18. Do individuals have the opportunity to decline to provide information or to consent to particular uses of the information? 18a. If, how is their permission granted? They have the opportunity to opt out of the system 19. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action? 19a. If, how does the system ensure due process? OPA provides the taxpayer the opportunity to respond to any negative determinations. If the taxpayer does not qualify for the Online Payment Agreement, a phone number shall be provided to answer any questions. 20. Did any of the PII provided to this system originate from any IRS issued forms? 20a. If, please provide the corresponding form(s) number and name of the form. Form Number Form Name 720 Quarterly Federal Excise Tax Return 940 Employers annual Federal Unemployment Tax Return 941 Employers Quarterly Federal Tax Return 943 Employers Annual Federal Tax Return for Agricultural Employees 944 Employers Annual Federal Tax Return 945 Annual Return of Federal Income Tax 990 REturn of Organization Exempt from income Tax 1065 U.S. Return of Partnership income 1120 U.S. Corporation Income Tax Return 2290 Heavy Highway Vehicle Use Tax 5500 Annual Return/Report of Employees Benefits Plan W-2/3 Transmittal of Wage and Tax Statement

6 20b. If, how was consent granted? Written consent Website Opt In or Out option Published System of Records tice in the Federal Register G. INFORMATION PROTECTIONS Authority: OMB M & PVR #9- Privacy as Part of the Development Life Cycle, #11- Privacy Assurance, #12- Privacy Education and Training, #17- PII Data Quality, #20- Safeguards and #22- Security Measures 21. Identify the owner and operator of the system: IRS Owned and Operated 21a. If Contractor operated, has the business unit provided appropriate notification to execute the annual security review of the contractors, when required? 22. The following people have use of the system with the level of access specified: IRS Employees: Users Managers System Administrators Developers Contractors: Contractor Users Contractor System Administrators Contractor Developers / Access Level Access Access Read Only Access If you answered yes to contractors, please answer 22a. (All contractor/contractor employees must hold at minimum, a "Moderate Risk" Background Investigation if they have access to IRS owned SBU/PII data.) 22a. If the contractors or contractor employees act as System Administrators or have Root Access, does that person hold a properly adjudicated High Level background investigation? 23. How is access to the PII determined and by whom? Access to the data by taxpayers is determined by the taxpayer entering valid shared secrets. Once they enter shared secrets and their data matches up with the IDRS/CFOL information to ensure that the information is correct, they are eligible to use the system. This is termed successful authentication. 24. How will each data element of SBU/PII be verified for accuracy, timeliness, and completeness? OPA restricts user input through the use of multiple mechanisms. The OPA application restricts user input through the use of a script that notifies the user if sections of the form were left blank or the input was a different type than what is acceptable for the field. OPA also prepopulates dropdown boxes(month, Day, Year, State) for certain forms where user input is required. This adds control to the values that can be stored or processed by the system. Radio buttons or checkboxes are also used to collect user responses for application defined answers. The system also notifies the taxpayer through the use of on screen text examples of input restrictions. 25. Are these records covered under the General Records Schedule (GRS), or have a National Archives and Records Administration (NARA) archivist approved a Record Control Schedule (RCS) for the retention and destruction of official agency records stored in this system?

7 25a. If, how long are the records required to be held under the corresponding RCS and how are they disposed of? In your response, please include the complete IRM number 1.15.XX and specific item number and title. The National Archives and Records Administration (NARA) approved disposition instructions for OPA inputs, system data, outputs and system documentation in July 2012, under Job. N All completed OPA sessions are updated to the Master File for official recordkeeping purposes. OPA disposition instructions published as pending in IRS Document 12990, Records Control Schedule 28 for Collections, item 158 will be updated to indicate approval upon next RCS 28 update. IDRS retains logs of all access of taxpayer records. All data and audit information is sent to SAAS application. NARA approved a 7-year retention of SAAS audit data under Job. N (approved 4/5/2011). SAAS retention requirements will be incorporated into OPA records requirements. If, how long are you proposing to retain the records? Please note, if you answered no, you must contact the IRS Records and Information Management Program to initiate records retention scheduling before you dispose of any records in this system. 26. Describe how the PII data in this system is secured, including appropriate administrative and technical controls utilized. The front-end web servers, which interface with the web application server where ICCE resides, are configured to transmit all traffic, including authentication data, over the HTTPS protocol using TLS. HTTPS is a protocol that provides encrypted transmission of data between web browsers and web servers using public key cryptography technology. TLS provides data encryption, server authentication, message integrity, and client authentication. Only the IRS server has the private key to decrypt the requests, and only the user's browser has the private key to decrypt the pages returned to the brower's address. The taxpayer's browser requests the IRS public key from the web server, and uses it to encrypt the request to the Web server. the browser sends the encrypted request along with its own public key. 26a. Next, explain how the data is protected in the system at rest, in flight, or in transition. Administrative policies and procedures have been developed to define the requirements for portection of data during transit, at rest, and in flight. ICCE relies on the IRS Registered User Portal (RUP) and complies with existing IRS Enterprise Architecture policies and security mechanisms inherent with the RUP. Access to the application is restricted to ICCE users through the RUP. Upon successful authentication, taxpayers only have access to their own tax records. system Administrators and Database Administrators are granted access via the OL5081 process and access enforcement is achieved by the operation system and database management system (OS and DBMS). 27. Has a risk assessment (e.g., SA&A) been conducted on the system to ensure that appropriate security controls have been identified and implemented to protect against known risks to the confidentiality, integrity and availability of the PII? 28. Describe the monitoring/evaluating activities undertaken on a regular basis to ensure that controls continue to work properly in safeguarding the PII. The ICCE applications and their supporting infrastructure use a multitude of protections for sensitive data. The transmission of data between the web portals and the Enterprise Computing Centers (ECCs) use encryption through the ANDAS/MQ Series product. The servers in the ECCs are located behind the third firewall and use a number of physical access controls. All servers require authentication for access. Periodic assessments are made regarding compliance with encryption requirements. ICCE is required to document all configurations and changes to configurations. Several times a year, ICCE request Security Impact Assessments be performed on the changes it is proposing. Security Assessment Services provides the SIA as part of the regular and periodic SA&A cycle. A minimum of one Security Control Assessment is performed annually to test whether ICCE is operating in accordance with the regulations regarding Information Technology Security.

8 29. Is testing performed, in accordance with Internal Revenue Manual (IRM) IT Security, Live Data Protection Policy? 29a. Has approval been received from the Office of Privacy Compliance to use Live Data in testing (if appropriate)? 29b. If you have received permission from the Office of Privacy Compliance to use Live Data, when was the approval granted? H. PRIVACY ACT & SYSTEM OF RECORDS Under the statute, any employee who knowingly and willfully maintains a system of records without meeting the Privacy Act notice requirements is guilty of a misdemeanor and may be fined up to $5000. Authority: OMB M & Privacy Act, 5 U.S.C. 552a (e) (4) & PVR #13-Transparency 30. Are 10 or more records containing PII maintained/stored/transmitted through this system? 31. Are records on the system retrieved by any identifier for an individual? (Examples of identifiers include but are not limited to Name, SSN, Photograph, IP Address) 31a. If YES, the System of Records tice(s) (SORN) published in the Federal Register adequately describes the records as required by the Privacy Act? Enter the SORN number and the complete name of the SORN. SORNS Number SORNS Name Treasury/IRS IRS Audit Trail & Security Records System Treasury/IRS Customer Account Data Engine Business Master file Treasury/IRS Customer Account Data Engine Individual Master file Comments I. ANALYSIS Authority: OMB M & PVR #21- Privacy Risk Management 32. What choices were made or actions taken regarding this IT system or collection of information as a result of preparing the PIA? Resulted in the removal of PII from the system (e.g., SSN use reduced/eliminated) Provided viable alternatives to the use of PII within the system New privacy measures have been considered/implemented 32a. If to any of the above, please describe: NA View other PIAs on IRS.gov