IRS Modifies Guidance on Consent to Use, Disclose Return Information

26 CFR 301.7216-3: Disclosure or use permitted only with the taxpayer's consent.

(Also: Sections 7216, 6713)

SECTION 1. PURPOSE

This revenue procedure provides guidance to tax return preparers regarding the format and content of taxpayer consents to disclose and consents to use tax return information with respect to taxpayers filing a return in the Form 1040 series (e.g., Form 1040, Form 1040NR, Form 1040A, or Form 1040EZ) under section 301.7216-3 of the Regulations on Procedure and Administration (26 CFR Part 301). This revenue procedure also provides specific requirements for electronic signatures when a taxpayer executes an electronic consent to the disclosure or consent to the use of the taxpayer's tax return information. This revenue procedure modifies and supersedes Revenue Procedure 2008-35, 2008-29 I.R.B. 132, to provide guidance pursuant to section 301.7216-3.

SECTION 2. CHANGES

This revenue procedure modifies the mandatory language required on each taxpayer consent to disclose or consent to use tax return information. This revenue procedure also explains the difference between tax return preparation services (or auxiliary services) and other financial or accounting services. Some taxpayers have expressed confusion regarding whether they needed to complete consent forms to engage a tax return preparer to perform tax return preparation services. The modified mandatory language required in consent forms clarifies that a taxpayer does not need to complete a consent form to engage a tax return preparer to perform only tax return preparation services. To allow a tax return preparer to disclose or use tax return information in providing services other than tax return preparation, however, a taxpayer must complete a consent form as described in this revenue procedure. Sections 5.04(1)(a) and (c) provide the modified language that must be included on each consent to disclose or consent to use tax return information. The examples in section 7 reflect the modified language provided in section 5.04. In addition, a few nonsubstantive changes have been made to the revenue procedure to promote clarity.

SECTION 3. BACKGROUND

.01 In general, section 7216(a) of the Internal Revenue Code imposes criminal penalties on tax return preparers who knowingly or recklessly make unauthorized disclosures or uses of information furnished in connection with the preparation of an income tax return. A violation of section 7216 is a misdemeanor, with a penalty of up to one year imprisonment or a fine of not more than $1,000, or both, together with the costs of prosecution. Section 7216(b) establishes exceptions to the general rule in section 7216(a) and also authorizes the Secretary to promulgate regulations prescribing additional permitted disclosures or uses.

.02 Section 6713(a) prescribes a related civil penalty for unauthorized disclosures or uses of information furnished in connection with the preparation of an income tax return. The penalty for violating section 6713 is $250 for each disclosure or use, not to exceed a total of $10,000 for a calendar year. Section 6713(b) provides that the exceptions in section 7216(b) also apply to section 6713.

.03 Section 301.7216-3 provides that, unless section 7216 or § 301.7216-2 specifically permits the disclosure or use of tax return information, a tax return preparer may not disclose or use a taxpayer's tax return information without obtaining a consent from the taxpayer. Section 301.7216-3(a) provides that consent must be knowing and voluntary. Section 301.7216-3(a)(3)(i) prescribes the form and content requirements that all consents to disclose or consents to use must include. Section 301.7216-3(b) provides timing requirements and other limitations upon consents to disclose or consents to use tax return information. Section 301.7216-3(b)(4) provides a limitation upon consents to disclose a taxpayer's social security number to a tax return preparer located outside of the United States.

.04 Section 301.7216-3(a)(3)(ii) provides that the Secretary may, by publication in the Internal Revenue Bulletin, prescribe additional requirements for tax return preparers regarding the format and content of consents to disclose and consents to use tax return information with respect to taxpayers filing a return in the Form 1040 series, as well as the requirements for a valid signature on an electronic consent under section 7216.

Section 301.7216-3(b)(4)(ii) provides that the Secretary may require, by publication in the Internal Revenue Bulletin, additional consent format and content requirements for purposes of consents to disclose a taxpayer's social security number. This revenue procedure defines an "adequate data protection safeguard" and describes the requirements of an adequate data protection safeguard for purposes of removing the limitation upon consents to disclose a taxpayer's social security number to a tax return preparer located outside of the United States.

SECTION 4. SCOPE

This revenue procedure applies to all tax return preparers, as defined in § 301.7216-1(b)(2), who seek consent to disclose or consent to use tax return information pursuant to § 301.7216-3 with respect to taxpayers who file a return in the Form 1040 series. Taxpayers who are not filers of returns in the Form 1040 series may use language prescribed in this revenue procedure or consents whose formats and content do not conform to this revenue procedure as long as the consents otherwise meet the requirements of Treas. Reg. § 301.7216-3.

SECTION 5. FORM AND CONTENT OF A CONSENT TO DISCLOSE OR A CONSENT TO USE FORM 1040 TAX RETURN INFORMATION

.01 Separate Written Document. Except as provided by § 301.7216-3(c)(1) (special rule for multiple disclosures or multiple uses within a single consent form), and described in section 5.05, below, a taxpayer's consent to each separate disclosure or separate use of tax return information must be contained on a separate written document, which can be furnished on paper or electronically. For example, the separate written document may be provided as an attachment to an engagement letter furnished to the taxpayer.

.02 A consent furnished to the taxpayer on paper must be provided on one or more sheets of 8 1/2 inch by 11 inch or larger paper. All of the text on each sheet of paper must pertain solely to the disclosure or use the consent authorizes, and the sheet or sheets, together, must contain all the elements described in section 5.04 and, if applicable, comply with section 5.06. All of the text on each sheet of paper must also be in at least 12-point type (no more than 12 characters per inch).

.03 A consent furnished in electronic form must be provided on one or more computer screens. All of the text placed by the preparer on each screen must pertain solely to the disclosure or use of tax return information authorized by the consent, except for computer navigation tools. The text of the consent must meet the following specifications: the size of the text must be at least the same size as, or larger than, the normal or standard body text used by the website or software package for direction, communications, or instructions and there must be sufficient contrast between the text and background colors. In addition, each screen or screens, together, must:

(1) contain all the elements described in section 5.04 and, if applicable, comply with section 5.06,

(2) be able to be signed as required by section 6 and dated by the taxpayer, and

(3) be able to be formatted in a readable and printer-friendly manner.

.04 Requirements for every consent. In addition to the requirements provided in § 301.7216-3, consents to disclose or use Form 1040 series tax return information must satisfy the following requirements:

(1) Mandatory statements in the consent. The following statements must be included in a consent under the circumstances described below, except that a tax return preparer may substitute the preparer's name where "we" or "our" is used.

(a) Consent to disclose tax return information in a context other than tax return preparation or auxiliary services. Unless a tax return preparer is obtaining a taxpayer's consent to disclose the taxpayer's tax return information to another tax return preparer to perform services that assist in, or to provide auxiliary services (as defined in § 301.7216-1(b)(2)(iii)) in connection with, the preparation of the taxpayer's tax return, any consent to disclose tax return information must contain the following statements in the following sequence:

(i) If the tax return information to be disclosed does not include the taxpayer's social security number or if the social security number is fully masked or otherwise redacted, consents for disclosure of tax return information to a tax return preparer outside of the United States must contain the following statement:

(3) Signature. All consents to disclose or use tax return information must be signed by the taxpayer.

(a) For consents on paper, the taxpayer's consent to a disclosure or use must contain the taxpayer's handwritten signature.

(b) For electronic consents, a taxpayer must sign the consent by any method prescribed in section 6, below.

(4) Incomplete consents. A tax return preparer shall not alter a consent form after the taxpayer has signed the document. Accordingly, a tax return preparer shall not present a taxpayer with a consent form containing blank spaces for the purpose of completing the spaces after the taxpayer has signed the document.

.05 Special rule for multiple disclosures within a single consent form or multiple uses within a single consent form. Section 301.7216-3(c)(1) provides that a taxpayer may consent to multiple uses within the same written document or multiple disclosures within the same written document. Disclosure consents and use consents must be provided in separate documents. Multiple disclosure consents and multiple use consents must provide the taxpayer with the opportunity, within the separate written document, to affirmatively select each separate disclosure or use. Further, the taxpayer must be provided the information in section 5.04 for each separate disclosure or use. The mandatory statements required in section 5.04(1) relating to disclosure or use need only be stated once in a multiple disclosure or multiple use consent.

.06 Disclosure of entire return. If, under § 301.7216-3(c)(2), a consent authorizes the disclosure of a copy of the taxpayer's entire tax return or all information contained within a return, the consent must provide that the taxpayer has the ability to request a more limited disclosure of tax return information as the taxpayer may direct.

.07 Adequate data protection safeguard. Pursuant to § 301.7216-3(b)(4), a tax return preparer located within the United States, including any territory or possession of the United States, may disclose a taxpayer's SSN to a tax return preparer located outside of the United States or any territory or possession of the United States with the taxpayer's consent only when both the tax return preparer located within the United States and the tax return preparer located outside of the United States maintain an adequate data protection safeguard at the time the taxpayer's consent is obtained and when making the disclosure. An adequate data protection safeguard is a management-approved and implemented security program, policy, and practice that includes administrative, technical, and physical safeguards to protect tax return information from misuse, unauthorized access, or disclosure and that meets or conforms to one of the following privacy or data security frameworks:

(1) The United States Department of Commerce "safe harbor" framework for data protection (or a successor program);

(2) A foreign law data protection safeguard that includes a security component (e.g., the European Commission's Directive on Data Protection);

(3) A framework that complies with the requirements of a financial or similar industry-specific standard that is generally accepted as best practices for technology and security related to that industry (e.g., the BITS, Financial Services Roundtable, Financial Institution Shared Assessment Program);

(4) The requirements of the AICPA/CICA Privacy Framework;

(5) The requirements of the most recent version of IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies and Entities; or

(6) Any other data security framework that provides the same level of privacy protection as contemplated by one or more of the frameworks described in (1) through (5).

SECTION 6. ELECTRONIC SIGNATURES

.01 If a taxpayer furnishes consent to disclose or consent to use tax return information electronically, the taxpayer must furnish the tax return preparer with an electronic signature that will verify that the taxpayer consented to the disclosure or use. The regulations under § 301.7216-3(a) require that the consent be knowing and voluntary. Therefore, for an electronic consent to be valid, it must be furnished in a manner that ensures affirmative, knowing consent of the taxpayer to each disclosure or use.

.02 A tax return preparer seeking to obtain a taxpayer's consent to the disclosure or consent to the use of tax return information electronically must obtain the taxpayer's signature on the consent in one of the following manners:

(a) Assign a personal identification number (PIN) that is at least 5 characters long to the taxpayer. To consent to the disclosure or consent to the use of the taxpayer's tax return information, the taxpayer may type in the pre-assigned PIN as the taxpayer's signature authorizing the disclosure or use. A PIN may not be automatically furnished by the software so that the taxpayer only has to click a button for consent to be furnished. The taxpayer must affirmatively enter the PIN for the electronic signature to be valid;

(b) Have the taxpayer type in the taxpayer's name and then hit "enter" to authorize the consent. The software must not automatically furnish the taxpayer's name so that the taxpayer only has to click a button to consent. The taxpayer must affirmatively type the taxpayer's name for the electronic consent to be valid; or

(c) Any other manner in which the taxpayer affirmatively enters 5 or more characters unique to the taxpayer that the tax return preparer uses to verify the taxpayer's identity. For example, entry of a response to a question regarding a shared secret could be the type of information by which the taxpayer authorizes disclosure or use of tax return information.

SECTION 7. EXAMPLES

.01 The application of this revenue procedure is illustrated by the following examples:

(1) Example 1. Preparer P offers tax preparation services over the Internet. P wishes to use information the taxpayer provides during tax preparation of the taxpayer's Form 1040 to generate targeted banner advertisements (i.e., electronic advertisements appearing on the computer screen based on the taxpayer's tax return information). In the course of advertising services and products, P also wishes to disclose to other third parties the information that the taxpayer provides.

(a) P posts, in pertinent part, the following consent on the computer screen for taxpayers to indicate approval. If a taxpayer does not indicate approval, the tax return preparation software does not permit the taxpayer to use the software.

(d) P has failed to comply with the requirements of § 301.7216-3 and this revenue procedure. P has attempted to obtain consent from the taxpayer by making the use of the program (i.e., the provision of tax return preparation services) contingent on the taxpayer's consent to P's disclosure and use of the taxpayer's tax return information for purposes other than tax preparation (e.g., for use in displaying targeted banner advertisement). Thus, the consent is not voluntary, as required by § 301.7216-3(a). P has also failed to identify the tax return information that it will disclose or use, as required by § 301.7216-3(a)(3)(C); to identify the purposes of the disclosures or uses, as required by section § 301.7216-3(a)(3)(B); and, to the extent that P intends to disclose the entire return based on the consent, P's consent form has not provided that the taxpayer has the ability to request a more limited disclosure of tax return information as the taxpayer may direct as required by section 5.06. The single document attempts to have the taxpayer consent to both disclosures and uses, in violation of section 5.05. P has not used the mandatory statements required by section 5.04(1). The consent is not signed by the taxpayer because P has not provided a means for the taxpayer to electronically sign the consent in a form authorized by section 6. Finally, the consent is not dated as required by section 5.03(2).

(2) Example 2. Preparer Q offers tax preparation services over the Internet and wishes to use targeted banner advertisements during tax return preparation. Q contracts with Bank A regarding the advertisement of Individual Retirement Accounts (IRAs). Preparer Q displays advertisements to the taxpayer only if the taxpayer's tax return information indicates that the services are relevant to the taxpayer (e.g., targeted banner advertisements). A taxpayer using Q's software must enter a password to begin the process of preparing a return.

(a) Before the taxpayer starts providing tax return information, the following screen appears on Q's tax preparation program.

(c) These two consent forms, above, satisfy the requirements of § 301.7216-3(c) and this revenue procedure for the disclosure or use of the information provided by the taxpayer for the specific purposes stated in the consent forms.

(3) Example 3. Large corporation C employs 200 expatriated employees who work in Belgium. Preparer R, located in the United States, prepares individual income tax returns for C's expatriated workers pursuant to a corporate plan for executive tax return preparation. Preparer R is affiliated with Preparer F, located in Belgium. Pursuant to the corporate plan for executive tax return preparation, Preparer R plans to provide the expatriated employees' tax return information, including the expatriated employees' SSNs, located on Preparer R's US based data servers to Preparer F who then plans to meet with the expatriated employees to prepare those employees' 2008 individual income tax returns. Preparer R obtains information electronically from various sources in anticipation of providing the information to Preparer F. Preparer R developed, adopted, and incorporated into its operations a data privacy program that meets the requirements of the AICPA/CICA Privacy Framework. Preparer F also developed, adopted, and incorporated into its operations a data privacy program, which is subject to the European Commission's Directive on Data Protection. The data privacy programs adopted by Preparer R and Preparer F are in operation at the time all consents to disclose are obtained by Preparer R and disclosures are made by Preparer R to Preparer F.

(a) Before transmitting or sending any expatriated employee's SSN to Preparer F, Preparer R provides the expatriated employee (taxpayer) with the following document.

(b) The consent above satisfies the requirements of section 301.7216-3 and this revenue procedure for the disclosure of the information provided by the taxpayer for the specific purpose stated in the consent form.

SECTION 8. EFFECT ON OTHER DOCUMENTS

Rev. Proc. 2008-35, 2008-29 I.R.B. 132, is modified and superseded.

SECTION 9. EFFECTIVE DATE

This revenue procedure is effective on January 14, 2013. During calendar year 2012, tax return preparers may use the mandatory language provided in section 5.04 of this revenue procedure or the language provided in section 4.04 of Rev. Proc. 2008-35. Any consent obtained on or after January 1, 2013 must contain the mandatory language provided in section 5.04 of this revenue procedure.

SECTION 10. DRAFTING INFORMATION

The principal authors of this revenue procedure are Skyler Bradbury and Emily M. Lesniak of the Office of the Associate Chief Counsel (Procedure and Administration). For further information regarding this revenue procedure contact Emily M. Lesniak at (202) 622-4910 (not a toll free call).