8. Does this system collect, display, store, maintain or disseminate Personally Identifiable Information (PII)? Yes

Transcription

1 NOTE: The following reflects the information entered in the PIAMS Website. A. SYSTEM DESCRIPTION Authority: Office of Management Budget (OMB) Memorandum (M) 03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 & PVR #10- Privacy Accountability and #21-Privacy Risk Management Date of Approval: 03/05/2013 PIA ID Number: What type of system is this? Legacy 1a. Is this a Federal Information Security Management Act (FISMA) reportable system? 2. Full System Name, Acronym, and Release/Milestone (if appropriate): On Line tice Review, ONLR 2a. Has the name of the system changed? If yes, please state the previous system name, acronym, and release/milestone (if appropriate): 3. Identify how many individuals the system contains information on Number of Employees: Number of Contractors: t Applicable t Applicable Members of the Public: Over 1,000, Responsible Parties: N/A 5. General Business Purpose of System OLNR is an independent, non-major application that allows Tax Examiners (TE) to review and edit Tax Examiners (TE) notices (a.k.a. Computer Paragraphs or CPs) on-line. It eliminates much of the manual work involved in the clerical and TE processes. There are three key components to the application: A Microsoft SQL Server database management system (DBMS), Visual Basic Desktop application and OLNR Web site. 6. Has a PIA for this system, application, or database been submitted previously to the Office of Privacy Compliance? (If you do not know, please contact *Privacy and request a search) 6a. If, please indicate the date the latest PIA was approved: 04/17/2012 6b. If, please indicate which of the following changes occurred to require this update. System Change (1 or more of the 9 examples listed in OMB applies) (refer to PIA Training Reference Guide for the list of system changes) System is undergoing Security Assessment and Authorization 6c. State any changes that have occurred to the system since the last PIA Since the last PIA, OLNR underwent regular maintenance. This maintenance included: Changes to Civil Penalties, TPNC/Math Error Descriptions, added a new Label for Tax Examiner's to apply to a notice; removed 2 unused tices (CP73 & CP78); allow more BMF tices to be retyped to other BMF notices. 7. If this system has an Exhibit 53 or Exhibit 300 please provide the Unique Project Identifier (UPI) number (XXX-XX-XX-XX-XX-XXXX-XX). Otherwise, enter the word 'none' or 'NA' B. DATA CATEGORIZATION Authority: OMB M & PVR #23- PII Management 8. Does this system collect, display, store, maintain or disseminate Personally Identifiable Information (PII)? 8a. If, what types of information does the system collect, display, store, maintain or disseminate?

2 9. Indicate the category that best describes the source that provides or originates the PII collected, displayed, stored, maintained or disseminated by this system. Most common categories follow: Taxpayers/Public/Tax Systems Employees/Personnel/HR Systems Other Other Source: 10. Indicate all of the types of PII collected, displayed, stored, maintained or disseminated by this system. Then state if the PII collected is on the Public and/or Employees. Most common fields follow: TYPE OF PII Collected? On Public? Name Social Security Number (SSN) Tax Payer ID Number (TIN) Address Date of Birth On IRS Employees or Contractors? Additional Types of PII: Other PII Records found. 10a. Briefly describe the PII available in the system referred to in question 10 above. The OLNR system contains tax payers' PII. This PII comes directly from tax payers' when they file their taxes. The PII includes all the common information provided on tax forms, as well as, Social Security #, TIN, DLN, penalties, interest, payments and Entity information. This information is necessary for the Tax Examiners (TEs) to perform a thorough review, update and reconciliate notices before they are mailed out to the tax payers.tax Examiner info on changes they make to taxpayer notice data is tracked by SEID rather than name or SSN. If you answered to Social Security Number (SSN) in question 10, answer 10b, 10c, and 10d. 10b. Cite the authority that allows this system to contain SSN's? (e.g. specific regulations, statutes, etc.) IRS (IRC 6011, IRC , and 26 CFR Section ) 10c. What alternative solution to the use of the SSN has/or will be applied to this system? (e.g. masking, truncation, alternative identifier) ne. This information must be verifiable so the TEs can determine the accuracy of notices before they are mailed out to the tax payer. TEs common use other sources, such as Quick Prints and the IDRS system, to confirm accuracy of the tax payers' information. 10d. Describe the planned mitigation strategy and forecasted implementation date to mitigate or eliminate the use of Social Security Numbers on this system? ne. This information must be verifiable so the TEs can determine the accuracy of notices before they are mailed out to the taxpayer.

3 11. Describe in detail the system's audit trail. State what data elements and fields are collected. Include employee log-in information. If the system does not have audit capabilities, explain why an audit trail is not needed. The OLNR system uses 3 types of audit trails: SQL Server C2 auditing, Windows Server Event Viewer logs & OlnrWeb reports. The SQL Server is configured to capture all C2 auditing information, along with the transaction type, user ID, date/time stamp of transaction, and the success or failure of the transaction. The Windows Server auditing captures System, Application and Security information in the Event Viewer logs. The Event Viewer logs capture the entry type, date/time stamp, source that caused the log entry, catagory, Event, user & computer. The OLNR Web site captures all user changes and includes a before & after snapshot of each transaction change, Users' SEID and date/time stamp. 11a. Does the audit trail contain the audit trail elements as required in current IRM Audit Logging Security Standards? 12. What are the sources of the PII in the system? Please indicate specific sources: a. IRS files and databases: If, the system(s) are listed below: System Name Current PIA? PIA Approval Date SA & A? Authorization Date b. Other federal agency or agencies: If, please list the agency (or agencies) below: c. State and local agency or agencies: If, please list the agency (or agencies) below: d. Third party sources: If yes, the third party sources that were used are: e. Taxpayers (such as the 1040): f. Employees (such as the I-9): g. If, specify: C. PURPOSE OF COLLECTION Authorities: OMB M & Internal Revenue Manual (IRM) , IT Security, Live Data Protection Policy & PVR #16, Acceptable Use 13. What is the business need for the collection of PII in this system? Be specific. tices contain PII Info. OLNR is a quality control tool. Its main goal is to improve the accuracy of notices delivered tax payers. OLNR allows the TEs to review and correct notices with the most up-to-date information available within the IRS before notices are mailed out to the Taxpayers. D. PII USAGE Authority: OMB M & PVR #16, Acceptable Use 14. What is the specific use(s) of the PII? To conduct tax administration To provide taxpayer services To collect demographic data For employee purposes If other, what is the use?

4 E. INFORMATION DISSEMINATION Authority: OMB M & PVR #14- Privacy tice and #19- Authorizations 15. Will the information be shared outside the IRS? (for purposes such as computer matching, statistical purposes, etc.) 15a. If yes, with whom will the information be shared? The specific parties are listed below: Other federal agency (-ies) State and local agency (-ies) Third party sources / Who? ISA OR MOU**? ** Inter-agency agreement (ISA) or Memorandum of Understanding (MOU) 16. Does this system host a website for purposes of interacting with the public? 17. Does the website use any means to track visitors' activity on the Internet? If yes, please indicate means: Persistent Cookies Web Beacons Session Cookies YES/NO AUTHORITY If other, specify: F. INDIVIDUAL CONSENT Authority: OMB M & PVR #15- Consent and #18- Individual Rights 18. Do individuals have the opportunity to decline to provide information or to consent to particular uses of the information? t Applicable 18a. If, how is their permission granted? 19. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action? t Applicable 19a. If, how does the system ensure due process? 20. Did any of the PII provided to this system originate from any IRS issued forms? 20a. If, please provide the corresponding form(s) number and name of the form. Form Number 1040 series and schedules US Individual Income Tax Return 2363 Master File Entity change 2650 TDA/TDI Transfer Form Name 4136 Computation of Credit for Federal Tax on Fuels 4136T Computation on Credit for Federal Tax on Fuels 5329 Additional Taxes on Qualified Plans (Including IRA's) and Other Tax-Favored Accounts 5449 Undelivered Refund Check CIV PEN Civil Penalty 1041 U.S. Fiduciary Income Tax Return (for Estates and Trusts) 1041-A U.S. Information Return-Trust Accululation of Charitable Amounts 1041N U.S. Income Tax Return for Electing Alaska Native Settlement Trusts 1041PF 1041QFT See form Split Interest Trust Information Return Qualified Funeral Trust 1042 Annual Withholding Tax Return for US Source Income of Foreign Persons 1042S Foreign Persons US Source Income Subject to Withholding

5 1065 U.S. Partnership Return of Income 1066 Real Estate Mortgage Investment Conduit Income Tax Return 1099 Income That you did not fully include on Your Return 1120 U.S. Coporation Income Tax Return 1120A 1120C 1120F 1120FSC 1120H 1120ICDISC 1120L 1120M 1120ND 1120PC 1120POL 1120REIT 1120RIC 1120S U.S. Corporation Short-Form Income Tax Return U.S. Income Tax Return for Cooperative Associations U.S. Income Tax Return of Foreign Corporations U.S. Income Tax Return of a Foreign Sales Corporation U.S. Income Tax Return for Homeowner Associations T/P Corres. Relating to Loose Sched's U.S. Life Insurance Company Income Tax Return U.S. Corporation Income Tax Return Return for Nuclear Decommissioning Trusts and Certain Related Persons U.S. Property and Casualty Insurance Company Income Tax Return U.S. Income Tax Return of Political Organizations U.S. Income Tax Return for Real Estate INvestment Trusts U.S. Income Tax Return for Regulated Investment Companies U.S. Small Business Corporation Income Tax Return 1120SF U.S. Income Tax Return for Settlement Funds (Under Section 468B) 1120X Amended U.S. Corporation Income Tax Return 11C Special Tax Return and Application for Registry-Wagering 2290 Heavy Vehicle Use Tax Return 2290EZ Heavy Vehicle Use Tax Return for filers with a single Vehicle 2363 Master File Entity Change 2650 TDA/TDI Transfer A Application for Extension of Time to File Certain Excise, Income, Information and other returns Annual Return to Report Transactions with Foreign Trusts and Receipt of Certain Foreign Gifts Annual Information Return of Foreign Trust with a U.S. Owner 3809 Miscellaneous Adjustment Voucher 4136 and 4136T Computation of Credit for Federal Tax on Fuels 4720 Return of Certain Excise Taxes on Charities and Other Persons Under Chap Split-Interest Trust Information Return 5330 Return of Excise Taxes Related to Employee Benefit Plans 706 United States Estate Tax Return 706GS(D) 706GS(T) 706NA Generation-Skipping Transfer Tax Return for Distribution Generation-Skipping Transfer Tax Return for Distribution United States n-resident Alien Estate Tax Return 709 United States Gift Tax Return 709A U.S. Short Form Gift Tax Return 720 Quarterly Federal Excise Tax Return 730 and 730C Tax on Wagering 8038 Information Return for Tax-Exempt Private Activity Bond Issues 8038-B 8038-CP Information Return for Qualified Build America Bonds and Qualified Recovery Economic Development Bon Credit for Qualified Bonds Allowed to Issuers 8038-G Information Return for Tax-Exempt Governmental Obligations 8038-GC 8038-TC Information Return for Small Tax-Exempt Governmental Bond Issues, Lease, and Installment Sales Information Return for Tax Credit Bonds 8328 Carryforward Election of Unused Private Activitiy Bond Volume Cap

6 8288 U.S. Withholding Tax Return for Disposition by Foreign Persons of U.S. Real Property Interest 8752 Required Payment of Refund Under Section Application for Automatic extesion of time for file Corporation Income Tax Return 8804 Annual Return for Partnership Withholding Tax (Section 1446) 8849 Claim for Refund of Excise Taxes 940 series and schedules Employer's Annual Federal Unemployment Tax Return 942 series returns Employer's Quarterly Tax Return for Household Employees 943 series returns Employer's Annual Tax Return for Agricultural Employees 944 series returns Employer's Annual Federal Tax Return 945 series returns Annual Return of Withheld Federal Income Tax 990 Organization Exempt From Income Tax 990C Exempt Cooperative Association Income Tax Return 990EZ Organization Exempt From Income Tax 990-N Electronic tice (e-postcard) for Tax-Exempt Organizations 990PF 990T CT-1 CT-1X CVL PEN W3 Return of Private Foundation Exempt Organization Business Income Tax Return Employer's Annual Railroad Retirement and Unemployment Return Adjusted Employer's Annual Railroad Retirement Tax Return or Claim for Refund Civil Penalty Transmittal of Wage and Tax Statements 20b. If, how was consent granted? Written consent Website Opt In or Out option Published System of Records tice in the Federal Register G. INFORMATION PROTECTIONS Authority: OMB M & PVR #9- Privacy as Part of the Development Life Cycle, #11- Privacy Assurance, #12- Privacy Education and Training, #17- PII Data Quality, #20- Safeguards and #22- Security Measures 21. Identify the owner and operator of the system: IRS Owned and Operated 21a. If Contractor operated, has the business unit provided appropriate notification to execute the annual security review of the contractors, when required? 22. The following people have use of the system with the level of access specified: IRS Employees: Users Managers System Administrators Developers Contractors: Contractor Users Contractor System Administrators Contractor Developers / Access Level Read Write Read Write Read Write Access

7 If you answered yes to contractors, please answer 22a. (All contractor/contractor employees must hold at minimum, a "Moderate Risk" Background Investigation if they have access to IRS owned SBU/PII data.) 22a. If the contractors or contractor employees act as System Administrators or have Root Access, does that person hold a properly adjudicated High Level background investigation? 23. How is access to the PII determined and by whom? The TE must submit a 5081 request to receive the appropriate access to the PII data in the OLNR system. The TE's Supervisor is the approver of the TE's request to access the OLNR system. 24. How will each data element of SBU/PII be verified for accuracy, timeliness, and completeness? To verify the accuracy, timeliness and completeness, the Tax Examiners working OLNR PII data use the Quick Prints from NRPS, Control-D web and IDRS to determine the correct notice data and update the record as appropriate. 25. Are these records covered under the General Records Schedule (GRS), or have a National Archives and Records Administration (NARA) archivist approved a Record Control Schedule (RCS) for the retention and destruction of official agency records stored in this system? 25a. If, how long are the records required to be held under the corresponding RCS and how are they disposed of? In your response, please include the complete IRM number 1.15.XX and specific item number and title. OLNR system data has been approved for destruction by NARA under Job. N This includes various temporary retention periods for the Centralized Data Base for tices Reviewed, the Centralized Database of stripped down information for statistical analysis, the Data Base Tables used to generate the original and changed values of tices, the Data Base Tables used to generate reports in the Search Batch and Search disposition features of the Application, and Audit Data Files. These disposition authorities are published in IRS Document 12990, under Records Control Schedule 29 for Tax Administration - Wage and Investment Records, item 116. If, how long are you proposing to retain the records? Please note, if you answered no, you must contact the IRS Records and Information Management Program to initiate records retention scheduling before you dispose of any records in this system. 26. Describe how the PII data in this system is secured, including appropriate administrative and technical controls utilized. OLNR uses both administrative and technical controls to secure the system's PII data. Several administrative controls are used to secure PII data. The first step is to determine who should have access to OLNR. Before a TE accesses the OLNR system, he/she must submit a 5081 request and receive approval from his/her management chain before he/she is authorized to access OLNR's PII data. Once the TE receives the necessary authorization, he/she is briefed on how to secure both equipment and hard copy documents as a part of their training which is handled by their management. As a policy, the TE is not allowed to take tax payer data outside of the office or store tax payer information on his/her PC. The TE is also informed about the proper disposal of all supporting PII data from the Quick Prints and the IDRS system when this data is no longer needed. This material is either shredded or burned and it is never disposed of in the trash. A TE, who is a seasonal or temporary employee, will have his/her access to OLNR removed when he/she processes out from the IRS.With regards to the technical controls, only authorized employees have the ability to access OLNR data from the OlnrWeb site and the OLNR desktop application. The OlnrWeb site is an intranet site and it does not interface with the public or any other system. Input and output files are securely encrypted and transferred to and from the OLNR servers with Tectia and the Enterprise File Transfer Utility (EFTU). In addition, the OLNR desktop application doesn't allow the TE to print or save tax payer data on his/her computer. Data storage and backups are encrypted and secured at off-site locations. All unnecessary services on the OLNR servers are disabled and the System Administrators run regular security scans to identify configuration changes to the system that may create vulnerabilities. 26a. Next, explain how the data is protected in the system at rest, in flight, or in transition. See answer in Has a risk assessment (e.g., SA&A) been conducted on the system to ensure that appropriate security controls have been identified and implemented to protect against known risks to the confidentiality, integrity and availability of the PII?

8 28. Describe the monitoring/evaluating activities undertaken on a regular basis to ensure that controls continue to work properly in safeguarding the PII. Encrypt any that contains PII sent among IRS users including sent to Criminal Investigation, TIGTA and Chief Counsel employees. It is permissible to send electronic mail to authorized non-irs parties (other than taxpayers or their representatives), but only if the Sensitive But Unclassified data is protected by an IRSapproved, Federal Information Processing Standards -140 standards, encryption method. Authorized non-irs parties include contractors, state partners, the Social Security Administration or the Department of Justice. It is prohibited to send s containing PII to taxpayers and their representatives unless they are using a technology and methodology approved by agency executives for this purpose. In addition, the EOPs System Administrators regularly run scans against the OLNR servers to identify unauthorized changes and vulnerabilities to the configuration settings. Continuous Monitoring (ecm) is performed annually to determine if selected System Security Plan (SSP) controls for that year (one-third) are operating as intended. The ecm-recertification (ecm-r) process is conducted on a three year cycle whereby the last one-third of the application information and control descriptions are updated and tested to ensure the controls continue to work properly in safeguarding the PII. Findings from the ecm and ecm-r are detailed in the Security Assessment Report (SARs) leading to the mitigation of the findings. 29. Is testing performed, in accordance with Internal Revenue Manual (IRM) IT Security, Live Data Protection Policy? t Applicable 29a. Has approval been received from the Office of Privacy Compliance to use Live Data in testing (if appropriate)? 29b. If you have received permission from the Office of Privacy Compliance to use Live Data, when was the approval granted? H. PRIVACY ACT & SYSTEM OF RECORDS Under the statute, any employee who knowingly and willfully maintains a system of records without meeting the Privacy Act notice requirements is guilty of a misdemeanor and may be fined up to $5000. Authority: OMB M & Privacy Act, 5 U.S.C. 552a (e) (4) & PVR #13-Transparency 30. Are 10 or more records containing PII maintained/stored/transmitted through this system? 31. Are records on the system retrieved by any identifier for an individual? (Examples of identifiers include but are not limited to Name, SSN, Photograph, IP Address) 31a. If YES, the System of Records tice(s) (SORN) published in the Federal Register adequately describes the records as required by the Privacy Act? Enter the SORN number and the complete name of the SORN. SORNS Number SORNS Name Treas/IRS Correspondence Treas/IRS Security and Audit Trail Records System Comments

9 I. ANALYSIS Authority: OMB M & PVR #21- Privacy Risk Management 32. What choices were made or actions taken regarding this IT system or collection of information as a result of preparing the PIA? Resulted in the removal of PII from the system (e.g., SSN use reduced/eliminated) Provided viable alternatives to the use of PII within the system New privacy measures have been considered/implemented 32a. If to any of the above, please describe: t Applicable View other PIAs on IRS.gov