RP-2008-35

This revenue procedure provides guidance to tax return preparers regarding the format and content of consents to disclose and consents to use tax return information with respect to taxpayers filing a return in the Form 1040 series, e.g., Form 1040, Form 1040NR, Form 1040A, or Form 1040EZ, under section 301.7216-3 of the Regulations on Procedure and Administration (26 CFR Part 301). This revenue procedure also provides specific requirements for electronic signatures when a taxpayer executes an electronic consent to the disclosure or use of the taxpayer’s tax return information. This revenue procedure modifies and supersedes Revenue Procedure 2008-12, 2008-5 I.R.B. 368, to provide guidance pursuant to section 301.7216-3T(b)(4)(ii).

.01 In general, section 7216(a) of the Internal Revenue Code imposes criminal penalties on tax return preparers who knowingly or recklessly make unauthorized disclosures or uses of information furnished in connection with the preparation of an income tax return. A violation of section 7216 is a misdemeanor, with a maximum penalty of up to one year imprisonment or a fine of not more than $1,000, or both, together with the costs of prosecution. Section 7216(b) establishes exceptions to the general rule in section 7216(a) and also authorizes the Secretary to promulgate regulations prescribing additional permitted disclosures and uses.

.02 Section 6713(a) prescribes a related civil penalty for unauthorized disclosures or uses of information furnished in connection with the preparation of an income tax return. The penalty for violating section 6713 is $250 for each disclosure or use, not to exceed a total of $10,000 for a calendar year. Section 6713(b) provides that the exceptions in section 7216(b) also apply to section 6713.

.03 Section 301.7216-3 provides that, unless section 7216 or §301.7216-2 specifically permits the disclosure or use of tax return information, a tax return preparer may not disclose or use a taxpayer’s tax return information prior to obtaining a consent from the taxpayer. Section 301.7216-3(a) provides that consent must be knowing and voluntary. Section 301.7216-3(a)(3)(i) prescribes the form and content requirements that all consents to disclose or use must include. Sections 301.7216-3(b) and 301.7216-3T(b) provide timing requirements and other limitations upon consents to disclose or use tax return information. Section 301.7216-3T(b)(4) provides a limitation upon consents to disclose a taxpayer’s social security number to a tax return preparer located outside of the United States.

.04 Section 301.7216-3(a)(3)(ii) provides that the Secretary may, by publication in the Internal Revenue Bulletin, prescribe additional requirements for tax return preparers regarding the format and content of consents to disclose and consents to use tax return information with respect to taxpayers filing a return in the Form 1040 series, as well as the requirements for a valid signature on an electronic consent under section 7216. Section 301.7216-3T(b)(4)(ii) provides that the Secretary may, by publication in the Internal Revenue Bulletin, describe the requirements of an “adequate data protection safeguard” for purposes of removing the limitation upon consents to disclose a taxpayer’s social security number to a tax return preparer located outside of the United States. This revenue procedure provides additional consent format and content requirements and defines an “adequate data protection safeguard.”

This revenue procedure applies to all tax return preparers, as defined in §301.7216-1(b)(2), who seek consent to disclose or use tax return information pursuant to §§301.7216-3 and 301.7216-3T with respect to taxpayers who file a return in the Form 1040 series, e.g., Form 1040, Form 1040NR, Form 1040A, or Form 1040EZ.

.01 Separate Written Document. Except as provided by §301.7216-3(c)(1) (special rule for multiple disclosures or uses within a single consent form), and described in section 4.05, below, a taxpayer’s consent to each separate disclosure or use of tax return information must be contained on a separate written document, which can be furnished on paper or electronically. For example, the separate written document may be provided as an attachment to an engagement letter furnished to the taxpayer.

.02 A consent furnished to the taxpayer on paper must be provided on one or more sheets of 8¹/₂ inch by 11 inch or larger paper. All of the text on each sheet of paper must pertain solely to the disclosure or use the consent authorizes, and the sheet or sheets, together, must contain all the elements described in section 4.04 and, if applicable, comply with section 4.06. All of the text on each sheet of paper must also be in at least 12-point type (no more than 12 characters per inch).

.03 An electronic consent must be provided on one or more computer screens. All of the text placed by the preparer on each screen must pertain solely to the disclosure or use of tax return information authorized by the consent, except for computer navigation tools. The text of the consent must meet the following specifications: the size of the text must be at least the same size as, or larger than, the normal or standard body text used by the website or software package for direction, communications or instructions and there must be sufficient contrast between the text and background colors. In addition, each screen or, together, the screens must—

(1) contain all the elements described in section 4.04 and, if applicable, comply with section 4.06,

(2) be able to be signed as required by section 5 and dated by the taxpayer,

(3) be able to be formatted in a readable and printer-friendly manner.

.04 Requirements for Every Consent. In addition to the requirements provided in §301.7216-3, consents to disclose or use Form 1040 series tax return information must satisfy the following requirements—

(1) Mandatory statements in the consent. The following statements must be included in a consent under the circumstances described below, except that a tax return preparer may substitute the preparer’s name where “we” or “our” is used.

(a) Consent to disclose tax return information in context other than tax preparation or auxiliary services. Unless a tax return preparer is obtaining a taxpayer’s consent to disclose the taxpayer’s tax return information to another tax return preparer for the purpose of performing services that assist in the preparation of, or provide auxiliary services (as defined in §301.7216-1(b)(2)(ii)) in connection with the preparation of, the tax return of the taxpayer, any consent to disclose tax return information must contain the following statements in the following sequence:

(b) Consent to disclose tax return information in tax preparation or auxiliary services context. If a tax return preparer is otherwise required to obtain a taxpayer’s consent to disclose the taxpayer’s tax return information to another tax return preparer for the purpose of performing services that assist in the preparation of, or provide auxiliary services (as defined in §301.7216-1(b)(2)(ii)) in connection with the preparation of, the tax return of the taxpayer, any consent to disclose tax return information must contain the following statements in the following sequence:

(c) Consent to use. All consents to use tax return information must contain the following statements in the following sequence:

(d) All consents must contain the following statement:

(e) Mandatory statement in any consent to disclose tax return information to a tax return preparer located outside of the United States. If a tax return preparer to whom the tax return information is to be disclosed is located outside of the United States, the taxpayer’s consent under §301.7216-3 prior to any disclosure is required. See §§ 301.7216-3(a)(3)(i)(D), 301.7216-2(c) and (d).

(i) If the tax return information to be disclosed does not include the taxpayer’s social security number, or if the social security number is fully masked or otherwise redacted, consents for disclosure of tax return information to a tax return preparer outside of the United States must contain the following statement:

(ii) If the tax return information to be disclosed includes the taxpayer’s social security number, or if the social security number is not fully masked or otherwise redacted, pursuant to the limitations of §301.7216-3T(b)(4) and section 4.07, consents for disclosure of the taxpayer’s tax return information including a social security number to a tax return preparer outside of the United States must contain the following statement:

(2) Affirmative consent. All consents must require the taxpayer’s affirmative consent to a tax return preparer’s disclosure or use of tax return information. A consent that requires the taxpayer to remove or “deselect” disclosures or uses that the taxpayer does not wish to be made, i.e., an “opt-out” consent, is not permitted.

(3) Signature. All consents to disclose or use tax return information must be signed by the taxpayer.

(a) For consents on paper, the taxpayer’s consent to a disclosure or use must contain the taxpayer’s signature.

(b) For electronic consents, a taxpayer must sign the consent by any method prescribed in section 5, below.

(4) Incomplete consents. A tax return preparer shall not present a consent form with blank spaces related to the purpose of the consent to the taxpayer for signature.

.05 Special rule for multiple disclosures within a single consent form or multiple uses within a single consent form. Section 301.7216-3(c)(1) provides that a taxpayer may consent to multiple uses within the same written document, or multiple disclosures within the same written document. Multiple disclosure consents and multiple use consents must provide the taxpayer with the opportunity, within the separate written document, to affirmatively select each separate disclosure or use. Further, the taxpayer must be provided the information in section 4.04 for each separate disclosure or use. The mandatory statements required in section 4.04(1) relating to use or disclosure need only be stated once in a multiple disclosure or multiple use consent.

.06 Disclosure of entire return. If, under §301.7216-3(c)(2), a consent authorizes the disclosure of a copy of the taxpayer’s entire tax return or all information contained within a return, the consent must provide that the taxpayer has the ability to request a more limited disclosure of tax return information as the taxpayer may direct.

.07 Adequate data protection safeguard. Pursuant to §301.7216-3T(b)(4), a tax return preparer located within the United States, including any territory or possession of the United States, may disclose a taxpayer’s SSN to a tax return preparer located outside of the United States or any territory or possession of the United States with the taxpayer’s consent only when both the tax return preparer located within the United States and the tax return preparer located outside of the United States maintain an adequate data protection safeguard at the time the taxpayer’s consent is obtained and when making the disclosure. An “adequate data protection safeguard” is a security program, policy and practice that has been approved by management and implemented that includes administrative, technical and physical safeguards to protect tax return information from misuse or unauthorized access or disclosure and that meets or conforms to one of the following privacy or data security frameworks:

(1) The United States Department of Commerce “safe harbor” framework for data protection (or successor program);

(2) A foreign law data protection safeguard that includes a security component, e.g., the European Commission’s Directive on Data Protection;

(3) A framework that complies with the requirements of a financial or similar industry-specific standard that is generally accepted as best practices for technology and security related to that industry, e.g., the BITS (Financial Services Roundtable) Financial Institution Shared Assessment Program;

(4) The requirements of the AICPA/CICA Privacy Framework;

(5) The requirements of the most recent version of IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies and Entities; or

(6) Any other data security framework that provides the same level of privacy protection as contemplated by one or more of the frameworks described in (1) through (5).

.01 If a taxpayer furnishes consent to disclose or use tax return information electronically, the taxpayer must furnish the tax return preparer with an electronic signature that will verify that the taxpayer consented to the disclosure or use. The regulations under §301.7216-3(a) require that the consent be knowing and voluntary. Therefore, for an electronic consent to be valid, it must be furnished in a manner that ensures affirmative, knowing consent to each disclosure or use.

.02 A tax return preparer seeking to obtain a taxpayer’s consent to the disclosure or use of tax return information electronically must obtain the taxpayer’s signature on the consent in one of the following manners:

(a) Assign a personal identification number (PIN) that is at least 5 characters long to the taxpayer. To consent to the disclosure or use of the taxpayer’s tax return information, the taxpayer may type in the pre-assigned PIN as the taxpayer’s signature authorizing the disclosure or use. A PIN may not be automatically furnished by the software so that the taxpayer only has to click a button for consent to be furnished. The taxpayer must affirmatively enter the PIN for the electronic signature to be valid;

(b) Have the taxpayer type in the taxpayer’s name and then hit “enter” to authorize the consent. The software must not automatically furnish the taxpayer’s name so that the taxpayer only has to click a button to consent. The taxpayer must affirmatively type the taxpayer’s name for the electronic consent to be valid; or

(c) Any other manner in which the taxpayer affirmatively enters 5 or more characters that are unique to that taxpayer that are used by the tax return preparer to verify the taxpayer’s identity. For example, entry of a response to a question regarding a shared secret could be the type of information by which the taxpayer authorizes disclosure or use of tax return information.

.01 The application of this revenue procedure is illustrated by the following examples:

(1) Example 1. Preparer P offers tax preparation services over the Internet. P wishes to use information the taxpayer provides during tax preparation of the taxpayer’s Form 1040 to generate targeted banner advertisements (i.e., electronic advertisements appearing on the computer screen based on the taxpayer’s tax return information). In the course of advertising services and products, P wishes also to disclose to other third parties information that the taxpayer provides.

(a) P posts, in pertinent part, the following consent on the computer screen for taxpayers to indicate approval. If a taxpayer does not indicate approval, the tax return preparation software does not permit the taxpayer to use the software.

(b) Beneath this Privacy Statement, the following acknowledgment line appears next to two button images stating “yes” and “no:”

“I have read the Privacy Statement and agree to it by clicking here.”

(c) If the taxpayer clicks “no,” a message appears on the screen informing the taxpayer that tax return preparation will not proceed without the taxpayer agreeing to the company’s Privacy Statement.

(d) P has failed to comply with the requirements of §301.7216-3 and this revenue procedure. P has attempted to obtain consent from the taxpayer by making the use of the program contingent on the taxpayer’s consent to P’s disclosure and use of the taxpayer’s tax return information for purposes other than tax preparation (e.g., for use in displaying targeted banner advertisement). Thus, the consent is not voluntary, as required by §301.7216-3(a). P has also failed to identify the tax return information that it will disclose or use, as required by §301.7216-3(a)(3)(C), to identify the purposes of the disclosures and uses, as required by section §301.7216-3(a)(3)(B), and to the extent that P intends to disclose the entire return based on the consent, P’s consent has not provided that the taxpayer has the ability to request a more limited disclosure of tax return information as the taxpayer may direct as required by section 4.06. The single document attempts to have the taxpayer consent to both disclosures and uses, in violation of section 4.05. P has not used the mandatory statements required by section 4.04(1). The consent is not signed by the taxpayer because P has not provided a means for the taxpayer to electronically sign the consent in a form authorized by section 5. Finally, the consent is not dated as required by section 4.03(2).

(2) Example 2. Preparer Q offers tax preparation services over the Internet and wishes to use targeted banner advertisements during tax return preparation. Q contracts with Bank A regarding the advertisement of Individual Retirement Accounts (IRAs). Preparer Q displays advertisements to the taxpayer only if the taxpayer’s tax return information indicates that the services are relevant to the taxpayer (i.e., they are targeted banner advertisements). A taxpayer using Q’s software must enter a password to begin the process of preparing a return.

(a) Before the taxpayer starts providing tax return information, the following screen appears on Q’s tax preparation program.

(b) If the taxpayer selects the consent above, the taxpayer is directed to print the screen. Later, after the taxpayer has entered data to prepare his or her 2006 tax return, the following screen is displayed:

If the taxpayer consents to the disclosure of the tax return information using the screen above, the taxpayer is directed to print the screen. Q will then transmit only that portion of the taxpayer’s tax return information for 2006 that is necessary for the bank authorized in the consent, Bank A, to provide the service.

(c) These two consent documents, above, satisfy the requirements of §301.7216-3(c) and this revenue procedure for the disclosure or use of the information provided therein for the specific purposes stated.

(3) Example 3. Large corporation C employs 200 expatriated employees who work in Belgium. Preparer R, located in the United States, prepares individual income tax returns for C’s expatriated workers pursuant to a corporate plan for executive tax return preparation. Preparer R is affiliated with Preparer F, located in Belgium. Pursuant to the corporate plan for executive tax return preparation, Preparer R plans to provide the expatriated employees’ tax return information, including the expatriated employees’ SSNs, located on Preparer R’s U.S. based data servers to Preparer F who then plans to meet with the expatriated employees to prepare those employees’ 2008 individual income tax returns. Preparer R obtains information electronically from various sources in anticipation of providing the information to Preparer F. Preparer R developed, adopted and incorporated into its operations a data privacy program which meets the requirements of the AICPA/CICA Privacy Framework. Preparer F also developed, adopted and incorporated into its operations a data privacy program and Preparer F’s data privacy program is subject to the European Commission’s Directive on Data Protection. The data privacy programs adopted by Preparer R and Preparer F are in operation at the time all consents to disclose are obtained by Preparer R and disclosures are made by Preparer R to Preparer F.

(a) Before transmitting or sending any expatriated employee’s SSN to Preparer F, Preparer R provides the expatriated employee (taxpayer) with the following document.

The taxpayer provides consent by checking the box and signing and dating the consent form. Preparer R then provides a copy of the signed and dated consent form to the taxpayer, and then transmits the taxpayer’s tax return information to Preparer F for processing of taxpayer’s 2008 individual income tax return.

(b) The consent above satisfies the requirements of §§ 301.7216-3, 301.7216-3T and this revenue procedure for the disclosure of the information provided therein for the specific purpose stated.

.01 Rev. Proc. 2008-12, 2008-5 I.R.B. 368, is modified and superseded.

This revenue procedure is effective on January 1, 2009.

The principal author of this revenue procedure is Lawrence Mack of the Office of Associate Chief Counsel (Procedure & Administration). For further information regarding this revenue procedure, contact Lawrence Mack at (202) 622-4940 (not a toll-free call).