One of the forces driving the Privacy Act of 1974 into existence was congressional concern about the government’s use of computer systems in which to keep records about individuals. The Act's preamble points out the possibility of automated record keeping greatly magnifying the potential harm to record subjects.

Due to the steady automation of government programs, automated records play a significant and pervasive role in federal record keeping. The CMPPA is the first amendment to the Privacy Act to address the concern of automated records impacting individual privacy by establishing protections, including public and individual notice, when information an individual provides to one government agency is matched with records from another agency for a different purpose.

The following statutes contain laws that relate to or impact the CMPPA:

Before September 30, 1997, computer matching programs (inter- and intra-agency) subject to the CMPPA were programs administered by Governmental Liaison and Disclosure.

The Chief Privacy Officer (CPO) is responsible for representing the IRS as a member of the Treasury Data Integrity Board (DIB) and is the executive director responsible for the IRS Privacy Program, including statutory oversight of IRS security and confidentiality requirements for federal and state agencies receiving federal tax return and return information, collectively referred to as federal tax information (FTI).

Privacy Policy and Compliance (PPC) is responsible for Privacy Act oversight, ensuring the IRS implements sound policies designed to protect the identity and privacy of employees and taxpayers.

Governmental Liaison, Disclosure and Safeguards (GLDS) is responsible for overseeing the computer matching provisions of the CMPPA, ensuring FTI is appropriately disclosed and ensuring FTI provided to federal, state and local agencies remains confidential. Through its functions, GLDS provides administration, guidance, support and technical assistance to the IRS Business and Functional Operating Division (BOD/FOD), as owner of the records, in the development of computer matching programs, agreements, notices and reports.

Business and Functional Operating Division (BOD/FOD), as owner of the records, is responsible for contacting Data Services, via e-mail at GLDS.CMPPA@irs.gov, to coordinate and prepare notices and reports required and appropriate for CMPPA matching program participation.

Due to the increase in the number of records systems being developed, and as IRS moves towards more cooperative activities with state and local agencies, the potential has increased that matches with non-federal agencies at the area and territory levels will also be subject to the CMPPA provisions. It is incumbent on Disclosure field personnel to become familiar with the provisions of the CMPPA so they can advise and assist with achieving compliance with the CMPPA when a covered match is identified.

Data Exchange and Quality Initiatives (DEQI), under Data Services, is responsible for program management, including operation and maintenance. A senior data analyst within DEQI is assigned to manage the program and coordinate all required activities with internal and external stakeholders. Program activities include, but are not limited to:

The senior data analyst will review output reports through Control-D, as well as reports received directly from IT programmers, and account for disclosures made to federal, state, and local agencies participating in one or more computer matching programs throughout each calendar year. Annual accounting reports will be made available to the IRS Safeguards for agency reviews and for IRS reporting to the Joint Committee on Taxation.

Data Services regularly reports program status through the Director, Governmental Liaison, Disclosure, and Safeguards to the IRS CPO through weekly briefings, quarterly operation reviews, and required annual reporting.

The senior data analyst within DEQI will conduct a servicewide review annually of that year’s CMPPA covered matching program activities and prepare an annual report of the matching programs for the IRS. The annual report will be submitted by the CPO to the Department of Treasury Senior Agency Official for Privacy to be included in Treasury’s annual report to OMB.

An annual matching review and report is required per OMB Circular A-108. The report will include a list of each matching program in which the agency participated during the year. For each matching program, the report will include:

The following table provides acronyms that are used throughout this IRM section:

IRM 1.1.27, Organization and Staffing, Privacy, Governmental Liaison and Disclosure (PGLD)

IRM 1.2.2.12.2, Delegation Order 11-2

IRM 1.10.1, Office of the Commissioner of Internal Revenue, Correspondence Manual

Computer Matching Programs: https://home.treasury.gov/footer/privacy-act/computer-matching-programs

National Archives and Records Administration (NARA), IRS Records Control Schedules (RCS): https://www.archives.gov/records-mgmt/rcs/schedules/index.html

Office of Management and Budget (OMB) Circular No. A-108, Federal Agency Responsibilities for Review, Reporting and Publication under the Privacy Act: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A108/omb_circular_a-108.pdf

Office of Management and Budget (OMB) Circular No. A-130, Managing Information as a Strategic Resource: https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf

Privacy Act Directives: https://home.treasury.gov/footer/privacy-act/privacy-directives

Privacy Act Reports: https://home.treasury.gov/footer/privacy-act/privacy-reports

The Privacy Act Handbook: https://www.treasury.gov/privacy/Pages/handbook.aspx

System of Records Notices (SORNs): https://home.treasury.gov/footer/privacy-act/system-of-records-notices-sorns

Certain matching programs are exempt from the requirements of the CMPPA. For disclosure purposes, the most pertinent exemptions are those which exclude matches done for the purposes of:

Although the CMPPA exempts matches performed for tax administration purposes, OMB final guidance on implementing the provisions of the CMPPA expressly states that matches for management of the IRS workforce are not included in the Act’s exemption of matching program requirements for tax administration purposes.

The CMPPA does not exclude matches conducted by an agency using only records from systems of records maintained by that agency, if the purpose of the match is not to take any adverse financial, personnel, disciplinary, or other adverse action against federal personnel.

Matches involving federal employees conducted by Treasury Inspector General for Tax Administration (TIGTA) are exempt from the CMPPA under the Inspector General Act of 1978, as amended by the Inspector General Empowerment Act of 2016 (PL 114-317).

See 5 U.S.C. 552a(a)(8)(B) for the complete list of exempt matches.

Pursuant to 5 U.S.C. 552a(o) Matching Agreements, no record which is contained in a system of records may be disclosed for use in a computer matching program except pursuant to a CMA between the agencies.

The IRS frequently conducts the same matching program for several different agencies; the match for each agency is considered a single matching program, thus requiring a CMA with each agency.

The type of CMA must be determined in accordance with OMB Circular A-108 and identified in IRM 11.3.39.2.

Data Services will coordinate with the BOD/FOD to appropriately draft and negotiate the CMA language with the other agency or other IRS function. According to the CMPPA, the CMA must specify the following:

After each party to the CMA concurs with the agreement language, the final draft will be signed by the responsible official for each agency, at least 180 days prior to scheduled implementation of the matching program. The responsible official is considered the system manager or the head of the organizational unit who has delegated authority to perform Privacy Act activities in accordance with Treasury Directive 25-04.

Data Services will submit the CMA, signed by each party to the agreement, to the Treasury DIB, via e-mail to Privacy@treasury.gov for review and approval by the Board. In accordance with Treasury Directive 25-06, the Board will:

Upon the Board’s approval, the Treasury DIB Chairperson will sign the CMA and the Treasury DIB Liaison will return the CMA to Data Services.

Data Services will coordinate with Treasury to report the matching program to Congress and OMB, if required and per OMB Circular A-108 guidance.

When preparing the CMA, Data Services and the BOD/FOD must consider the systems of records to be used in the matching program. The routine use cited in the existing system notice must encompass the proposed matching program. If not, the system notice must be republished to modify the routine use statement prior to submitting the CMA for review by the Treasury DIB.

In addition, the data resulting from the matching program must be considered. If the data match results in a new system of records, then a new system notice must also be published.

The initial CMA will remain in effect for a period not to exceed 18 months. During the last 90 days of the existing CMA, the parties to the CMA will approve a one-time renewal, not to exceed 12 months. The renewal CMA does not require notice and reports to Congress and OMB and publication in the Federal Register.

Upon expiration of the initial CMA and one-time renewal CMA, a re-establishment CMA must be secured to continue the matching program. A re-establishment CMA must be fully executed within the last 90 days of the original CMA, or renewal CMA, if applicable. The re-establishment CMA requires the same notice, reporting and publication requirements as the initial CMA. The format for the initial CMA must be used for the re-establishment CMA.

Agencies participating in matching programs that are subject to CMPPA are required to publish a matching notice in the Federal Register at least 30 days prior to the establishment, re-establishment, or significant modification of the matching program. Examples of significant modifications are cited in OMB Circular A-108.

Agencies are required to report to OMB and Congress any proposal to establish, re-establish, or significantly modify a matching program at least 30 days prior to the submission of the notice to the Federal Register for publication.

When the IRS is the recipient agency (or federal agency when the matching program is conducted with a non-federal agency), the IRS will notify records subjects in one of two ways, either by constructive notice or direct notice.

For the IRS matching programs designed to detect fraud and/or illegal acts of agency employees, the IRS will ensure that direct notice is provided to each record subject. While Document 12011, Internal Revenue Service Ethics Handbook, universally prohibits fraud or inappropriate actions on the part of its employees, a specific notice to each record subject regarding the matching program will be provided prior to the implementation of the matching program and, at the least, an annual notice during the period the matching program is authorized.

Notice published in the Federal Register must contain the following information:

The IRS must publish notices of the establishment, re-establishment or modification of a matching program in the Federal Register at least 30 days prior to conducting the matching program.