The many implications of Sec. 7216

Editor: Matthew K. Becker, CPA

In recent years, much of the discussion related to Sec. 7216 has centered around the use of foreign tax preparation centers; however, the provision has much wider-ranging implications.

Sec. 7216 governs the disclosure and use of taxpayer data by tax professionals. The use of stateside third-party preparation services, the use of affiliates or related entities, data mining for the marketing or solicitation of other services, and the disclosure of information to a taxpayer’s other service providers are all examples of activities that could require taxpayer consent under Sec. 7216.

As public accounting firms, like most businesses, undergo digital transformation and increasingly rely on data, tax preparers must be good stewards of their clients’ information. It is imperative that practitioners familiarize themselves with the intricacies of Sec. 7216 and its applications.

This column is intended to be an overview of the provision and its many applications; it is not meant to serve as a comprehensive guide to Sec. 7216.

What is Sec. 7216?

Sec. 7216 was enacted to protect the privacy of taxpayers’ tax return information. A criminal provision, it prohibits tax return preparers from “knowingly or recklessly” disclosing or using tax return information and provides meaningful accountability for violations. A tax preparer convicted of violating Sec. 7216 may be subject to a fine of up to $1,000 or imprisonment of not more than one year (or both). The monetary penalty increases to up to $100,000 if the disclosure or use is in connection with a crime involving identity theft. In addition to potential criminal penalties, Sec. 7216 infractions can expose tax preparers to a referral to the IRS’s Office of Professional Responsibility, which oversees professional conduct.

When discussing Sec. 7216, it is important to also mention Sec. 6713, a corresponding civil provision that governs the privacy of taxpayers’ information. Sec. 6713 carries lower penalty amounts for disclosure and use violations; however, it has a much broader application, as violations do not need to meet the “knowingly or recklessly” standard to apply. This column does not go into detail on Sec. 6713.

What information is protected by Sec. 7216?

Sec. 7216 protects any information “furnished in any form or manner for, or in connection with, the preparation of a tax return of the taxpayer” (Regs. Sec. 301.7216-1(b)(3)). This covers even basic information, including but not limited to:

• Personal identifying information — name, address, Social Security number, etc.;
• Financial information;
• Employment information;
• Business information; and
• Investment information.

If any of the above information was first obtained while providing services other than tax return preparation, it is unlikely to be subject to Sec. 7216; however, such information is still subject to the confidentiality requirements provided for by the AICPA, the various state boards of accountancy, other professional organizations, U.S. federal and state privacy laws, the General Data Protection Regulation of the EU, and any confidentiality provisions contained within engagement letters or other types of contractual arrangments with clients.

What constitutes disclosure?

Disclosure under Sec. 7216 “means the act of making tax return information known to any person in any manner” (Regs. Sec. 301.7216-1(b)(5)). Disclosures are broken down into two categories — those that require consent of the taxpayer and those that do not. Preparers must evaluate each disclosure to determine which category it falls into.

Disclosures that do not require taxpayer consent

The following disclosures do not require taxpayer consent:

• Disclosures to the taxpayer;
• Disclosures to other employees of the tax return preparer who need the information to perform their duties;
• Disclosures to a third-party service provider engaged by the tax return preparer that is providing services related to the preparation, processing, or electronic filing of the tax return;
• Disclosures required by law, such as responding to a subpoena or court order;
• Disclosures the tax preparer makes in the course of obtaining professional advice (such as from legal counsel) or seeking technical assistance from a professional organization;
• Disclosures to the IRS or other taxing authorities, as required by law or during an audit or investigation; and
• Disclosures for purposes of quality, peer, or conflict reviews.

This list is not exhaustive; preparers might want to consider consulting legal counsel when evaluating ambiguous situations.

Disclosures that require taxpayer consent

The following disclosures do require taxpayer consent:

• Disclosures to any person or entity, including third parties, for purposes other than those necessary for the preparation, processing, or electronic filing of the tax return — this includes sharing taxpayer information with entities or individuals not directly involved in the tax return preparation process;
• Disclosures to affiliates or related entities of the tax return preparer, unless certain conditions are met — “affiliates or related entities” refers to other entities that have a relationship with the tax return preparer, such as subsidiaries or parent companies;
• Disclosure or use of taxpayer information for the purpose of soliciting non–tax return preparation business or for marketing nontax services to the taxpayer — this includes using taxpayer information for general advertising or promotional purposes; and
• Disclosures to bankers, brokers, family offices, trust departments, and (in certain cases) spouses, along with a number of other potential recipients.

This list also is not exhaustive. In general, though, any disclosure of taxpayer information that goes beyond what is necessary for the tax return preparation process requires the taxpayer’s consent under Sec. 7216.

Furthermore, to ensure compliance with the law, taxpayer consent must be obtained before any disclosure is made. Taxpayers have the right to terminate their consent at any time.

As tax practice leaders look to adapt their operating procedures to remain competitive in a rapidly changing environment, understanding the aspects of Sec. 7216 that affect their business has become critical. Many preparers are considering using new technologies and services to manage costs and navigate a tight labor market. This may involve third-party return preparation outsourcing options, use of other tax professionals that are part of a firm’s U.S. or international network, outside legal counsel providing input on highly technical tax matters, or any number of other solutions. Each instance needs to be evaluated carefully to determine whether consent is required before a disclosure is made and, if so, what form the consent must take.

Disclosure consents

Disclosure consents vary depending on whether taxpayer information will be disclosed outside the United States.

Outside the United States: If tax return information is going to be disclosed outside the United States, a consent is almost certainly going to be required (Regs. Sec. 301.7216-3(a)(3) (i)(D)). One important consideration for non-U.S. disclosure is whether the practitioner is willing and/or able to redact the taxpayer’s Social Security number. In either case, a consent is needed, but a provider who chooses not to or is unable to redact will need to use different consent language and must ensure both the U.S. preparer and the service provider located outside the United States have adequate data protection safeguards in place (Regs. Sec. 301.7216-3(b)(4)).

Inside the United States: If the information is going to remain in the United States, the nature of the services to be provided becomes important in the decision-making process. Disclosure within the United States for the purpose of assisting the tax return preparer in the preparation, processing, or electronic filing of the tax return does not require consent. However, assistance that involves the service provider’s making substantive decisions related to the return does require consent (Regs. Sec. 301.7216-2(d)(1)). Examples of substantive decisions include, but are not limited to, which filing status is elected, how various types of income are reported, which deductions and credits are claimed, and how income is allocated.

Because some U.S.-based thirdparty service providers offer a range of services, it is essential that practitioners understand which service will be utilized for each client. For example, a practitioner might send Taxpayer A’s information to a service provider for full preparation of the return (which would require Taxpayer A’s consent) and send Taxpayer B’s information to the same provider for scan-only service (which, because it involves no substantive decision-making, does not require consent).

With respect to disclosures to brokers, bankers, etc., it is important to consider the not-so-obvious disclosures subject to Sec. 7216 consent requirements. With high-net-worth clients, tax preparers often receive information from the taxpayer’s family office or family group, closely held business, financial adviser, or other related individuals. Tax preparers must carefully consider the various relationships and participants involved in the tax return process. Consent requirements may apply to parties related to the taxpayer, even those who provide necessary pieces of information. The fact that someone works for the taxpayer, is related to the taxpayer, or represents the taxpayer in nontax matters does not mean that the appropriate Sec. 7216 consent is not required.

What constitutes use?

Use of tax return information, under Sec. 7216, “includes any circumstance in which a tax return preparer refers to, or relies upon, tax return information as the basis to take or permit an action” (Regs. Sec. 301.7216-1(b)(4)(i)).

This provision is exceptionally broad, and there are several exceptions, including maintenance of a list containing specified items of tax return information that may be used for the sole purpose of providing tax and general business or economic information for education purposes or soliciting additional tax return preparation services.

Practitioners may also use tax return information to inform taxpayers of both prospective and retroactive changes in tax law (see Rev. Rul. 2010-4).

However, with the rise of data analytics, its use by preparers is, in a growing number of cases, disallowed without the taxpayer’s consent. Mining taxpayer data to analyze whether additional services should be offered will be among the exceptions discussed above only if the offered services fall squarely in the category of “tax return preparation services.” Tangential services, such as wealth management and advisory services, are not included in this exception. Additionally, the list may not be used for overall marketing purposes, such as delivering firm newsletters or promoting upcoming webcasts.

In all cases in which consent is required, the taxpayer must be provided with a clear explanation of the intended use or disclosure of their information, and they have the right to refuse or withdraw their consent at any time.

Increasing scrutiny

The implications of Sec. 7216 have come under increased scrutiny in recent months. A 2022 investigation by The Markup found that TaxSlayer, H&R Block, and TaxAct had been sharing taxpayers’ financial information with tech firms such as Meta and Google (Fondrie-Teitler, Waller, and Lecher, “Tax Filing Websites Have Been Sending Users’ Financial Information to Facebook,” The Markup (Nov. 22, 2022)). Following the report, a group of congressional Democrats led by Sen. Elizabeth Warren, D-Mass., investigated the allegation. The June 2023 congressional report, titled Attacks on Tax Privacy, details numerous alleged Sec. 7216 violations, calls for enforcement entities to launch their own investigations, and encourages prosecution.

Obtaining consent

Each type of consent discussed above has separate requirements that must be met regarding form, content, and format (these requirements are governed by Regs. Sec. 301.7216-3(a) (3) and Rev. Proc. 2013-14).

Generally, for business entities, a consent must include the following:

• The name of the tax return preparer;
• The taxpayer’s name;
• The purpose of the disclosure, unless covered by an exception (as provided in Regs. Sec. 301.7216-3(a)(3)(iii));
• The recipients of the information;
• A description of the use of the information if the consent is being obtained for use purposes;
• The tax return information to be disclosed or used; and
• The taxpayer’s signature and date.

A consent may be in any format, including appearing in the text of engagement letters. It may cover both disclosure and use, and it need not identify each disclosure or use specifically and separately.

The requirements for individual Form 1040, U.S. Individual Income Tax Return, filers are more prescriptive (Rev. Proc. 2013-14). Some key differences include:

• Consent must be in a separate written document. Specific rules govern the appearance of the disclosure, and they vary depending on whether the consent is on paper or electronic. Similarly, signing requirements vary depending on the method of signature; these include safeguards around electronic consent.
• There is mandatory language that must be contained in each consent. Requirements can vary based on the circumstances of the arrangement. Use consents and disclosure consents must be provided and contained in separate documents.
• Consent must be affirmative; optout consents are not permitted (Rev. Proc. 2013-14, §5.04(2)). Taxpayers must have the option to affirmatively select each separate disclosure or use. Taxpayers presented with a disclosure of an entire tax return or all information contained within a tax return must be given the option to request a more limited disclosure of tax return information.
• Tax preparers cannot alter a consent in any way after the taxpayer has signed it.
• A copy of the consent must be provided to the taxpayer.

Best practices

It is important that tax preparers review their current processes and procedures to look for disclosures. Each disclosure should be analyzed to determine whether a consent is required and, if so, the appropriate form the consent should take. Practitioners may determine that inappropriate disclosures and uses of taxpayer information were made without required consent. Although taxpayer information cannot be “undisclosed,” every effort should be made to stop such disclosures and uses immediately. Steps to prevent additional disclosures may require removing or limiting access to systems that contain taxpayer data.

Due to the nature of the tax preparer/ taxpayer relationship, firms should institute an adequate training program for all tax professionals and other employees who may come into contact with taxpayer information. The adoption and use of a standard template form can be helpful, but it is important to remember that no single template will address all types of disclosure or use.

Practitioners should also have a process in place to maintain an accurate record of consents. As stated earlier, taxpayers may revoke their consent for the disclosure or use of their information at any time. Once a taxpayer rescinds consent, tax preparers must immediately cease any further disclosure or use of their information. As public accounting firms turn to data with increasing frequency, companies need to have a system that tracks consents to avoid inadvertent Sec. 7216 violations.

Avoid risk with a comprehensive review

This column is meant to serve as an introduction to the many implications of Sec. 7216; by no means should it be considered a comprehensive guide. Each firm should conduct a comprehensive review of its consent, disclosure, and use policies. Tax practitioners who do not comply with the rules set forth in Sec. 7216, the regulations thereunder, and other IRS guidance risk not only financial and criminal penalties — they also risk losing their professional license and their reputation.

With the rise of data analytics, its use by preparers is, in a growing number of cases, disallowed without the taxpayer’s consent.

Contributors

Kasey Pittman, CPA, MST, is the director of tax policy at Baker Tilly US LLP in its Washington national tax practice; Les Williford, CPA, is the national managing principal of Tax Quality at BDO USA in Atlanta; Matthew K. Becker, CPA, is a national managing partner of tax with BDO USA in Grand Rapids, Mich. Becker and Pittman are members of the AICPA Tax Practice Management Committee. For more information on this column, contact thetaxadviser@aicpa.org.