A Briefing On Public Policy Issues Affecting Civil Liberties Online from The Center For Democracy and Technology

IRS Proposal Could Impact Millions of Internet Users

(1) IRS Proposal Could Impact Millions of Internet Users

(2) Treasury Proposal Mirrors Problems With Other Data Retention Schemes

(3) Request for SSNs Runs Contrary to Anti-ID Theft Initiative

(1) IRS Proposal Could Impact Millions of Internet Users

The U.S. Treasury Department -- in an effort to track down unreported small business income -- is seeking legislation requiring brokers of personal property, such as auction houses and consignment stores, to collect personal data on their customers and share it with the Internal Revenue Service. It appears that the real targets of the proposal are Internet-based businesses, including eBay and Amazon. It seems the IRS believes Internet companies should be enlisted in tax collection due to the apparent ease of collecting and transmitting information over the Internet.

The IRS proposal is disturbing on many levels -- not least in that it calls for the collection, storage and transmission of large amounts of sensitive personal information at a time when Internet users are increasingly concerned about identity theft; and when public- and private-sector data breaches have become routine. It would also potentially burden many smaller businesses that lack the technology or security infrastructure to safely collect sensitive personal information.

The IRS proposal calls for "brokers" of transactions involving tangible personal property to file income statements about all sellers who conduct 100 or more separate transactions that generate $5,000 or more in gross income. The IRS form required under the proposal would include the name, address and Social Security number (SSN) or Taxpayer ID Number (TIN) of each seller. In order to comply, brokers would likely need to keep track of ID numbers and other information on all sellers, even those that do not meet the sales threshold (since they won't know until the end of the year who meets the threshold). For small sellers this will almost always be an SSN. The proposal is in the President's budget and, while no lawmaker has yet come out in support of it, the measure could easily find its way into a larger legislative package.

The request is just the latest manifestation of a broader effort by the government to force businesses to retain large amounts of customer data. These "data retention" proposals would force the creation of massive, privately maintained databases of personally identifiable data that government investigators could tap at their leisure. What's particularly troubling about this trend is that it occurs against the backdrop of a concerted effort by the Administration to weaken the legal standards that protect ordinary Americans against undue government snooping.

The government is effectively seeking to increase the amount of information collected and stored about ordinary Americans even as it relaxes the standards by which it can obtain that information. Also, forcing businesses to collect SSNs could have a chilling effect on legitimate e-commerce if consumers balk at providing their SSNs for simple transactions -- something most people are not accustomed to doing.

The Treasury Department has done little to justify why Congress should impose this substantial new burden on brokers and their customers. Although reports of a multi-billion dollar gap between the taxes Americans owe and the taxes they pay have made headlines of late, there has been no evidence that online sellers are prime offenders or that the imposition of draconian record keeping requirements on auction operators and other online brokers represent the best, least intrusive means to address the problem.

While the IRS needs SSNs for tax purposes, and private sector tax reporting is partly what the number was created for, this proposal essentially requires Internet commerce companies to collect and store the SSNs of millions of people, most of whom will never even meet the requirements for reporting their auction income to the IRS.

To the best of our knowledge, the IRS is not seeking to compel flea market or mall operators to collect the Social Security numbers of their sellers for tax purposes, so it's hard to understand the rationale for targeting Internet businesses. Too often, it seems the basis for seeking ever-larger amounts of information from Internet operators has to do with the fact that such collection is believed to be easy, not because it is a good idea.

A broader concern is that the Treasury Department is seeking to dramatically increase the amount of sensitive personal data collected from individuals, even as other agencies are being urged to limit such collection as a means of combating ID theft. The Federal Trade Commission (FTC) and Justice Department recently unveiled a strategic plan to combat identity theft, which, among other things, called for agencies to minimize their use of Social Security numbers. The IRS proposal is goes against the spirit of the DOJ-FTC recommendations.

(2) Treasury Proposal Mirrors Problems With Other Data Retention Schemes

Last year, the Justice Department began calling for federal legislation that would require Internet service providers to retain information about their customers for months or even years at a time. Ostensibly aimed at preserving information about the activities of online predators for use in later investigations, the proposal would mandate the creation of massive databases of sensitive information about Internet users. In February of this year, Rep. Lamar Smith (R-Texas) introduced legislation that would effectively give the Justice Department a blank check to write its data retention rules for ISPs.

The Treasury proposal is similar to the DOJ data retention proposal in several objectionable aspects:

• Data retention requirements threaten personal privacy and pose a security risk at the very time the public is justifiably concerned about security and privacy online. One of the best ways to safeguard privacy is to minimize the amount of personally identifiable data that is collected and stored. Data retention flies in the face of that wisdom, by mandating the creation of large new databases of personally identifiable information that would instantly become ripe targets for identity thieves.
• Data retention laws are susceptible to "mission creep." Although the Treasury proposal calls only for brokers to generate tax forms for users, there is nothing in the proposal to limit the further use of the information that the sites must collect to generate those forms. Either the government or the brokers themselves could use the information for currently unanticipated purposes.
• Data retention laws undermine public trust in the Internet. The new data disclosure demands that online goods brokers would be required to make to meet their new IRS obligations would alienate customers who are already rightly skittish about how much of their sensitive personal information they must surrender to do business online. Right now, legitimate e-commerce websites can warn consumers never to give their SSNs online. Indeed, sites that currently ask consumers for their SSNs are very likely to be related to illegal "phishing" scams. This proposal would make it harder to distinguish fraudulent sites.
• Data retention laws are burdensome and costly. Particularly for smaller operators, the Treasury proposal represents a potentially crippling increase in record keeping, storage and paperwork.