Under the Taxpayer First Act (TFA), are we required to obtain a taxpayer’s express permission to share their tax return information only if we obtain it from the IRS, as opposed to receiving it directly from the taxpayer?

Yes, the TFA’s consent requirement applies only to tax return information provided by the IRS. However, a customer’s tax return information remains subject financial privacy laws, which may require the customer’s consent before disclosure to a third party, unless an exception applies.

The TFA amended the Internal Revenue Code to require that “[p]ersons designated by the taxpayer under this subsection to receive return information shall not use the information for any purpose other than the express purpose for which consent was granted and shall not disclose return information to any other person without the express permission of, or request by, the taxpayer.” This consent requirement applies when the “Secretary [of the Treasury]” discloses “the return of any taxpayer, or return information with respect to such taxpayer, to such person or persons as the taxpayer may designate . . . .” Consequently, the TFA’s consent requirement should apply only when the IRS provides a taxpayer’s tax return information to a person designated by the taxpayer, not when a taxpayer provides its own tax return information directly to a person.

However, a customer’s tax return information remains protected by both Illinois and federal privacy laws and, absent an exception, should not be shared with third parties without the customer’s consent. For example, Regulation P includes an exception to its opt-out requirements for sharing information with examiners, but there may be other situations to which no exception applies and for which your customer’s consent will be required.

For resources related to our guidance, please see:

Internal Revenue Code, 26 USC 6103(c) (“The Secretary may, subject to such requirements and conditions as he may prescribe by regulations, disclose the return of any taxpayer, or return information with respect to such taxpayer, to such person or persons as the taxpayer may designate in a request for or consent to such disclosure, or to any other person at the taxpayer’s request to the extent necessary to comply with a request for information or assistance made by the taxpayer to such other person. However, return information shall not be disclosed to such person or persons if the Secretary determines that such disclosure would seriously impair Federal tax administration. [Additional text added by the Taxpayer First Act, effective December 28, 2019: Persons designated by the taxpayer under this subsection to receive return information shall not use the information for any purpose other than the express purpose for which consent was granted and shall not disclose return information to any other person without the express permission of, or request by, the taxpayer.]”)

Internal Revenue Code, 26 USC 7701(a)(1) (“(1) Person. The term ‘person’ shall be construed to mean and include an individual, a trust, estate, partnership, association, company or corporation.”)

Internal Revenue Code, 26 USC 6050(c)(1) (“For purposes of subsection (a) [mortgage interest of $600 or more] . . . The term ‘person’ includes any governmental unit (and any agency or instrumentality thereof).”)

Illinois Banking Act, 205 ILCS 5/48.1(a)(4) (“Financial records” protected by the Illinois Banking Act’s privacy requirements include “any other item containing information pertaining to any relationship established in the ordinary course of a bank’s business between a bank and its customer, including financial statements or other financial information provided by the customer.”)

Regulation P, 12 CFR 1016.3(q)(2)(i) (“Personally identifiable financial information” protected by Regulation P’s privacy requirements includes “(A) Information a consumer provides to you on an application to obtain a loan, a credit card, a credit union membership, or other financial product or service; . . . (E) Any information that a consumer provides to you or that you or your agent otherwise obtain in connection with collecting on, or servicing, a loan or a credit account; . . .”)

Regulation P, 12 CFR 1016.15(a) (“Exceptions to opt out requirements. The requirements for initial notice in § 1016.4(a)(2), for the opt out in §§ 1016.7 and 1016.10, and for service providers and joint marketing in § 1016.13 do not apply when you disclose nonpublic personal information: (1) With the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction; . . . (7)(iii) To respond to judicial process or government regulatory authorities having jurisdiction over you for examination, compliance, or other purposes as authorized by law.”)