Aggregated return data must adequately mask taxpayer identities

Plain-English summary

Chief Counsel described the IRS's general rule that grouped return information should include at least three taxpayers before it is treated as statistical. Three taxpayers may still be insufficient when members of a small community could identify who is included. The relevant question is whether other people, not the taxpayer itself, can recognize a taxpayer from the disclosed information. Staff familiar with the project should assess the actual masking, disclose the number only if identities are protected, and otherwise delete it.

Ruling snapshot

• Question: When may grouped return information be disclosed as statistical information without revealing taxpayer identities?
• Outcome: Advice given: the rule of three is a minimum, and disclosure is permitted only when the facts show adequate masking.
• Key authorities: IRC § 6103

Full text (IRS public release)

ID:       CCA_2016012117055117
UILC:     6103.02-00

Number: 201608013
Release Date: 2/19/2016
From:
Sent: Thursday, January 21, 2016 5:05:52 PM
To:
Cc:
Bcc:
Subject: RE--------------------------------


Hello all –

I agree that the information below is not directly on point, but it does reflect the guidance
counsel generally provides with regard to statistical or aggregate information.

The IRS uses a general “rule-of-three” that grouped return information must include data from
at least three taxpayers in order to be statistical. Data from fewer than three taxpayers is not
statistical. However, depending on the specific circumstances, three may not be sufficient to
mask the identities of the included taxpayers. In that case, when possible we increase the
number of taxpayers included in the data until appropriate masking is achieved. If such
masking cannot be achieved, then the grouped information should not be disclosed.

The basic question raised ----------------------------------------------is whether -----------------of a
community of ---------------provides sufficient masking. We should consider not only the
numbers, but also the extent to which the community members are familiar with each other
and therefor reasonably could be expected to recognize/identify any of the specific members
included. We are not concerned with whether any taxpayer can recognize itself, but rather
whether other people can recognize the taxpayer. Also, if the included taxpayers have already
told other members of the community that they were audited, then the fact that the
community knows who is included in this number when presented in a slightly different context
can mitigate the concern that the number is not statistical.

I talked with one of the Counsel (P&A) folks who worked on the previous report. He doesn’t
remember any specific discussion of the statistical question, just that taxpayer-specific
information had to be removed. He agreed that with such a small community, we should not
mechanically apply the rule of three, but should consider whether the number we have is
adequate to mask the taxpayers’ identities. That judgment is something that needs to be done
by the folks who substantively work this project and have the best knowledge of the extent to
which the community members are able to recognize each other. If you are comfortable that


                                                2

the number of taxpayers included is large enough to mask their identities, then it can be
disclosed; if you think it is not large enough, then the number should be deleted.

I hope that helps. IF you would like to discuss it further, please let me know.

---------------

Senior Attorney

Procedure & Administration