[BY EMAIL Notice.Comments@irscounsel.treas.

gov / Notice 2005-93 and E-Filing

REG-137243-02.]

March 8, 2006

CC:PA:RU (Notice 2005-93)

Room 5526
Internal Revenue Service
Ben Franklin Station
Washington, DC 20224

CC:PA:LPD:PR (REG-137243-02)
Room 5203
Internal Revenue Service
PO Box 7604
Ben Franklin Station
Washington, DC 20044

Re: Comments of the Center for Financial Privacy and Human Rights on
Notice 2005-93 and REG-137243-02 Concerning Secondary Use of Tax
Preparation Data

To Whom It May Concern:

CFPHR is a public interest research center in Washington, D.C. Established in 2005, the
Center for Financial Privacy and Human Rights is part of the Liberty and Privacy
Network and focuses on privacy, civil liberties and human rights including economic
rights.

We submit the comments below on Notice 2005-93 and proceeding REG-137243-02.1

While this proposed regulation only concerns tax preparers, a greater problem currently
ignored is the indiscriminate and impolitic sharing of information among governments.
The Internal Revenue Service, for instance, has a proposed regulation from the Clinton
years that would require collecting information on nonresident aliens with U.S. bank
accounts so that it could be shared with foreign governments. This not only would have
adverse consequences for the economy since it would drive deposits to foreign
jurisdictions, it also could compromise human rights. Many nations still oppress and
discriminate based on race, religion, political affiliation, economic status, and sexual
orientation. Other nations, meanwhile, suffer from corruption, high crime rates, financial
instability, and expropriation. Blanket information sharing among governments is a threat
to the civil liberties and human rights of people living in these types of jurisdictions.

1
IRS Issues Proposed Regulations to Safeguard Taxpayer Information, Internal Revenue Service, Dec. 7,
2005, available at http://www.irs.gov/newsroom/article/0,,id=151368,00.html

1
Certified Public Accountants prepare many tax returns and are bound by a code of ethics
that protect the client’s personal information and should not exempt from any additional
disclosure requirements so long as the entire company (including non-CPA staff) abide
by the ethical obligations.2 The new proposals risk initiating an unnecessary regulatory
burden on the smallest tax preparers who would be the least likely to use client
information for marketing purposes. A disproportionate regulatory burden on smaller
preparers would create an incentive mechanism to consolidate the industry and inhibit
new entrants thereby effectively rewarding those most likely to market personal
information and punish those that do not.

Introduction

Section 7216 of the Internal Revenue Code, 26 U.S.C. § 7216, prohibits tax return
preparers from using or disclosing tax return data except as allowed by Congress or by
the implementing regulations. The IRS drafted proposed changes to those regulations in
response to concerns about privacy problems created by the secondary marketing use of
tax information and the outsourcing of tax preparation services.3 The agency seeks to
safeguard taxpayer information by making knowing and voluntary consent a prerequisite
for disclosure of personal information.4

The proposed changes to the regulations represent an important effort to increase

taxpayers' awareness of what is done with their personal information. However, the
updated regulations fail to adequately safeguard taxpayer privacy because they neglect to
protect information once it is disclosed, allow consent that is less than voluntary, and
carry penalties that are not harsh enough to ensure tax return preparers obey the law.

Most importantly, taxpayers lose most of the protections for their private information
as soon as they consent to its disclosure. While the proposed regulations generally set a
high standard for consent, they give tax return preparers no incentive to make responsible
decisions about disclosure, and they often impose no obligations at all on the recipients of
disclosed information. Insufficient protections endanger consumer privacy. The British
tabloid The Sun demonstrated these risks to privacy when it purchased the details
associated with 1000 personal bank accounts from an Indian call center employee for
$5000.5

2
http://www.aicpa.org/about/code/et_300.html#et_301
Rule 301—Confidential client information: “A member in public practice shall not disclose any
confidential client information without the specific consent of the client.”
3
Statement of Rep. Edward U. Markey (D-Mass.) on Proposed Taxpayer Privacy Rules, Dec. 7, 2005,
available at http://www.irs.gov/newsroom/article/0,,id=151372,00.html
4
IRS Issues Proposed Regulations to Safeguard Taxpayer Information, Internal Revenue Service, Dec. 7,
2005, available at http://www.irs.gov/newsroom/article/0,,id=151368,00.html; Statement of Rep. Edward
U. Markey (D-Mass.) on Proposed Taxpayer Privacy Rules, Dec. 7, 2005, available at
http://www.irs.gov/newsroom/article/0,,id=151372,00.html
5
Transcript of Quentin McDermott's report into cyber-fraud, "Your Money and Your Life," Australian
Broadcasting Corporation, Aug. 15, 2005, available at
http://www.abc.net.au/4corners/content/2005/s1438338.htm

2
 Taxpayers entrust their tax return preparers with sensitive personal information, and
they deserve a guarantee of responsible behavior in return. Furthermore, preparers are in
a position to evaluate the credibility of third-party recipients of taxpayer information,
while consumers are not. In fact, in some cases, companies characterize their information
sharing relationships as "trusted" or otherwise vetted by some process to ensure their
integrity. In reality, these information sharing agreements will be made with almost any
company, and the offers to enter into one of these agreements are advertised to the world
on the Internet, not to a limited group of "trusted" partners.6

These factors should create an obligation for tax return preparers to refrain from
making disclosures without taking precautions to ensure the continued security of
taxpayer information. Instead, the proposed regulations give consumers a hollow right to
control over their personal information because consent to disclosure eliminates most
protections. If tax preparers will not take responsibility for the use of personal data by
information sharing partners, IRS should withdraw the consent rule and not allow
disclosures for marketing purposes whatsoever.

This problem is intensified by exceptions to the "knowing and voluntary" consent

standard. Tax return preparers are allowed to disclose information to other domestic
preparers, including the contractors who repair their equipment and software, without any
guarantee of credibility and without even informing the taxpayer. Such induced consent
is not truly voluntary because consumers will be unwilling to back out of the service
entirely by the time they receive the consent notice, and because they will be unable to
find affordable alternatives that do not impose the same conditions.

In addition to allowing involuntary consent, the regulations do not adequately ensure

that consent will be "knowing." They make an important start by setting minimum text
and paper sizes and requiring that all the text on a consent page relate to the disclosure or
use authorized. However, they do not ensure that, in practice, consumers will read and
understand the consent form. As the National Consumer Law Center [NCLC] notes in its
comments, time pressures and lack of English literacy may prevent taxpayers from
reading the consents they sign. We second the NCLC's recommended requirements for
preparers who use software to provide services in person. Preparers should be required to
obtain consent electronically, following the steps now required for electronic consent.
Additionally, the text of the consent should be read aloud by audio output. We agree that
this policy approach will be effective because it will draw greater attention to the consent.
It will also create an electronic trail, allowing the IRS to ascertain whether the required
process is followed.

Even if the regulations are changed to better protect taxpayer privacy, the current
penalties under Sections 7216 and 6713 are not harsh enough to deter tax return preparers
from breaking the law. Taxpayer information is very valuable, and many preparers may
decide that they stand to gain more from selling it than they are likely to lose through

6
Over 50,000 "datacards" advertising the sale of personal information are available online in the "List
Finder" section of Direct Magazine: http://www.directmag.com.

3
prosecution under § 7216. Penalties for violating the law not should merely be a cost of
doing business.

Specific Comments

1. §301.7216-1

A. Tax return preparer

The proposed definition of "tax return preparer" is appropriately broad. Importantly,

even preparers who do not charge a fee for tax return preparation services are included
within the definition. This inclusion will prevent preparers from offering free services in
order to collect and sell taxpayer information.

However, the proposed definition excludes employees of tax return preparers who do
not personally assist in the preparation of returns or assist in the provision of auxiliary
services. Any employee with access to tax return information should be prohibited from
using or disclosing it.

B. Tax return information

We strongly support the inclusion of all information "furnished in any form or

manner for, or in connection with," preparation of the taxpayer's tax return within the
definition of "tax return information." All such information is provided in order to
receive tax preparation services, so the taxpayer should be able to limit its use to
legitimate tax return preparation purposes.

However, § 301.7216-1(b)(3)(ii) Example 1 could be read to imply that information

supplied to register tax preparation software is not tax return information unless the tax
return preparer states during the registration process that it will provide updates to
registrants. Because consumers furnish registration information in connection with return
preparation and for the purpose of receiving tax preparation services, registration
information falls within the definition of tax return information regardless of whether the
preparer advertises or provides software updates. We recommend the revision of
Example 1 to clearly indicate that all information supplied to register tax preparation
software is tax return information.

C. Use

"Use" is narrowly defined by the regulation as any circumstance where a covered

entity "refers to, or relies upon, tax return information as the basis to take or permit an
action." IRS should expand the definition of "use" to include all foreseeable situations
where the preparer accesses the information.

The regulations currently afford very little protection for tax return information after
the taxpayer consents to disclosure. They allow preparers to condition service on

4
disclosure to contractors but give them no incentive to ensure that those contractors do
not abuse the information. To encourage preparers to disclose information responsibly,
use by a preparer should include subsequent use by a person to whom the preparer
discloses information.

D. Disclosure

Importantly, the regulations clarify that disclosure includes any affirmative manner of
making information known to any person. However, the definition of disclosure should
be expanded to include situations where tax return preparers merely make information
available passively, by inaction (for instance, where a preparer leaves information on a
desk or on a computer screen that a passerby or other unauthorized person can see). Tax
return preparers are entrusted with sensitive personal information, so they should be
responsible for safeguarding information rather than just refraining from willfully making
it known. This distinction could be important regarding employees who are excluded
from the definition of "tax return preparer" under § 301.7216-1(b)(2)(i)(D).

"Disclosure" by a tax return preparer should also include subsequent disclosure by a

third party to whom the tax return preparer makes information available. As discussed
above, the regulations currently allow preparers to condition service on disclosure to
contractors but give them no incentive to ensure that those contractors do not abuse the
information. Extending the definition of disclosure would encourage preparers to make
responsible decisions about contracting out tax return preparation. In the marketing
industry, it is routine to sell a customer list under the condition that the recipient not re-
disclose the information to others. Marketers even "seed" their lists with dummy
addresses that are monitored to catch recipients who use the list more than once or those
who resell the information. Similar procedures should be in effect to prevent a chain of
reselling of tax return information.

2. §301.7216-2

A. Disclosures to other tax return preparers

The exception to the consent requirement for disclosures to other tax return preparers
inappropriately weakens the "knowing and voluntary" consent requirement. Consumers
should be informed before their information is passed to third parties. Although all tax
return preparers who receive taxpayer information are technically bound by the consent
requirements of § 7216, this protection becomes less effective as information is passed to
small, amorphous providers who may be difficult to track for enforcement purposes.

If the IRS does create an exception for disclosures made to contractors, the
regulations should require disclosing tax return preparers to take affirmative steps to
prevent misuse of the information by the third-party recipients. Disclosing preparers
should be required to have audited security measures in place to protect the security and
authenticity of data. Furthermore, as in the proposed regulations, disclosure should be
limited to the extent necessary for the contractor to perform the services.

5
 B. Certain disclosures by attorneys and accountants

Section 301.7216-2(h)(2) states that tax return preparers are permitted to use or
disclose a taxpayer's information in the course of performing services for another client if
"the information is, or may be, relevant to the subject matter of the legal or accounting
services for the other client, and consideration of the information by those performing the
services is necessary for the proper performance of the services." However, the
regulation does not clearly limit the exception to such situations. It should state that use
and disclosure are only permissible when relevant and necessary.

C. Payment for tax preparation services

As the regulations recognize, information the taxpayer provides to pay for tax
preparation services is tax return information. The regulations appropriately limit the use
and disclosure of such information to the extent necessary to process the payment and to
the information relevant to the payment.

D. Producing statistical information in connection with tax return preparation

business

The proposed regulations appear to allow the use of a statistical compilation of data
for the internal management or support of the tax return preparer's tax return preparation
business. This exception should be reduced to use for internal management, because
"support" could be interpreted as financial support, allowing a tax return preparer to
target specific customers with advertising.

3. §301.7216-3

A. Taxpayer consent

We strongly support the knowing and voluntary standard for taxpayer consent. If
taxpayers do not actually understand what they are agreeing to, the consent requirement
offers them no protection.

Importantly, the regulations generally prohibit preparers from conditioning service on

consent. Conditioning service on consent makes consent involuntary because the
consumer is likely to have committed to the service before the consent is requested, and
is unlikely to find substantially different options elsewhere.

Even where service cannot be conditioned on consent, consumers may assume that
they will be refused service if they decline consent. To prevent taxpayers from
consenting because they erroneously believe that they must do so, the revenue procedure
should require requests for consent to state that taxpayers will not be refused service if
they decline to consent.

6
 Additionally, the use or disclosure authorized by a consent should be limited to the
information necessary to accomplish the purpose of the consent.

B. Disclosure of entire return

We strongly oppose the provision authorizing the disclosure of an entire return.

Disclosure of a full return is never necessary for marketing. Marketers target individuals
by categorizing them, and they do not need full returns to group consumers. Income
ranges and other general facts will suffice.

3. Notice 2005-93

A. Separate written document

We strongly support the provisions requiring the notice and consent disclosures to
appear on a separate piece of paper. In other situations, companies have attempted to
obfuscate notice by providing it on papers integrated with a bill. Having the disclosure
on a separate sheet of paper or computer screen will increase the likelihood that
consumers see and read the notice. The minimum standards for paper and text size will
also improve readability.

B. Identification of tax return information to be disclosed or used

We support the requirement that the consent specify the particular items of tax return
information to be disclosed or used. However, the information used or disclosed should
be limited to information necessary to accomplish the purpose of the use or disclosure.

C. Mandatory statements in the consent

Contrary to the required warning, taxpayers' privacy rights should not end when they
consent to disclosure. Consumers entrust tax return preparers with sensitive personal
information. Furthermore, preparers are in a position to evaluate third-party recipients of
taxpayer information, while consumers are not. These factors should create an obligation
to refrain from making disclosures without taking precautions to ensure the continued
security of taxpayer information. Tax return preparers should be required to audit the
people who receive information from them, and held responsible for abuse of information
by those third parties. The mandatory warning should reflect this situation. If preparers
cannot guarantee that information will be handled ethically and securely, there should be
no consent option.

While the regulations properly require the tax return preparer to include certain
statements in the consent, they should place stricter limits on what preparers may add to
those statements. Section 4.01 appropriately requires that all text on the consent form
pertain solely to the disclosure or use authorized. However, this requirement does not
prevent a preparer from distracting taxpayers with long, misleading, or dull narratives.

7
The text of consent forms should be limited to the mandatory statements and a succinct
explanation of the use or disclosure.

D. Affirmative consent

We strongly support the affirmative consent requirement. Opt-out choice is not

knowing and voluntary because it does not sufficiently direct the taxpayer's attention to
the consent being given. Opt-out consent decreases the likelihood that the consumer will
read and process the agreement.

E. Electronic signatures

We strongly suggest that taxpayers be required to physically enter a statement to

indicate that they are willing to have their tax information disclosed. This requirement
will force consumers to pay more attention to the consent process, increasing the
likelihood that they see and read the notice. For instance, instead of typing in the
customer's name in the form to express consent, the preparer could obtain a statement
such as: "Although I am not required to do so, I give my consent for my tax information
to be sold" or "I have taken the option to waive my right to keep my return information
secret."

F. Examples

Example 2 allows the tax return preparer to make false statements in the request for
consent. The hypothetical provider states that it must disclose taxpayer information to
provide the taxpayer with information on IRAs or RALs. This claim is clearly
untrue—the preparer could easily provide the customer with information about the
services simply by providing a pamphlet or a link to an instructive website. The
misrepresentation hides the fact that the preparer is selling the customer's personal
information, and makes the disclosures authorized appear benign and necessary.

Respectfully Submitted,

Center for Financial Privacy and Human Rights