Department of the Treasury 

2021 Consolidated Privacy and Civil Liberties Reports 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Message from the Assistant Secretary for Management 

As the Department of the Treasury’s Senior Agency 

Official for Privacy and Chief Privacy and Civil 

Liberties Officer, I am pleased to present Treasury’s 

2021 Consolidated Privacy and Civil Liberties 

Reports. 

	 Annual Privacy Report required by Section 522(a) 

of the Consolidated Appropriations Act of 2005; 

	 Semiannual Privacy and Civil Liberties Report 

required by Section 803 of the Implementing 

Recommendations of the 9/11 Commission Act of 

2007; and 

	 Annual Data Mining Report required by the 

Federal Agency Data Mining Reporting Act of 

2007. 

The Department of the Treasury (“Treasury” or “the Department”) is committed to 

safeguarding and ensuring privacy compliance through integrated technology, 

policy, and high-quality standards. As a collector of data on millions of individuals 

and companies, the Department strives to be a leader in privacy best practices and 

privacy policy. 

Inquiries about these reports may be directed to privacy@treasury.gov. These 

reports, as well as previous reports, can be found on the Department’s Privacy Act | 

U.S. Department of the Treasury. 

Trevor Norris 

Acting Assistant Secretary for Management 

U.S. Department of the Treasury 

2
	
 

 

 

 

 

 

2021 Consolidated Privacy and Civil Liberties Reports
	

Table of Contents
	

Message from the Assistant Secretary for Management ..................................................................................2
	

SECTION ONE: DEPARTMENT OF THE TREASURY CONSOLIDATED APPROPRIATIONS ACT
	

IMPLEMENTING RECOMMENDATIONS OF THE 9/11 COMMISSION ACT OF 2007 PRIVACY
	

AND CIVIL LIBERTIES ACTIVITIES REPORT FOR REPORTING PERIOD APRIL 1, 2021 TO
	

Statutory Requirements .......................................................................................................................... 5
	

The Reporting Periods............................................................................................................................ 5
	

The Consolidated Appropriations Act of 2005 Annual Privacy Report................................................. 5
	

The Implementing Recommendations of the 9/11 Commission Act of 2007......................................... 5
	

The Data Mining Reporting Act of 2007 Annual Report ....................................................................... 6
	

OF 2005 ANNUAL PRIVACY REPORT ...................................................................................................... 8
	

Complaints of Privacy Violations .......................................................................................................... 8
	

System of Records Notices (SORNs)..................................................................................................... 8
	

Privacy and Civil Liberties Impact Assessments (PCLIA) .................................................................... 8
	

Elimination of the Unnecessary Use of Social Security Numbers ......................................................... 9
	

Privacy Policies on Treasury Websites .................................................................................................. 9
	

Treasury Orders and Directives.............................................................................................................. 9
	

Privacy Awareness and Training: A Culture of Privacy Awareness .................................................... 10
	

Treasury Computer Matching Programs .............................................................................................. 10
	

SECTION TWO: DEPARTMENT OF THE TREASURY SECOND SEMIANNUAL 2021
	

SEPTEMBER 30, 2021.................................................................................................................................. 12
	

Introduction.........................................................................................................................................................12
	

Privacy and Civil Liberties Reviews Undertaken................................................................................. 13
	

Privacy and CivilLiberties Impact Assessments (PCLIA) ..........................................................................14
	

System of Records Notices.................................................................................................................... 14
	

Computer Matching Programs..........................................................................................................................14
	

3
	
 

 

 

Privacy Compliance Reviews............................................................................................................... 15
	

Advice and Responses.......................................................................................................................... 15
	

Privacy Complaints and Dispositions................................................................................................... 17
	

Conclusions .......................................................................................................................................... 17
	

SECTION THREE: DEPARTMENT OF THE TREASURY FY 2021 DATA MINING REPORTING ACT OF
	

2007 ANNUAL REPORT ............................................................................................................................. 18
	

The Role of the Treasury Chief Privacy and Civil Liberties Officer (CPCLO) ................................... 18
	

Definitions..............................................................................................................................................18
	

FINCEN FY 2021 DATA MINING REPORT .................................................................................... 19
	

ALCOHOL AND TOBACCO TAX AND TRADE BUREAU (TTB) FY 2021 DATA MINING 

REPORT.................................................................................................................................................. 30
	

INTERNAL REVENUE SERVICE (IRS) FY 2021 DATA MINING REPORT...................................35
	

CONCLUSION .......................................................................................................................................44
	

APPENDIX A .........................................................................................................................................45
	

4
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Statutory Requirements 

In this report, Treasury consolidates the following three reporting requirements 

to reduce duplication and provide Congress and the public with a more comprehensive 

overview of Treasury’s privacy compliance and oversight activities: 

(1)		 The Annual Privacy Report required by Section 522(a) of the Consolidated 

Appropriations Act of 2005; 

(2)		 The Annual Data Mining Report required by Section 804 of the Federal Agency 

Data Mining Reporting Act of 2007; and 

(3)		 The second semi-annual Privacy and Civil Liberties Report required by Section 803 

of the Implementing Recommendations of the 9/11 Commission Act of 2007. 

The Reporting Periods 

These reports cover Treasury activities during the 2021 fiscal year (FY21). The 

Annual Privacy Report and the Annual Data Mining Report cover the entire fiscal year 

while the Section 803 report covers the second half of FY 21 (April 1, 2021 to 

September 30, 2021); the first Section 803 report for FY21 is a standalone report and 

will be posted to the Treasury’s Privacy website at Privacy Annual Reports | U.S. 

Department of the Treasury. 

The Consolidated Appropriations Act of 2005 Annual Privacy Report 

The Annual Privacy Report was prepared in accordance with Section 

522(a) of the Consolidated Appropriations Act of 2005, which includes the 

following requirement: 

Privacy Officer— 

Each agency shall have a Chief Privacy Officer to assume primary 

responsibility for privacy and data protection policy, including— 

* * * 

(6) preparing a report to Congress on an annual basis on activities of the 

Department that affect privacy, including complaints of privacy 

violations, implementation of section 552a of title 5, 11 United 

States Code, internal controls, and other relevant matters; 

* * * 

The Implementing Recommendations of the 9/11 Commission Act of 2007, 

Semi-Annual Privacy and Civil Liberties Report 

Section 803 of the 9/11 Commission Act sets forth the following requirements: 

(f) Periodic Reports – 

(1) In General – 

The privacy officers and civil liberties officers of each 

department, agency, or element referred to or described in subsection 

5
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(a) or (b) shall periodically, but not less than semiannually; submit a 

report on the activities of such officers— 

(A)(i) to the appropriate committees of Congress, including 

the Committee on the Judiciary of the Senate, the Committee on 

the Judiciary of the House of Representatives, the Committee on 

Homeland Security and Governmental Affairs of the Senate, the 

Committee on Oversight and Government Reform of the House 

of Representatives, the Select Committee on Intelligence of the 

Senate, and the Permanent Select Committee on Intelligence of 

the House of Representatives; 

(ii) to the head of such department, agency, or element; and 

(iii)to the Privacy and Civil Liberties Oversight Board. 

(B) which shall be in unclassified form to the greatest 

extent possible, with a classified annex where necessary. 

(2) Contents – 

Each report submitted under paragraph (1) shall include 

information on the discharge of each of the functions of the officer 

concerned, including— 

(A) information on the number and types of reviews undertaken; 

(B) the type of advice provided and the response given to such advice; 

(C) the number and nature of the complaints received by the department, 

agency, or element concerned for alleged violations; and 

(D) a summary of the disposition of such complaints, the reviews and 

inquiries conducted, and the impact of the activities of such officer. 

* * * 

The Data Mining Reporting Act of 2007 Annual Report 

The Federal Agency Data Mining Reporting Act of 2007, 42 U.S.C.
	

§2000ee-3, includes the following requirement:
	

(c) Reports on data mining activities by Federal agencies 

(1) Requirement for report - The head of each department or agency of the
	

Federal Government that is engaged in any activity to use or develop
	

data mining shall submit a report to Congress on all such activities of
	

the department or agency under the jurisdiction of that official. The
	

report shall be produced in coordination with the privacy officer of that
	

department or agency, if applicable, and shall be made available to the
	

public, except for an annex described in subparagraph (C).
	

(2) Content of report - Each report submitted under subparagraph (A) shall
	

include, for each activity to use or develop data mining, the following
	

information:
	

(A) A thorough description of the data mining activity, its goals, and, 

where appropriate, the target dates for the deployment of the data 

6
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

mining activity; 

(B) A thorough description of the data mining technology that is being 

used or will be used, including the basis for determining whether a 

particular pattern or anomaly is indicative of terrorist or criminal 

activity; 

(C) A thorough description of the data sources that are being or will be used; 

(D) An assessment of the efficacy or likely efficacy of the data mining 

activity in providing accurate information consistent with and 

valuable to the stated goals and plans for the use or development 

of the data mining activity; 

(E) An assessment of the impact or likely impact of the implementation 

of the data mining activity on the privacy and civil liberties of 

individuals, including a thorough description of the actions that are 

being taken or will be taken with regard to the property, privacy, or 

other rights or privileges of any individual or individuals as a result 

of the implementation of the data mining activity; 

(F) A list and analysis of the laws and regulations that govern the 

information being or to be collected, reviewed, gathered, 

analyzed, or used in conjunction with the data mining activity, to 

the extent applicable in the context of the data mining activity; 

(G) A thorough discussion of the policies, procedures, and guidelines 

that are in place or that are to be developed and applied in the use of 

such data mining activity in order to— 

(i)		 protect the privacy and due process rights of
	

individuals, such as redress procedures; and
	

(ii) ensure that only accurate and complete information is
	

collected, reviewed, gathered, analyzed, or used, and guard
	

against any harmful consequences of potential
	

inaccuracies.
	

7
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

SECTION ONE: DEPARTMENT OF THE TREASURY CONSOLIDATED 

APPROPRIATIONS ACT OF 2005 ANNUAL PRIVACY REPORT 

Complaints of Privacy Violations 

Section 522 of the Consolidated Appropriations Act of 2005 requires 

Treasury to address in its annual report complaints of privacy violations. Section 

803 of the Implementing Recommendations of the 9/11 Commission Act of 

2007 (“9/11 Commission Act”) requires Treasury to address both privacy and 

civil liberties complaints. Therefore, to avoid redundancy, both privacy and 

civil liberties complaints will be addressed in the Section 803 Report in Section 

2 of these consolidated reports. 

Implementation of the Privacy Act, 5 U.S.C., Section 552a. 

System of Records Notices 

A system of records is a grouping of paper or electronic records
	

maintained by a Federal agency from which information about an individual
	

is retrieved by the name of the individual or another unique identifier
	

assigned to the individual (e.g., Social Security number). Pursuant to 5 U.S.C.
	

§ 552a(e)(4), agencies are required to publish a systems of records notice
	

(SORN) in the Federal Register for each system of records. Treasury has
	

published regulations describing how it collects, maintains, and discloses
	

records about individuals that are maintained in a system of records. These
	

regulations provide procedures by which individuals may request access to
	

their information maintained by Treasury.1
	

A list of the Department’s SORNs is available on Treasury’s Privacy
	

Act website, at System of Records Notice | U.S. Department of the Treasury
	

Internal Controls 

Privacy and Civil Liberties Impact Assessments 

A Privacy and Civil Liberties Impact Assessment (PCLIA) is an 

analysis of how information is handled in compliance with legal, regulatory, 

and privacy policy requirements, as well as information privacy issues that may 

affect civil liberties. This includes an analysis to ensure compliance with the 

Privacy Act requirements. It allows the assessment of the risks associated with 

collecting, maintaining, and disseminating information and discusses the 

mitigation strategies used to address those risks. Section 208 of the EGovernment Act of 2002 (E-Gov Act) requires agencies to conduct PCLIAs for 

electronic information systems and collections that involve the collection, 

maintenance, or dissemination of information in identifiable form from or about 

1 See 31 C.F.R. §§ 1.20-1.36 

8
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

members of the public. Links to the Treasury’s PCLIAs are available on 

Treasury’s website, at Privacy and Civil Liberties Impact Assessments | U.S. 

Department of the Treasury 

Elimination of the Unnecessary Use of Social Security Numbers 

The Social Security Number Fraud Prevention Act of 2017 requires 

Treasury to file an annual report for five years identifying all mailings that 

include the full Social Security Number (SSN). Treasury is required to update 

Congress annually on its progress in eliminating the mailing of full SSNs. 

Treasury recently submitted its 2021 report to Congress. For more information 

on Treasury’s usage of the SSN, please refer to Section 2 of this report. 

Privacy Policies on Treasury Websites 

Treasury maintains online privacy policies to provide notice to Treasury 

website visitors describing how Treasury collects, uses, shares, and disposes of 

information it collects on its websites. This includes providing notice about 

how certain information collected is handled in compliance with the Privacy 

Act. Treasury bureaus, offices, and Treasury’s Inspectors General maintain 

their own online privacy policies to address the unique information they collect 

on their websites. Links to Treasury bureau and office policies may be found on 

Treasury’s webpage at Privacy Policy | U.S. Department of the Treasury. 

Treasury Orders and Directives 

Treasury Orders (TO) and Treasury Directives (TD) serve as the 

controls by which Treasury ensures that appropriate stakeholders are involved 

in privacy and civil liberties policy development and implementation. 

Treasury Orders are documents signed by the Secretary or Deputy Secretary that: 

 delegate authority from the Secretary or Deputy Secretary to other 

senior Treasury officials; 

 define the organization of the Department and the reporting; 

relationships among the most senior officials; and/or 

 establish Treasury policy. 

Treasury Orders relevant to this report are: 

Treasury Orders 

TO-102-25, Delegation of Authority Concerning Privacy and Civil Liberties
	

Treasury Directives and Publications are documents signed by the appropriate senior 

Treasury officials that: 

 further delegate authority from the most senior officials to other 

9
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Treasury officials; and/or 

 provide processes for implementing legal obligations and Departmental policy 

objectives. 

Treasury Directives and Publications relevant to this report are: 

Treasury Directives and Publications 

TD 25-04, The Privacy Act of 1974, as Amended 

TDP, 25-04, The Privacy Act Handbook 

TD 25-06, Treasury Data Integrity Board 

TD 25-07, Privacy Impact Assessments 

TD 25-08, Safeguarding Against and Responding to the Breach of PII 

TD 25-09, Privacy and Civil Liberties Activities Pursuant to Section 803 of the 

Implementing Recommendations of the 9/11 Commission Act of 2007, P.L. 110-

53 

TD 25-10, Information Sharing Environment Privacy and Civil Liberties Policy 

Privacy Awareness and Training: A Culture of Privacy Awareness 

Subsection (e)(9) of the Privacy Act requires that agencies provide 

instruction to persons involved in the design, development, operation, or 

maintenance of systems of records. All Treasury employees are required to 

take the annual privacy training which includes information regarding the 

potential criminal penalties and civil liability for employees who do not 

comply with the Privacy Act requirements. In FY21, 92% of all Treasury 

employees successfully completed this training. 

Treasury Computer Matching Programs 

Pursuant to the Computer Matching and Privacy Protection Act of 

1988,2 Treasury maintains a Data Integrity Board (DIB) to oversee its computer 

matching programs. Computer matching programs provide a direct benefit to 

the public by assisting in the elimination of errors and in monitoring fraud, 

waste, and abuse. Matching agreements expire 18 months after execution unless 

renewed for an additional 12-month period. After a renewal period expires, an 

agreement may be re-established for an additional 18 months. For 2021 data on 

Treasury’s computer matching agreements, please refer to page 14. Treasury’s 

2 Pub. L. No. 100-503. 

10
	
 

 

computer matching agreements can be found at: Computer Matching Programs | 

U.S. Department of the Treasury 

11
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

SECTION TWO: DEPARTMENT OF THE TREASURY 

SEMIANNUAL 2021 REPORTING ON PRIVACY AND CIVIL 

LIBERTIES ACTIVITIES PURSUANT TO SECTION 803 OF THE 

IMPLEMENTING RECOMMENDATIONS OF THE 9/11 

COMMISSION ACT OF 2007 FOR REPORTING PERIOD APRIL 1, 

2021 TO SEPTEMBER 30, 2021 

1. Introduction 

The Assistant Secretary for Management (ASM) is the 

Department of the Treasury’s (Treasury) Privacy and Civil Liberties 

Officer (PCLO). As the PCLO, the ASM is responsible for implementing 

the 9/11 Commission Act of 2007’s privacy and civil liberties 

requirements. 

To assist the ASM with these responsibilities, TD 25-04, “The 

Privacy Act of 1974, as amended,” designates the Deputy Assistant 

Secretary for Privacy, Transparency, and Records (DASPTR) as the 

Acting ASM’s principal advisor on issues related to privacy and civil 

liberties. The DASPTR leads the Office of Privacy, Transparency, and 

Records (OPTR) and provides the ASM with day-to-day support in 

executing his PCLO duties. 

Section 803 of the 9/11 Commission Act, 42 U.S.C. § 2000ee-1, 

sets forth the following requirements: 

(f) Periodic Reports – 

(1) In General – 

The privacy officers and civil liberties 

officers of each department, agency, or 

element referred to or described in subsection 

(a) or (b) shall periodically, but not less than 

semiannually; submit a report on the activities 

of such officers— 

(A)(i) to the appropriate committees of 

Congress, including the Committee on the 

Judiciary of the Senate, the Committee on 

the Judiciary of the House of 

Representatives, the Committee on 

Homeland Security and Governmental 

Affairs of the Senate, the Committee on 

Oversight and Government Reform of the 

House of Representatives, the Select 

Committee on Intelligence of the Senate, 

and the Permanent Select Committee on 

12
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Intelligence of the House of 

Representatives; 

(ii) to the head of such department, agency, or 

element;and to the Privacy and Civil Liberties 

Oversight Board; and 

(B) which shall be in unclassified 

form to the greatest extent possible, 

with a classified annex where 

necessary. 

(2) Contents – 

Each report submitted under paragraph 

(1) shall include information on the 

discharge of each of the functions of the 

officer concerned, including— 

a) information on the number and types of reviews undertaken; 

b) the type of advice provided and the response given to such advice; 

c) the number and nature of the complaints 

received by the department, agency, or 

element concerned for alleged violations; 

and 

d) a summary of the disposition of such 

complaints, the reviews and inquiries 

conducted, and the impact of the activities 

of such officer. 

The Intelligence Authorization Act for Fiscal Year 2014, 

Pub. L. No. 113-126 (July 7, 2014), changed the reporting period 

from quarterly to semiannually. The semiannual reports cover the 

following time periods: April – September and October – March.3 

2.		 Privacy and Civil Liberties Reviews Undertaken 

Treasury reviews programs and information technology 

(IT) systems that may present privacy risks. Privacy and civil 

liberties reviews include the following Treasury activities: 

a)		 Privacy and Civil Liberties Threshold Assessments are the 

Treasury mechanism for reviewing IT systems, programs, and 

other activities to determine whether the program is meeting 

information compliance requirements (civil liberties, privacy, 

records management, Section 508 compliance under the 

Rehabilitation Act of 1973, and Paperwork Reduction Act of 

1995), and to determine whether a more comprehensive Privacy 

and Civil Liberties Impact Assessment (PCLIA) is required; 

3 44 U.S.C. § 3501 note. 

13
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

b)		 PCLIAs as required by the E-Government Act of 2002;4 

c)		 System of Records Notices, and any associated Final Rules
	

for Privacy Act exemptions, as required by the Privacy
	

Act;4
	

d)		 Privacy Act Statements5

, to provide notice to
	

individuals at the point of collection, as required under
	

the Privacy Act;
	

e) Computer Matching Agreements, as required by the Computer Matching Privacy 

Protection Act;6 

f) Data Mining Reports, as required by Section 804 of the 

9/11 Commission Act of 2007;7
	

g) Privacy Compliance Reviews;
	

h) Privacy reviews of IT and program budget requests, including
	

Office of Management and Budget Exhibit 300s; and
	

i) Other privacy reviews, such as implementation
	

reviews for information sharing agreements.
	

3.		 Privacy and Civil Liberties Impact Assessments 

The Privacy and Civil Liberties Impact Assessments (PCLIA) 

process is one of Treasury’s key mechanisms to ensure that programs 

and technologies sustain, and do not erode, privacy protections. 

During FY21, Treasury published 81 new, updated, or renewed 

PCLIAs. All published Treasury PCLIAs are available on Treasury’s 

privacy website. 

4.		 System of RecordsNotices 

During the reporting period, Treasury published and updated 

4 SORNs. All Treasury SORNs, Notices of Proposed Rulemaking, 

and Final Rules for Privacy Act Exemptions are available at: System 

of Records Notices (SORNs) | U.S. Department of the Treasury 

Treasury has determined that the information contained in its 

systems of records is accurate, timely, relevant, complete, and 

necessary to maintain the proper performance of documented agency 

functions. Please consult our website or the Federal Register for the 

full text of Treasury SORNs. 

5.		 Computer Matching Programs 

The computer matching provisions of the Privacy Actimprove 

4 5 U.S.C. § 552a(j), (k). See also Office of Management and Budget (OMB) Circular No. A-108, “Federal
	

Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act,” 81 FR 94424
	

(Dec. 23, 2016).
	 5 5 U.S.C. § 552a(e)(3)
	 6 5 U.S.C. § 552a(o)-(u)
	 7 42 U.S.C. § 2000ee-3.
	

14
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

oversight and protect the due process rights of individuals whose Privacy 

Act records are shared in inter-agency information sharing arrangements 

known as “matching programs.” Treasury participates in 10 active 

computer matching programs in accordance with the requirements of the 

Privacy Act of 1974, as amended by the Computer Matching and 

Privacy Protection Act (CMPPA). To comply with the Act, as well as all 

relevant regulations and guidance, Treasury established a Data Integrity 

Board to review and approve Treasury matching agreements. All Treasury 

Computer Matching Agreements are available at: Computer Matching 

Programs | U.S. Department of the Treasury. 

During the reporting period, the Data Integrity Board 

reviewed and approved a total of 63 12-month agreements (7 Reestablishments and 56 Renewals. No CMAs were denied or lapsed. 

6.		 Privacy ComplianceReviews 

Treasury conducts Privacy Compliance Reviews (PCR) to ensure 

that programs and technologies implement and maintain appropriate 

protections for personally identifiable information (PII). A PCR is a 

collaborative effort that helps improve a program’s ability to comply with 

existing privacy requirements by identifying and remediating gaps in 

compliance documentation, including PCLIAs, SORNs, and formal 

agreements, such as memoranda of understanding and memoranda of 

agreement. It also includes informal, ad hoc, situational advice sought by 

Treasury bureaus and offices on privacy and civil liberties issues. 

Treasury’s current PCR effort involves continuing to analyze 

departmental mailing of forms, letters, and other documents containing the 

Social Security Number (SSN). This analysis is required by the SSN Fraud 

Prevention Act of 2017. Treasury remains focused on eliminating the use of 

SSNs whenever possible and safeguarding SSNs that must be collected and 

maintained because no reasonable alternative to using the SSN exists. During 

the reporting period, Treasury continued its Department-wide review of the 

mailing of full SSNs. This exercise allowed Treasury to update its list of 

appropriate uses of the SSN and identify SSN uses that can be eliminated. 

Treasury bureaus and offices are working actively to reduce the collection, 

use, and maintenance of SSNs during the completion of a PCLTAs and 

PCLIAs. 

7.		 Advice and Responses 

Treasury provides privacy advice to its bureaus and offices 

throughout the year. Examples of guidance are included below: 

a.		 The Departmental Offices provided the following 

advice and recommendations in compliance with the 

15
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Privacy Act of 1974, 5 U.S.C. § 552a, and the 

operational and privacy-specific safeguards outlined 

in the NIST SP 800-122, Guide to Protecting the 

Confidentiality of Personally Identifiable Information 

(PII): 

	 Advice given on Robotic Process 

Automation PCLIA- Purpose of the system 

and benefits to IRS – The Robotic Process 

Automation is used to automate manual 

business processes which increase accuracy, 

improve productivity, higher consistency, 

better efficiency, easier scalability, allow 

employees to focus on more critical, and 

analytical tasks while robot performs 

mundane repetitive processes. The 

automation also elevated the level of 

consistency and quality of services to 

automate standardized business processes 

used to extract Automated Under Reporter 

(AUR) report data for each campus. In 

addition to shifting time spent on laborintensive activities to higher value-add 

activities, and leverage technology as a 

resource to scale for increasing taxpayer 

demands, while reducing the cost of 

providing those services. 

After an initial review of the PCLIA, during 

its PCR process, the IRS identified several 

items that needed correction including: 

•		 Additional PII detailed 

information 

•		 Individual Notice and Consent 

•		 Acronyms 

•		 Business needs and accuracy 

Because of the PCR recommendations, 

changes were made to the PCLIA. 

	 Advice given on Adoption Taxpayer 

Identification Number PCLIA- IRS 

Adoption Taxpayer Identification Number 

(ATIN) is a temporary identification number 

assigned by the IRS to a child who has been 

placed by an authorized placement agency in 

the household of a perspective adoptive 

16
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

parent for legal adoption. Prospective 

adoptive parents must have an ATIN to 

claim certain tax benefits such as the 

Dependency Exemption, Adoption Credit, 

Child Tax Credit and the Credit for Child 

and Dependent Care Expenses. 

After an initial review of the PCLIA, the IRS 

PCR team identified several items that 

needed correction including: 

•		 Further identification of PII 

elements 

•		 Description of the system audit 

trails 

•		 Plain language issues 

Because of the PCR team’s 

recommendations, changes were made to the 

PCLIA. 

8.		 Privacy Complaints and Dispositions 

For purposes of Section 803 reporting, complaints are written
	

allegations of harm or violation of privacy and civil liberties compliance
	

requirements filed with Treasury’s privacy and civil liberties programs (or
	

the Office of General Counsel). The categories of complaints reflected in
	

Appendix A are aligned with the categories detailed in the OMB
	

Memorandum 08-21, FY 2008 Reporting Instructions for the Federal
	

Information Security Management Act and Agency Privacy Management.
	

U.S. citizens, lawful permanent residents, visitors, and aliens may submit
	

complaints.
	

9.		 Conclusions 

As required by the 9/11 Commission Act, and in accordance with the Intelligence 

Authorization Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), this annual report 

summarizes Treasury’s privacy activities from April 1, 2021 through September 30, 2021. 

Treasury will continue to work with the Congress, colleagues in other Federal departments and 

agencies, and the public to protect privacy in all its efforts. 

17
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

SECTION 3: DEPARTMENT OF THE TREASURY FY2021 DATA MINING 

REPORTING ACT OF 2007 ANNUAL REPORT 

The Role of the Treasury Chief Privacy and Civil Liberties Officer (CPCLO) 

The Department of the Treasury (“Treasury” or the “Department”) is 

providing this report to Congress pursuant to Section 803 of the Implementing 

Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act), 

entitled the Federal Agency Data Mining Reporting Act of 2007 (“Data Mining 

Reporting Act” or “the Act”). This report discusses activities currently 

deployed or under development in the Department that meet the Data Mining 

Reporting Act’s definition of data mining. The report also provides the 

information the Act requires with respect to each data miningactivity. 

Definitions 

(1) DATA MINING. The term “data mining” means a program 

involving pattern-based queries, searches, or other 

analyses of one or more electronic databases, where: 

a. a department or agency of the Federal Government, or a non-Federal entity acting on 

behalf of the Federal Government, is conducting the queries, searches, or other analyses 

to discover or locate a predictive pattern or anomaly indicative of terrorist or criminal 

activity on the part of any individual or individuals; 

b. the queries, searches, or other analyses are not subject-based and do not use personal 

identifiers of a specific individual, or inputs associated with a specific individual or 

group of individuals, to retrieve information from the database or databases; and 

c. the purpose of the queries, searches, or other analyses is not solely— 

i. the detection of fraud, waste, or abuse in a Government agency or program; or 

ii. the security of a Government computer system. 

(2) DATABASE. The term “database” does not include 

telephone directories, news reporting, information that is 

publicly available to any member of the public without 

payment of a fee, or databases of judicial and 

administrative opinions or other legal research sources.8 

Three Treasury bureaus maintain systems using applications that meet the 

definition of data mining: the Financial Crimes Enforcement Network (FinCEN), 

the Internal Revenue Service (IRS), and the Alcohol and Tobacco Tax and Trade 

Bureau (TTB). These systems were discussed in previous Treasury data mining 

reports and can be found on Privacy Reports | U.S. Department of the Treasury. 

42 U.S.C § 2000ee-3(b)(1). “[T]elephone directories, news reporting, 

information publicly available to any member of the public without payment of 

a fee, or databases of judicial and administrative opinions or other legal research 

sources” are not “databases” under the Act. § 2000ee- 3(b) 

18
	

8 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

FINCEN’s FY 2021 DATA MINING REPORT 

The Federal Agency Data Mining Reporting Act of 2007 requires the 

head of each Department or agency of the Federal Government that is engaged 

in any activity that uses or develops data mining to submit a report to Congress 

on all pattern-based data mining activities. Each report must include the 

following information for each activity where data mining is in use or in 

development: 

(A) A thorough description of the data mining activity, its goals, and, 

where appropriate, the target dates for the deployment of the data 

mining activity. 

The mission of the Financial Crimes Enforcement Network (FinCEN) is 

to safeguard the financial system from illicit use, combat money laundering, and 

promote national security through the strategic use of financial authorities and 

the collection, analysis, and dissemination of financial intelligence. To 

accomplish its mission, FinCEN provides financial intelligence, data 

stewardship, and support for law enforcement, the intelligence community, and 

our foreign financial intelligence unit (FIU) partners. FinCEN also engages in 

the detection of trends and typologies of money laundering and terrorist 

financing. 

In furtherance of this goal, as set forth in 31 U.S.C. § 310, FinCEN is 

required to maintain a government wide data access service with a range of 

financial transaction information; to conduct analysis and dissemination of 

information in support of law enforcement at the federal, state, local, Tribal, and 

foreign levels; to identify emerging trends and methods in money laundering 

and other financial crimes; to serve as the FIU of the United States; and to carry 

out other delegated regulatory responsibilities. FinCEN works to achieve its 

mission while avoiding the collection and indexing of information on persons 

exercising their constitutional rights and civil liberties. 

FinCEN’s analysts use various data analysis techniques for generating 

leads on subjects or institutions whose activities warrant outreach, investigation, 

or other statutorily mandated activities. 

FinCEN has successfully developed algorithms to identify transactions 

associated with multiple types of illicit financial activity, including money 

laundering, terrorist financing, and cybercrime. FinCEN also uses algorithms to 

examine filing patterns across financial sectors. This analysis supports a broad 

range of objectives from the identification of trends and patterns of illicit 

financial activity to the detection of institutions that may require additional 

regulatory oversight. 

FinCEN continues to develop and expand the use of automated business 

rules to surface high value reports of illicit financial activity. The term “business 

19
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

rule” refers to automated queries or algorithms designed to screen incoming 

Bank Secrecy Act (BSA) filings against established criteria to identify high 

priority filings likely to require further review or analysis. FinCEN reviewed 

rule findings internally and distributed to external stakeholders, such as 

domestic law enforcement and foreign FIU partners. FinCEN’s business rules 

play a vital role in the identification and dissemination of timely financial 

intelligence to combat threats such as terrorist financing, money laundering, 

cyber threats, and other illicit financial activity. 

(B) A thorough description of the data mining technology that is being used 

or will be used, including the basis for determining whether a particular 

pattern or anomaly is indicative of terrorist or criminal activity. 

FinCEN leverages two principal methods for deriving information 

relevant to illicit financial activity from the BSA data. The first is contentdriven, searching for specific subject names, or term combinations used in 

reporting associated with various types of illicit financial activity. The second 

method is pattern-driven and can take various forms. FinCEN may derive 

patterns from searches for a subject in the data. FinCEN then identifies subjects 

that fit that same pattern and have certain filing profiles. Matching filing 

patterns across different types of BSA reports highlights anomalous behavior 

that leads to the identifying subjects for potential investigation. 

For content-driven data analysis, FinCEN staff use a web-based 

application called FinCEN Query. The application provides analysts with the 

capability to search for specific entity names and term combinations across all 

FinCEN’s records. For pattern-driven analysis, staff use commercial off-theshelf (COTS), open-source, and custom developed tools with capabilities 

including statistical, social network, geospatial analysis, data modelling, 

visualization, and text analytics that aid in the analysis of BSA data. These 

tools enable analysts to deconstruct, manipulate, and flexibly analyze large 

volumes of data in order to discover underlying patterns of behavior involving 

potential illicit entities or networks. 

(C) A thorough description of the data sources that are being or will be used. 

The data that is collected under FinCEN’s BSA authorities (“BSA data”) 

form the underlying data for FinCEN’s manual and automated search methods 

and trend analysis activities. 

To accomplish its mission and give context to the data FinCEN extracts 

from its BSA database, FinCEN also considers other information available to it 

through various sources, including open source material, law enforcement 

information, other government information, and information obtained through 

subscription services. FinCEN uses this information to support or amplify 

conclusions or hypotheses derived from the analysis of BSA data. For example, 

commercially available databases are used to support or further identify 

information and to aid in the identification of potential illicit activity based on 

20
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

suspicious trends, patterns, or methods. FinCEN’s trend analysis may also use 

public source information, commercial database information, and third-party 

data sources, such as Census Bureau, Social Security Administration,9 and 

Office of Foreign Assets Control data. 

(D) An assessment of the efficacy or likely efficacy of the data mining activity 

in providing accurate information consistent with and valuable to the 

stated goals and plans for the use or development of the data mining 

activity. 

FinCEN provides strategic and tactical products for several audiences: 

law enforcement, foreign FIU partners, financial regulators, the financial 

industry, and the general public. Each of these sets of consumers has different 

restrictions or guidelines under which FinCEN can provide BSA data or BSA 

data derived analysis. 

In FY 2021, FinCEN used BSA data to advance its investigations under 

Section 311 of the USA PATRIOT Act, further map out a range of illicit finance 

networks, and respond to specific requests for information from both law 

enforcement and intelligence community partners. FinCEN also used BSA data 

to identify potential BSA violations or programmatic deficiencies in furtherance 

or support of FinCEN examinations or enforcement investigations. 

For domestic and foreign law enforcement partners, FinCEN provides 

high value data analytics. For example, FinCEN has implemented a series of 

cybercrime-related business rules to assist in the identification of emerging 

cyber threats such as ransomware and business email compromise. FinCEN 

leverages business rules to actively monitor the volume of reported cyber 

threats, evaluate the potential risk these threats pose to financial institutions, and 

identify opportunities to increase threat preparedness. FinCEN has successfully 

leveraged cyber-related rules to track cyber criminals and develop financial 

intelligence products for law enforcement, identify the use of specialized 

malware associated with large-scale breaches and targeted attacks on payment 

systems, as well as review reporting of malware signatures and cyber intrusions 

affecting financial institutions. 

To proactively combat significant money laundering and terrorist 

financing threats, FinCEN has implemented a series of algorithms designed to 

identify anomalous Suspicious Activity Reports (SARs) and Currency 

Transaction Reports (CTR) that have not already been identified by law 

enforcement. FinCEN created the algorithms to aggregate data on entities found 

in the BSA filings who may be using aliases and/or false identifiers to obfuscate 

their identities. The algorithms have been instrumental in generating high 

9 The Death Master File is Social Security Administration (SSA) information used by medical researchers, 

hospitals, medical programs, and law enforcement agencies and other government agencies to verify a 

person’s death and to prevent fraud. Although it is SSA information, the National Technical Information 

Service in the Department of Commerce maintains the database. For more information, please visit the 

NTIS website. 

21
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

priority leads for FinCEN’s stakeholders.
	

FinCEN annually receives the results of surveys of its Egmont Group 

counterparts and domestic law enforcement agencies regarding the utility of its 

analytical products. These survey results consistently reflect positive feedback 

from our foreign and domestic stakeholders. FinCEN also receives feedback on 

individual reports from law enforcement and regulatory agencies on our efforts 

to combat terrorist financing, money laundering, and fraud against the U.S. 

government to include healthcare fraud and income tax fraud. 

FinCEN narrowly tailors its business rules to achieve its mission, and 

each rule is developed, tested, implemented, and re-tested for efficacy 

throughout its deployment. The Office of Chief Counsel and the Technology 

Division are engaged during the development of all business rules. FinCEN 

continues to receive strong positive feedback both from our domestic and 

foreign partners on the value of the financial intelligence derived from our 

business rules program. 

(E) An assessment of the impact or likely impact of the implementation of the 

data mining activity on the privacy and civil liberties of individuals, including 

a thorough description of the actions that are being taken or will be taken 

with regard to the property, privacy, or other rights or privileges of any 

individual or individuals as a result of the implementation of the data mining 

activity. 

The impact of FinCEN’s congressionally mandated mission on the 

privacy and civil liberties of individuals has been and will continue to be 

minimal. The Supreme Court has determined that financial information banks 

and other financial institutions hold—and that FinCEN collects and analyzes 

pursuant to its authority in 31 U.S.C. § 310 and the BSA (discussed in more 

detail in item (F) below)—carries no constitutionally protected expectation of 

privacy10 . The Right to Financial Privacy Act of 197811 expressly provides no 

protection for financial records or information required to be reported in 

accordance with any federal statute or regulation, which includes information 

contained in BSA reports. Nevertheless, during the development of all business 

rules, analytical models, and algorithms, FinCEN considers whether the 

analytics will adversely affect an individual or entity’s (to the extent applicable) 

privacy, civil rights, or civil liberties. 

Significantly, FinCEN takes no adverse actions against individuals based 

solely on the existence of, or information contained in BSA data since a BSA12 

report usually requires other data for there to be evidence of criminal activity. 

Therefore, in addition to considering it along with other information when 

10 United States v. Miller, 425 U.S. 435, 442 (1976).
	 11 12 U.S.C. § 3401, et seq.
	 12 12 U.S.C. § 3413(d) (“Disclosure pursuant to Federal statute or rule promulgated thereunder: Nothing in
	

this chapter shall authorize the withholding of financial records or information required to be reported in
	

accordance with any Federal statute or rule promulgated thereunder.”)
	

22
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

taking actions under its own authorities, FinCEN provides the data, or analytical 

products analyzing the data, to outside agencies where the information may be 

relevant to current or potential investigations or proceedings under the 

jurisdiction of those agencies. 

The collected information is generally subject to the Privacy Act of 

1974,13 which is discussed in more detail under item (F) below. FinCEN has 

developed policies and procedures to ensure that: (1) the analyzed information is 

used for purposes authorized by applicable law; and (2) the security of the 

information is adequately maintained. Analytical products produced by FinCEN 

are subject to clear restrictions regarding use and further dissemination of the 

products to ensure that the products will only be used by appropriate agencies 

for statutorily authorized purposes. To the extent such products reference 

information collected pursuant to the BSA, FinCEN has issued guidelines 

requiring user agencies to attach warning language to such products and to 

follow specific procedures for further dissemination of the BSA information. 

These procedures aim to ensure that: (1) only appropriate agencies will have 

access to the information; (2) the information will be used for statutorily 

authorized purposes; (3) agencies with access to FinCEN data are aware of the 

sensitivity of the material; and (4) FinCEN will be able to track which agencies 

have such materials in their possession. 

FinCEN posts Privacy Impact Assessments (PIA) on its public website, 

which informs the public of FinCEN’s activities and practices related to the 

collection, processing, retention, and distribution of personally identifiable 

information (PII).14 The PII that FinCEN data repositories handle is necessary to 

assist regulators and law enforcement in identifying and monitoring the 

financial activities of individuals who are potentially committing financial 

crimes. 

(F) A list and analysis of the laws and regulations that govern the 

information being or to be collected, reviewed, gathered, analyzed, or 

used in conjunction with the data mining activity to the extent 

applicable in the context of the data mining activity. 

The Bank Secrecy Act, 31 U.S.C. § 5311, et seq. (BSA) and implementing 

regulations, 31 C.F.R. Chapter X, et seq: 

31 U.S.C. § 5311— Declaration of Purpose 

This section specifies that the purpose of the recordkeeping and reporting 

requirements in the BSA is to, “require certain reports where they have a high 

degree of usefulness in criminal, tax, or regulatory investigations or 

proceedings, or in the conduct of intelligence or counterintelligence activities, 

including analysis, to protect against international terrorism.” 

13 5 U.S.C. § 552a. 

14 For more information about FinCEN PIAs, please visit FinCEN’s website. 

23
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

31 C.F.R. § 1010.301 — Determination by the Secretary
	

This regulation reflects the Secretary of the Treasury’s determination that the 

reports collected pursuant to the BSA have a “high degree of usefulness,” in 

criminal, tax, or regulatory investigations or proceedings. 

31 U.S.C. § 5319 — Availability of Reports 

This section makes it clear that, upon request, the Secretary of the Treasury (as 

delegated to FinCEN pursuant to Treasury Order 180-01) shall provide BSA 

information to an agency, including state financial institutions supervisory 

agencies, United States intelligence agencies, or self-regulatory organizations 

registered with the Securities and Exchange Commission or the Commodity 

Futures Trading Commission, for purposes consistent with the subsection. This 

section also provides that reports collected pursuant to the BSA are exempt from 

disclosure under the Freedom of Information Act, 5 U.S.C. § 552. 

31 C.F.R. § 1010.950 — Availability of Information 

This section authorizes the Secretary to disclose BSA information for any reason 

consistent with the purposes of the BSA and specifies that the recipients are to 

receive the information in confidence and shall not be further disclosed to any 

person except for official purposes relating to the investigation, proceeding or 

matter in connection with which the information is sought. 

31 U.S.C. § 5313 — Reports on domestic coins and currency transactions 

This section provides for the reporting by financial institutions of certain 

currency transactions in an amount, denomination, or amount and denomination, 

or under circumstances the Secretary (as delegated to FinCEN) prescribes by 

regulation. 

31 C.F.R. §§ 1010.311; 1021.311 — Reports of transactions in currency 

These regulations implement the reporting requirement of 31 U.S.C. §5313 and 

specify the amount of reportable transactions in currency at more than $10,000. 

31 U.S.C. § 5316 — Reports on exporting and importing monetary instruments 

This section requires reports by those that transport currency or other monetary 

instruments of more than $10,000 at one time from or through a place outside 

the United States into the United States, or from the United States to or through 

a place outside the United States. 

31 C.F.R. § 1010.340 — Reports of transportation of currency or monetary 

instruments 

This regulation implements the reporting requirement of 31 U.S.C. § 5316 with 

respect to currency or other monetary instruments of more than $10,000 

physically transported, mailed, or shipped into the United States or physically 

transported, mailed, or shipped outside the United States. 

24
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

31 U.S.C. § 5314 — Records and reports on foreign financial agency 

transactions 

This section authorizes the Secretary (as delegated to FinCEN) to prescribe 

regulations requiring the reporting of certain types of foreign transactions and 

relationships with foreign financial institutions. 

31 C.F.R. § 1010.350 — Reports of foreign financial accounts 

This regulation, implementing 31 U.S.C. § 5314, requires that U.S. persons file 

reports of foreign bank accounts. 

31 C.F.R. § 1010.360 – Reports of transactions with foreign financial agencies 

This regulation provides that the Secretary (as delegated to FinCEN) may 

promulgate regulations requiring specified financial institutions to file reports of 

certain transactions with designated foreign financial agencies. These 

regulations may be kept confidential, and do not always have to be published in 

the Federal Register, so long as any financial institutions subject to the 

regulation will be named and personally served or otherwise given actual notice. 

31 U.S.C. § 5318(g) — Reporting of suspicious transactions 

This section authorizes the Secretary (as delegated to FinCEN), to require the 

reporting of suspicious transactions relevant to a possible violation of law or 

regulation. The section also provides for the confidentiality of such reports, 

barring financial institutions from notifying anyone involved in the transaction 

that the transaction has been reported. Government employees are subject to the 

same confidentiality restrictions, except as “necessary to fulfill the official 

duties” of such employees. The policies and procedures detailed above in 

response to item (E) are aimed, in large part, at maintaining the confidentiality 

of these reports. 

31 C.F.R. §§1010.320; 1020.320; 1021.320; 1022.320; 1023.320; 1024.320; 

1025.320; 1026.320— Reports of Suspicious Transactions 

These regulations implement 31 U.S.C. § 5318(g), requiring covered financial 

institutions to file suspicious activity reports and requiring the maintaining of 

strict confidentiality of the reports. 

31 U.S.C. § 5331 — Reports relating to coins and currency received in 

nonfinancial trade or business 

This section provides for the reporting of currency transactions of more than 

$10,000 by businesses other than financial institutions. 

31 C.F.R. § 1010.330 — Reports related to currency in excess of $10,000 

received in a trade or business 

This regulation implements 31 U.S.C. § 5331. 

12 U.S.C. § 1829b(b)(3) – International Funds Transfer Reporting 

25
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Requirements
	

This section states that the Secretary and the Board of Governors of the Federal 

Reserve System shall jointly prescribe, after consultation with State banking 

supervisors, final regulations requiring that insured depository institutions, 

businesses that provide check cashing services, money transmitting businesses, 

and businesses that issue or redeem money orders, travelers’ checks or other 

similar instruments maintain records of payment orders which involve 

international transactions; and direct transfers of funds over wholesale funds 

transfer systems or on the books of any insured depository institution, or on the 

books of any business that provides check cashing services, any money 

transmitting business, and any business that issues or redeems money orders, 

travelers’ checks or similar instruments, that will have a high degree of 

usefulness in criminal, tax, or regulatory investigations or proceedings. 

31 CFR § 1020.410(a) – Records to be made and retained by banks 

This regulation implements 12 U.S.C. § 1829b(b)(3), and requires each bank 

covered by the regulation to retain records of funds transfers in the amount of 

$3,000 or more. 

31 U.S.C. § 5318A – Special measures for jurisdictions, financial institutions, 

international transactions, or types of accounts of primary money laundering 

concern 

The Secretary of the Treasury (as delegated to FinCEN) may require any 

domestic financial institution or financial agency to maintain specified records 

and file reports upon a finding that a jurisdiction outside of the United States, 

one or more financial institutions operating outside of the United States, one or 

more classes of transactions within, or involving, a jurisdiction outside of the 

United States, or one or more types of accounts is of primary money laundering 

concern, the Secretary of the Treasury (as delegated to FinCEN) may require 

any domestic financial institution or financial agency to maintain records, file 

reports, or both, concerning the aggregate amount of transactions, or concerning 

each transaction, with respect to the entity found to be of primary money 

laundering concern; beneficial ownership of any account opened or maintained 

in the United States by a foreign person or a representative of that foreign 

person that involves the entity found to be of primary money laundering 

concern; or information relating to certain correspondent accounts. 

Section 314a of the USA PATRIOT Act – Cooperative Efforts to Deter 

Money Laundering 

This section (located in the Notes to 31 U.S.C. § 5311) helps law enforcement 

identify, disrupt, and prevent terrorist acts and money laundering activities by 

encouraging further cooperation among law enforcement, regulators, and 

financial institutions to share information regarding those suspected of being 

involved in terrorism or money laundering 

31 CFR § 1010.520 – Information sharing between government agencies and 

26
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

financial institutions 

This regulation implements Section 314a of the USA PATRIOT Act of 2001
	

and provides that a law enforcement agency investigating terrorist activity or
	

money laundering may request that FinCEN solicits, on the investigating
	

agency’s behalf, certain information from a financial institutions or group of
	

financial institutions. The requesting agency must provide a written certification
	

that each entity for which the agency is seeking information is engaged in or is
	

reasonably suspected based on credible evidence of engaging in, terrorist
	

activity or money laundering along with specific identifies. FinCEN may also
	

solicit, on its own behalf, and on behalf of appropriate components of the
	

Department of the Treasury such information.
	

The Privacy Act of 1974 (Privacy Act), 5 U.S.C. § 552a 

The reports that FinCEN collects pursuant to the BSA are “records” contained
	

in a “system of records,”15 and are covered by the Privacy Act. Covered records
	

may be disclosed without the permission of the individual to whom the record
	

pertains if they are disclosed to individuals and organizations external to the
	

U.S. Department of the Treasury pursuant to a “routine use,”16 and are disclosed
	

for purposes for which the information was collected. FinCEN’s routine uses are
	

included in three published Systems of Records Notices (SORNs) that cover the
	

information it collects under the BSA:
	

(1) Treasury/FinCEN .001, FinCEN Investigations and Examinations System,17 

(2) Treasury/FinCEN .002, Suspicious Activity Report (SAR) System;18 and 

(3) Treasury/FinCEN .003, Bank Secrecy Act (BSA) Reports System.19 

FinCEN followed Privacy Act procedures (including appropriate public 

notice and comment periods) to exempt certain records maintained in the SARs 

and BSA systems of records from specific provisions of the Privacy Act, 

including those allowing for subject’s access to the reports, notification to the 

subject when reports are shared, requests for correction of the contents of such 

reports by the subject, and the civil remedies covering these areas. These 

exemptions prevent individuals who are planning crimes from avoiding 

detection or apprehension or structuring their operations to avoid detection or 

apprehension. 

Other Relevant Provisions 

15 5 U.S.C. § 552a(a)(3) (defining a “record” to mean any item, collection, or grouping of information about 

an individual that is maintained by an agency, including, but not limited to, his education, financial 

transactions, medical history, and criminal or employment history and that contains his name, or the 

identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or 

voice print or a photograph and a “system of records” to mean a group of any records under the control of 

any agency from which information is retrieved by the name of the individual or by some identifying 

number, symbol, or other identifying particular assigned to the individual); 

16 5 U.S.C. § 552a(b)(3). 

17 79 Fed. Reg. 20969 (April 14, 2014). 

18 Id. at 20972. 

19 Id. at 20974 

27
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

31 U.S.C. § 310 — Financial Crimes Enforcement Network
	

This section establishes FinCEN as a bureau in the Department of the 

Treasury, sets out the duties and powers of the Director, and empowers the 

Director to administer the BSA to the extent delegated by the Secretary of the 

Treasury.20 This section also requires FinCEN to maintain a “government-wide 

data access service” for the information collected under the BSA, as well as 

records and data maintained by other government agencies and other publicly 

and privately available information.21 

FinCEN is required to “analyze and disseminate” the data for a broad 

range of purposes consistent with the law.22 These purposes include identifying 

possible criminal activity; supporting domestic and international criminal 

investigations (and related civil proceedings); determining emerging trends and 

methods in money laundering and other financial crimes; supporting the conduct 

of intelligence and counterintelligence activities, including analysis, to protect 

against international terrorism; and supporting government initiatives against 

money laundering. 

The section further requires that FinCEN furnish research, analytical, 

and informational services to financial institutions and domestic and foreign law 

enforcement agencies for the “detection, prevention, and prosecution of 

terrorism, organized crime, money laundering and other financial crimes,” and 

provide, “computer and data support and data analysis to the Secretary of the 

Treasury for tracking and controlling foreign assets23.” The section also provides 

for the establishment of standards for making the information available through 

efficient means, and to screen appropriate users and appropriate uses24. The 

activities and procedures described in this report adhere to the requirements of 

this statute. 

(G) A thorough discussion of the policies, procedures, and guidelines that 

are in place or that are to be developed and applied in the use of such 

data mining activity in order to: 

(i)		 protect the privacy and due process rights of 

individuals, such as redress procedures. 

A description of the policies, procedures, and guidance in place to ensure 

the privacy and due process rights of individuals that are the subject of FinCEN 

data mining activities is provided in subsection (E) above. 

(ii) ensure that only accurate and complete information 

20 Treasury Order 180-01, Financial Crimes Enforcement Network (July 1, 2014) (delegating to the
	

Director of FinCEN various duties and responsibilities, including the authority to administer, implement,
	

and enforce the BSA)
	 21 31 U.S.C.§ 310(b)(2)(B).
	 22 Id. at § 310(b)(2)(C)(i)-(vii).
	 23 Id. at § 310(b)(2)(E), (G).
	 24 Id. at § 310(c)(1) and (c)(2).
	

28
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

is collected, reviewed, gathered, analyzed, or used, 

and guard against any harmful consequences of 

potential inaccuracies. 

FinCEN, through its data perfection procedures, ensures that information 

contained in the database of BSA reports is accurate and complete. In addition, 

as discussed in item (E) above, FinCEN does not take adverse actions against 

individuals (outside the context of enforcing the requirements of the BSA itself) 

based on the information contained in BSA reports. In addition, because user 

agencies only use BSA information in conjunction with other evidence, a BSA 

report is not used as the sole basis for user agencies’ adverse actions. 

As noted earlier in this report, individuals have not constitutionally 

protected “expectation of privacy” in FinCEN’s BSA data, and FinCEN takes 

no adverse actions against individuals based on the BSA data collected. 

Nevertheless, FinCEN’s BSA analyst training discusses the importance of 

confidentiality, safeguarding and non-disclosure of BSA data to unauthorized 

individuals or organizations. Additionally, all FinCEN staff are required to 

complete Privacy Awareness training annually which includes staff’s privacy 

responsibilities, including the Privacy Act handling and safeguarding 

responsibilities that apply to all BSA data. Accountability for the BSA data’s 

security and confidentiality and its handling are prominently articulated in all 

course materials. FinCEN also has mandatory training for its BSA data users, 

including secure handling and safeguarding of the information. FinCEN 

provides online training for all external users as a requirement for access to 

FinCEN Query. At a minimum, biennially, BSA data users must complete 

training as a requirement of continued system access. In addition to this online 

training, FinCEN hosts webinars as requested. 

29
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

ALCOHOL AND TOBACCO TAX AND TRADE BUREAU (TTB) FY 2021 

DATA MINING REPORT 

TTB Data Mining Activities 

(A) A thorough description of the data mining activity, its goals, and, where 

appropriate, the target dates for the deployment of the data mining 

activity. 

TTB performs two types of activities that together qualify as data mining as 

defined by the Federal Agency Data Mining Reporting Act of 2007: 

•		 Queries of commercial transactions recorded by tax and trade databases 

maintained by TTB and other Federal agencies; and 

•		 Searches of commercial and law enforcement databases to discover
	

criminal activity.
	

The data is gathered through queries of registered individuals or 

businesses and include some queries that are solely based on subject matter (for 

example, queries of all tobacco products imported over a given time period). 

TTB conducts these activities for the purpose of compiling business intelligence 

reports and as part of a strategic risk-based approach to effectuate TTB’s 

mission to collect the revenue and to ensure only qualified businesses enter the 

alcohol and tobacco industries. Through data-driven analysis, TTB focuses on 

identifying the highest risk activity for further TTB action, including research, 

audits, and investigations. Continuous refinements to these data analytic reports 

combined with sound intelligence enable TTB to efficiently deploy its resources 

to address the most serious revenue threats or to prevent persons likely to 

engage in illicit activity from commencing operations. 

(B) A thorough description of the data mining technology that is being used 

or will be used, including the basis for determining whether a particular 

pattern or anomaly is indicative of terrorist or criminal activity. 

TTB uses commercially available data mining technologies to access and 

analyze information. The experience of TTB field staff determines whether a 

particular pattern or anomaly is indicative of violations that may be subject to 

further field review and investigation. 

Most data mining is conducted with a combination of statistical analysis 

software (SAS) and Oracle relational database systems. Data are retrieved with 

SAS data step programming and/or Structured Query Language (SQL) queries. 

Data fields are transformed with procedures that aggregate, correlate, cluster, 

and otherwise simplify available variables. Once data is collected and 

transformed, TTB develops reports that consolidate specific factors along with 

business rules that flag entities needing additional research. This additional 

research may serve as the basis of referral for further TTB action. 

30
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(C) A thorough description of the data sources that are being or will be 

used. 

TTB uses data from its own databases, the databases of other Federal 

agencies, and commercial data providers. The data sources include: 

Internal Data: 

•		 Integrated Revenue Information System (IRIS) – tax data submitted by
	

TTB industry members;
	

•		 Permits Online (PONL) – application data from businesses requesting a
	

TTB permit;
	

•		 AutoAudit and Case Management System – data from TTB’s audits and
	

investigations;
	

•		 Formulas Online (FONL) – data from businesses submitting formula
	

approval requests; and
	

•		 Certification/Exemption of Label/Bottle Approvals (COLAS) Online –
	

data from businesses submitting labels for approval.
	

External Data: 

•		 International Trade Data System (ITDS) - data regarding imports of products
	

regulated by TTB;
	

•		 LexisNexis Accurint – a commercial database containing records of court 

proceedings, including some criminal cases, property holdings, and bankruptcies; and 

•		 Standard & Poor’s Capital IQ – commercial database containing company profiles, 

including ownership and financial information. 

(D) An assessment of the efficacy or likely efficacy of the data mining 

activity in providing accurate information consistent with and valuable 

to the stated goals and plans for the use or development of the data 

mining activity 

TTB’s data mining activity automates certain routine screening and 

monitoring processes to improve permit application reviews and detection of tax 

compliance violations. New analytic tools identified cases with significant tax 

compliance violations that required TTB follow-up action over 84% of the time. 

Other business intelligence reports and dashboards automatically consolidate 

data and monitor operations, tax payments, and import activity patterns. These 

reports facilitate TTB oversight of a wider selection of its regulated industries 

and serve as the source of referrals for enforcement cases. For FY21, TTB had 

a 66% success rate of enforcement cases initiated using analytics. Cases 

identified through analytics were nearly twice as effective as those initiated 

through traditional methods, such as referrals or complaints. . 

(E) An assessment of the impact or likely impact of the implementation of 

the data mining activity on the privacy and civil liberties of individuals, 

including a thorough description of the actions that are being taken or 

will be taken with regard to the property, privacy, or other rights or 

privileges of any individual or individuals as a result of the 

31
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

implementation of the data mining activity. 

TTB’s data mining activity has little impact on the privacy and civil 

liberties of individuals. Insights gained from the activity primarily result in 

actions against property, or the privilege to operate in regulated industries, after 

thorough review by experienced specialists with oversight authorities mandated 

by Federal laws and regulations. The data sources mined are also limited to 

include only tax records, regulatory records, commercial records, and law 

enforcement records authorized for use in oversight and enforcement. 

Any data concerning individuals or businesses are vigorously protected 

against unauthorized use and disclosure. Policies and procedures prohibit the 

search of any database for reasons other than providing authorized oversight or 

enforcement. In cases when patterns in data are thought to be indicative of 

compliance issues, the data and circumstances are carefully reviewed by 

experienced staff before any adverse action is taken. TTB also continues to 

protect data against any unauthorized disclosure through all investigation and 

enforcement actions. 

Data gathered in data mining activities is considered private and 

confidential and 26 U.S.C. § 6103 protects it from disclosure. TTB handles this 

data consistent with that statute. Privacy protections are further assured by 

additional laws that provide for civil and criminal penalties for any unauthorized 

disclosure of taxpayer data. There are criminal penalties including: (1) felony 

for the willful unauthorized disclosure of tax information; (2) misdemeanor for 

the unauthorized inspection of tax information; and (3) civil cause of action for 

the taxpayer whose information has been inspected or disclosed in a manner not 

authorized. 

(F) A list and analysis of the laws and regulations that govern the 

information being or to be collected, reviewed, gathered, analyzed, or 

used in conjunction with the data mining activity to the extent applicable 

in the context of the data mining activity 

TTB administers the provisions of the Internal Revenue Code (IRC) 

relating to distilled spirits, wine, and beer (26 U.S.C. Chapter 51), tobacco (26 

U.S.C. Chapter 52), firearms and ammunition excise taxes (26 U.S.C. § 4181, 

4182, and related portions of chapter 32), and the general rules of tax procedure 

with respect to these commodities (including related criminal provisions at 26 

U.S.C. Chapters 68 and 75). In addition, TTB administers the Federal Alcohol 

Administration Act (27 U.S.C. chapter 8, subchapter I), which covers basic 

permits, unfair trade practices, and labeling and advertising of alcohol 

beverages; the Alcoholic Beverage Labeling Act of 1988 (27 U.S.C. chapter 8, 

subchapter II), which requires a specific “Government Warning” statement on 

alcohol beverage labels; and the Webb-Kenyon Act (27 U.S.C. §§ 122-122b), 

which prohibits the shipment of liquor into a state in violation of state law. 

The IRC establishes qualification criteria to engage in the businesses 

relating to manufacturing and importing or exporting tobacco products, and 

32
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

manufacturing or importing processed tobacco, and require that persons obtain 

permits to engage in these activities. See 26 U.S.C. § 5713. A permit 

qualification requirement also applies to the production of distilled spirits and 

wine, as well as to the wholesaling and importation of all beverage alcohol 

products. See 26 U.S.C. §§ 5171(c) and (d), 5271; see also 27 U.S.C. §§ 201 et 

seq. 

The Secretary of the Treasury originally retained the authority to collect 

excise taxes on imported alcohol and tobacco products through the Homeland 

Security Act of 2002 (See 6 U.S.C. §§ 212 and 215). Through Treasury Order 

100–16, the Secretary of the Treasury delegates authority over “Customs 

revenue functions” to the Secretary of the Department of Homeland Security. 

The Homeland Security Act of 2002 defines these functions as “assessing and 

collecting customs duties (including antidumping and countervailing duties and 

duties imposed under safeguard provisions), excise taxes, fees, and penalties 

due on imported merchandise, including classifying and valuing merchandise 

for purposes of such assessment.” (6 U.S.C. § 215(a)(1)). 

TTB is authorized pursuant to the Homeland Security Act of 2002, Pub. 

L. 107-296; Executive Order 13439, July 18, 2007; the Internal Revenue Code 

of 1986 (IRC); and the Federal Alcohol Administration Act, 27 U.S.C. chapter 8 

(FAA Act) to access data within Customs and Border Protection (CBP) data 

systems necessary to fulfill its statutory mission. TTB is working in conjunction 

with CBP to fulfill its statutory mission as it relates to imported products subject 

to various taxes and to ensure taxpayers understand their tax responsibilities 

related to these products. Cooperative efforts across Federal agency lines will 

accommodate the collection of data as it relates to imported commodities 

subject to Federal taxes, including but not limited to retail, excise, 

manufacturers, and environmental taxes. 

When the data analyzed by the reports consists of taxpayer information, 

26 U.S.C. § 6103 governs the use of all tax-related data. Subsection (a) sets out 

the general rule of confidentiality. Subsection (b) sets forth definitions of terms 

commonly used throughout Section 6103. Subsections (c) through (o) of Section 

6103 contain exceptions to the general rule of confidentiality. The use of 

confidential commercial, financial, or trade secrets information is governed by 

the Trade Secrets Act, 18 U.S.C. § 1905, which prohibits the unlawful 

disclosure of this information by any Federal official, employee, or contractor. 

(G) A thorough discussion of the policies, procedures, and guidelines that are in 

place or that are to be developed and applied in the use of such data mining 

activity in order to: 

(i) protect the privacy and due process rights of individuals, such as 

redress procedures. 

All of TTB’s information collections are subject to the OMB review 

process and any forms that request personal information subject to the Privacy 

33
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Act include a Privacy Act Statement. In addition, TTB’s privacy policy is 

posted on TTB’s website and is referenced on TTB’s Online Applications. 

TTB’s systems of record notice can be found in the Federal Register at 80 F.R. 

4637 (January 28, 2015). 

TTB data mining activities do not determine whether a person or entity 

will be subject to administrative enforcement action or criminal prosecution. 

Any audit or investigation that is initiated based, in part, upon data from the 

activities are governed by the laws, administrative procedures, policies, and 

controls that govern criminal investigations or any other ensuing actions. 

Information generated and accessed by the data mining activities is 

protected by internal controls that limit access to persons whose official duties 

require inspection of such information for tax administration purposes. The 

information is further protected by 26 U.S.C. § 6103, governing the 

confidentiality of returns and return information, and the Trade Secrets Act, 18 

U.S.C. § 1905, which protects confidential commercial, financial, or trade 

secrets information collected by the Federal government. 

TTB notifies system operators of the requirements and legal 

consequences of accessing predictive models and/or analytic reports. The 

message states: 26 U.S.C. § 6103 Data Warning. Information contained in this 

report is tax return information protected from disclosure by 26 U.S.C. § 6103. 

By accessing this report, you hereby certify that your official duties require you 

to inspect such information for tax administration purposes. 

Users of analytic reports receive demonstrations of reports, dashboards, 

user guides and/or product descriptions, as needed. Field Operations staff 

receive 26 U.S.C. § 6103 and disclosure training. In addition, all TTB 

employees complete the annual Privacy Awareness and Cyber Security 

Awareness training. Finally, system sponsors and IT staff supporting 

development, maintenance, and operations of IT systems are required to take 

additional specialized security training each year. 

(ii) ensure that only accurate and complete information is collected, 

reviewed, gathered, analyzed, or used, and guard against any harmful 

consequences of potential inaccuracies. 

TTB has programs and processes in place to ensure its decisions are 

made with good quality data. 

TTB documents and manages all data sets associated with its systems 

using the TTB Systems Development Life Cycle (SDLC). This process 

includes the identification and correction of data inconsistences with system 

owners. These data corrections conform to Office of the Chief Information 

Officer (OCIO) Data Management best practices and standards to ensure they 

are documented, authorized, tested, and quality checked before and after 

execution. 

34
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

In addition to the SDLC, TTB’s Data Governance Program prescribes 

the standards, roles, responsibilities, and processes over data quality. TTB 

formally assesses the quality of data in key business areas, identifies priorities in 

resolving poor data quality issues, and has dedicated teams to resolve them. 

These teams include technical and subject matter experts who perform root 

cause analysis, provide process and/or system fixes, and cleanse poor quality 

data. TTB also uses a tool that consolidates all known data quality issues and 

monitors the effectiveness of its efforts to improve data quality. 

The Memorandum of Understanding with CBP contains language that 

both parties will notify one another if either agency discovers data issues. 

TTB does not rely solely on information gathered to take any adverse 

action against any individual or entity. Rather, the reports are the first step in 

gathering data and this information is verified through subsequent research, and 

investigation and/or audits of companies before any action is taken. 

INTERNAL REVENUE SERVICE (IRS) FY 2021 DATA MINING 

REPORT 

(A) A thorough description of the data mining activity, its goals, and, 

where appropriate, the target dates for the deployment of the data 

mining activity. 

Four divisions of the IRS are engaged in data mining activities covered 

by the Act: IRS Criminal Investigation organization (IRS-CI); the IRS Small 

Business/Self-Employed Division (SB/SE); the IRS Wage and Investment 

Division (W&I); and the IRS Research, Applied Analytics, and Statistics 

Division (RAAS). In FY 2021, each of these IRS divisions used one or more 

data mining applications/computing environments to search for specific 

characteristics that are indicators of potential criminal activity: 

•		 Investigative Data Examination Application (IDEA) - formerly
	

known as Investigative Data Analytics;
	

•		 Lead and Case Analytics (LCA); 

•		 Return Review Program (RRP); 

•		 FinCEN Query; and 

•		 Compliance Data Warehouse (CDW) 

IRS-CI is tasked with protecting IRS revenue streams by detecting 

fraudulent activity and preventing recurrences. In FY 2021, IRS-CI used IDEA, 

LCA, and RRP systems to support this work. Data uncovered using these 

systems may be reflected in indictments and criminal prosecutions. 

IDEA is a data query tool currently in use at the CI Lead Development 

Centers (LDC), Scheme Development Centers (SDC) and field offices, and it 

provides CI analysts and special agents with the ability to quickly search 

electronic data through a single access point. By using the IDEA application, 

35
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

special agents and investigative analysts can proactively identify patterns 

indicative of illegal activities. This tool enhances investigation selection and 

supports investigative priorities in tax law enforcement, counterterrorism, and 

other high-priority criminal investigations. The IDEA application uses data for 

both reactive and proactive queries. Reactive queries are a result of specific, 

targeted investigations; proactive queries are the result of pattern matching to 

generate leads. Data available in the IDEA application enable users to detect 

suspicious financial transactions indicative of money laundering, terrorism, and 

other financial crimes. IDEA query results are used exclusively for generating 

leads. Any investigative process that results from these leads uses the 

corresponding data from the originating systems. 

LCA is a data query and visualization application that allows CI 

investigative analysts and agents to query and analyze large and disparate sets of 

data through a single access point. This enhances the analyst’s ability to develop 

a comprehensive picture of suspicious or criminal activity. The LCA application 

uses data for both reactive and proactive queries. Reactive queries are a result of 

specific, targeted investigations; proactive queries are the result of pattern 

matching to generate leads. Data available in the LCA application enable users 

to detect suspicious financial transactions indicative of money laundering, 

terrorism, and other financial crimes. The application presents information to 

the user visually, exposing associations between entities in the data that might 

otherwise remain undiscovered. The software used to create LCA allows users 

from the LDCs, SDCs, and field offices to create visualization diagrams, graphs, 

spreadsheets, reports, timelines, and maps to enhance investigation selection. It 

also supports investigative priorities to proactively identify and develop leads 

for refund fraud, identity theft, counterterrorism, money laundering, offshore 

abusive trust schemes, and other financial crime, as well as Bank Secrecy Act 

(BSA) Suspicious Activity Report (SAR) reviews and Financial Crimes Task 

Force activity. 

IRS-CI and W&I use RRP to maximize detection of tax return fraud, tax 

noncompliance, and identity theft. As RRP receives returns, it loads and assigns 

a risk score to each tax return based on an array of models. Scores range from 

0.0 to 1.0, with a higher score indicating a greater potential for fraud/noncompliance/identity theft. In addition to models, RRP also includes multiple 

model scores and linking characteristics. IRS uses these analytics, including 

data mining, to systemically stop suspicious refunds from being automatically 

issued to taxpayers. In RRP, IRS-CI does not directly examine the scores, but 

does use returns that W&I determines to be potentially fraudulent as a basis for 

its criminal investigations. RRP employs multiple technologies for data mining 

activities. Each of these technologies use current year examples of identity theft 

(IDT), non-IDT tax fraud, and non-fraud to develop supervised models, 

unsupervised models, rules, and network analytics. 

IRS-CI and SB/SE users access the FinCEN Query system (see FinCEN 

report) as the system of record for Bank Secrecy Act (BSA) data. 

36
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

CDW is an analytical computing environment managed by RAAS that is 

used by IRS researchers for high performance computing and advanced 

analytics. It simplifies access to over 50 legacy and third-party data sources 

through a self-service analytical model that fosters collaboration among 

business units and better sharing of data assets. A large and diverse set of use 

patterns includes: 

•		 Machine learning and deep learning. Used to detect IDT and refund
	

fraud patterns; develop return-based scores for compliance planning;
	

identify anomalies for case selection; embed case routing and
	

treatment strategies into collection processes; and predict journey
	

events in the sequence of customer service interactions.
	

•		 Natural language processing. Used to better understand behavioral
	

factors in taxpayer decisions; categorize appeals determinations;
	

identify related entities, material advisors, and other parties in complex
	

business structures; compare third-party documents and classify topics
	

in customer service case notes. Also used for language translation to
	

convert machine-readable text from dozens of foreign languages to
	

English to facilitate other analytical methods.
	

•		 Graph analytics. Used to identify complex relationships and fraud patterns in 

corporate flow-throughs, tax shelters and entity establishments; detect 

noncompliance in preparer networks; develop risk-based models for multi-party 

transactions; and model the diffusion of tax law changes through internal orders, 

process controls, and policies. 

•		 Simulation. Used to perform what-if calculations for changes in tax policy; 

develop models of taxpayer choice for customer service channels; model tax 

evasion for pass-through entities; estimate taxpayer burden measures; better 

understand the impacts of labor migration; and facilitate improved workload 

planning for non-filer strategies. 

•		 Optimization. Used to create dynamic, next-best-case
	

recommendation for workload delivery; develop enterprise staffing
	

attrition models; and identify optimal post-of-duty locations.
	

(B) A thorough description of the data mining technology that is being used or 

will be used including the basis for determining whether a particular pattern 

or anomaly is indicative of terrorist or criminal activity 

IDEA and LCA do not provide IRS with the ability to determine 

indicators of terrorist or criminal activity. Special agents and investigative 

analysts can query based on experience. Agents and analysts determine 

indicators of fraudulent activity based on previous successful investigations of 

money laundering, counterterrorism, and BSA violations. 

W&I employees use RRP to identity potentially fraudulent, 

noncompliant, and identity theft activity. IRS-CI uses the fraudulent tax returns 

identified by W&I as a basis for its criminal investigations. Paper refund returns 

37
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

come to RRP from the Generalized Mainline Framework (GMF).25 This allows 

W&I and SDC employees to review those returns for suspicious activities. 

If a return meets designated score tolerances and/or other criteria, W&I 

and IRS-CI personnel may examine the return for fraudulent activity. Once a 

return is verified to be false via screening, Taxpayer Protection Program 

authentication and/or the wage verification process, the fraudulent returns are 

added via Electronic Fraud Detection System Case Management systemically or 

by W&I and CI-IRS users to the Scheme Tracking and Retrieval System 

(STARS) component. IRS-CI investigative analysts review the returns in 

Discoverer and STARS to find possible schemes, or fraudulent patterns, which 

may result in a referral to a CI field office for investigation. 

RRP employs multiple technologies for data mining activities. Each of 

these technologies use current year examples of IDT, non-IDT tax fraud, and 

non-fraud to develop supervised models, unsupervised models, rules, and 

network analytics: 

•		 SAS – RRP uses SAS as the workbench for developing and evaluating supervised and 

unsupervised models as well as for data exploration activities. RRP uses multiple 

SAS machine learning algorithms (e.g., decision trees, neural networks, logistic 

regression) to uncover patterns in the data associated with fraud. RRP also includes 

components of SAS’ High Performing Analytics (e.g., SAS Grid, SAS in-database 

analytics) to develop and deploy models with greater complexity than what could be 

built on a traditional infrastructure. Greater complexity allows RRP models to display 

greater accuracy and robustness. Supervised models produce a score from 0.000 to 

1.000 where a higher score represents a higher likelihood of a return being fraud. 

•		 Greenplum Data Computing Appliance (DCA) – All RRP models are
	

deployed and run directly in the database. Deploying models directly to
	

the database removes the network latency required to move data to a
	

separate application tier server containing the models. Moreover, the
	

Greenplum DCA provides massively parallel processing capabilities
	

across multiple segment servers. In addition to models developed using
	

SAS, RRP also develops models in the form of custom user-defined
	

functions in the Greenplum DCA.
	

a)		 RRP’s network analytics tool – Linked Return Analysis (LRA) – uses 

multiple custom built Greenplum functions to link returns that display 

common, suspicious characteristics. 

b)		 RRP builds “identity theft filters” using Greenplum functions. These 

functions combine the outputs of RRP models, rules and LRA to flag 

suspicious cases of identity theft treatment. 

25 The Generalized Mainline Framework is a service center pipeline processing system that validates and 

perfects data from a variety of input sources. Tax returns, remittances, information returns, and adjustment 

and update transactions in the system are controlled, validated, corrected, and passed on for master file 

posting. 

38
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

•		 FICO Blaze Advisor (FICO BA) – RRP builds and maintains business rules using 

FICO Blaze Advisor. FICO BA provides transparency into the logic that drives 

business decisions. FICO BA houses the logic that drives RRP’s Systemic 

Verification process – the rule logic that matches taxpayer submitted Income 

Documents (IDOCs) to the document submitted by withholding party(ies) (e.g., 

employer submitted W-2s containing income and withholding information). 

CDW provides a state-of-the-art research and technology infrastructure 

to enable a full range of analytical use patterns, including large-scale analysis of 

historical records, distributed parallel computing of data stored across deep 

storage/memory architectures, and in-memory computing of large data 

structures, such as complex graphs. Major components of the CDW ecosystem 

include: 

•		 Traditional data warehousing – centered on SAP IQ, SAP HANA, and SAP Data 

Services to enable SQL-based analytics User-Defined Functions (UDFs). Other 

database technologies include Oracle, SQL Server, PostgreSQL, and MongoDB. 

•		 Analytical tools – Commercially licensed and open source software includes SAS, 

Stata, R, Python, Julia, Tableau, Zeppelin, ArcGIS, ExtendSim, NetLogo, Repast 

HPC, Cytoscape, Solr, ElasticSearch, Tesseract, Tensorflow, and BigSQL for 

machine learning, graph-based analytics, natural language processing, simulation, 

optimization, and advanced visualization. 

•		 High performance computing – Hadoop platform with Spark, SparklyR, PySpark, 

TensorFlow, and other Apache-based tools designed for Hadoop processing. 

•		 Image processing – centered on iPro, Kofax, Adobe, and IBM DataCap for image 

processing and Optical Character Recognition (OCR) services. 

•		 Knowledge management – use of GitLab, MVC Forum, and Wiki to enable code 

management, collaboration, and other information services for analytics. 

(C) A thorough description of the data sources that are being or will be used. 

The IRS-CI applications IDEA and LCA leverage the following data sources. 

•		 Taxpayer: The source is the electronically filed return, as transmitted
	

through Modernized e- File (MeF) or a paper filed tax return.
	

•		 Employers/Payers: Information from employers/payers captured on
	

various forms as stored in the Information Returns Master File (IRMF).
	

•		 Other Treasury sources: BSA data provided by FinCEN,
	

Specially Designated Nationals’ data provided by the Office of
	

Foreign Assets Control, and loan application data provided by
	

the Pandemic Response Accountability Committee (PRAC).
	

•		 Other IRS sources: Tax Exempt Organizations data, Voluntary
	

Disclosures, andCriminal Investigations data.
	

The RRP application leverages the following data sources. 

•		 Taxpayer: The source is the electronically filed return (as transmitted 

39
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

through MeF) or a paper filed tax return. RRP also loads taxpayer data 

contained on the IRS Master File. 

•		 Employers/Payers: Information from employers/payers captured on
	

Form W-2 and/or Form 1099 as stored in the IRMF.
	

•		 Other Federal agencies: Federal Bureau of Prisons for prisoner
	

information; Social Security Administration for National Accounts
	

Profile data for dates of births and deaths.
	

•		 State and local agencies: All states and the District of Columbia
	

prisons deliver prisoner listing information annually to IRS-W&I in
	

electronic format.
	

CDW leverages the following data sources: 

•		 Taxpayer: Tax returns from individuals, businesses, exempt organizations, and other 

taxpayers as transmitted through MeF or as a paper filed tax return. 

•		 Employers/Payers: Information from employers/payers captured on various forms as 

stored in the IRMF. 

•		 Other Federal agencies. Social Security Administration for birth/death data, 

Department of Justice for sealed documents, Department of Transportation for exciserelated information, Department of Treasury (Financial Crimes Enforcement 

Network) for Bank Secrecy Act data (Both Title 26 and Title 31 data). 

•		 Other IRS sources: Tax Treaty organizations, Voluntary Disclosures, case
	

management systems for examination, collection, and under reporter data.
	

(D) An assessment of the efficacy or likely efficacy of the data mining activity 

in providing accurate information consistent with, and valuable to, the 

stated goals and plans for the use or development of the data mining 

activity. 

The data uncovered during the query searches are only leads and require 

additional investigative steps for quality verification. There is no empirical data 

on the efficacy of searches by the IDEA and LCA applications. 

The success of RRP can be measured in terms of identity theft detection 

and ability to identify returns ready for non-identity theft compliance referral 

treatment. Two key metrics are used to assess RRP’s effectiveness: lead 

generation (i.e., identification of potential fraud for the business to review) and 

lead accuracy rate (i.e., projected percentage of RRP selections which turned out 

to be real fraud). 

In processing year (PY) 2021 (through October 6, 2021), RRP selected 

2,391,173 identity theft leads with a projected lead accuracy of 33 percent. In 

addition to identity theft detections, RRP includes models, rules, and filters to 

identify returns ready for non-identity theft compliance. In PY 2021, RRP 

selected 837,484 (through October 6, 2021) for non-identity theft for referral 

treatment with a 36% lead accuracy rate, amounting to 4% improvement year 

over year. RRP has the capability to reprocess, and screen returns when the IRS 

receives taxpayer authentication or new/updated third party data (e.g., employer 

40
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

submitted W-2s) to align with PATH act and ensure selected returns are 

adequately reviewed before refunds are released. 

The efficacy of the FinCEN Query system is discussed in Section (D) of 

that report. 

For CDW, the results produced from data analysis represent insights or 

potential leads and require additional investigative steps for quality verification. 

There is no empirical data on the efficacy of searches by these applications. 

(E) An assessment of the impact, or likely impact, of the implementation of 

the data mining activity on the privacy and civil liberties of individuals, 

including a thorough description of the actions that are or will be taken 

with regard to the property, privacy, or other rights or privileges of any 

individual or individuals as a result of implementing the data mining 

activity. 

Once evidence of fraud is discovered, laws and administrative procedures, 

policies, and controls govern the ensuing actions. IDEA, LCA, and CDW 

applications use personally identifiable information (PII), where needed, for 

record matching and analysis in data-driven investigations. CI and RAAS follow 

the IRS security and privacy IRM standards and regulations for the use and 

protection of PII. 

The impact or likely impact of RRP data mining activities on privacy 

and civil liberties of individuals is governed by 26 U.S.C. § 6103, which 

provides general rules of maintaining confidentiality and permissible 

disclosures. Under this statute, all taxpayer data are private and confidential and 

protected from disclosure except under specific conditions. Additional laws 

provide for civil and criminal penalties for any unauthorized disclosure of 

taxpayer data. The penalties include (1) felony for the willful unauthorized 

disclosure of tax information, (2) misdemeanor for the unauthorized inspection 

of tax information, and (3) civil cause of action for the taxpayer whose 

information has been inspected or disclosed in a manner not authorized by 

Section 6103. The CI special agents receive periodic training on maximum 

sentencing and penalties for each criminal violation. Access to the system 

requires a background check. IRS has a system, Online 5081, that governs 

program access authorization. 

RRP data mining activities, including machine learning, and scoring 

processes, do not directly use PII in determining whether a return is likely to be 

fraudulent. Scoring occurs on the characteristics of the return in question, not on 

PII. When performing investigative techniques, PII associated with the return is 

pulled to assist in validating the return was filed using the taxpayer account in 

question and to determine venue of the investigation. 

The tax returns that IRS-CI reviews are the subjects of criminal 

investigations and actions based on tax laws, policies, and criminal procedures. 

Other tax returns are subjected to IRS civil treatments and examination 

41
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

procedures that provide for due process and redress procedures through taxpayer 

notification, appeals, and tax court options. 

(F) A list and analysis of the laws and regulations that govern the 

information being collected, reviewed, gathered, analyzed, or used in 

the data mining activity. 

The use of all tax data is governed by 26 U.S.C. § 6103. Subsection (a) 

sets out the general rule of confidentiality. Subsection (b) sets forth definitions 

of terms commonly used throughout Section 6103. Subsections (c) through (o) 

of Section 6103 contain exceptions to the general rule of confidentiality. These 

subsections permit disclosures as described generally below: 

•		 Section 6103(c) – Disclosures to taxpayer’s designees (consent); 

•		 Section 6103(d) – Disclosures to state tax officials and certain state and local law
	

enforcement agencies;
	

•		 Section 6103(e) – Disclosures to the taxpayer and persons having a material interest; 

•		 Section 6103(f) – Disclosures to certain committees of Congress; 

•		 Section 6103(g) – Disclosures to the President and certain other persons; 

•		 Section 6103(h) – Disclosures to Federal employees and the courts for tax
	

administration purposes;
	

•		 Section 6103(i) – Disclosures to Federal employees for non-tax criminal law
	

enforcement purposes and to combat terrorism, as well as the Government
	

Accountability Office;
	

•		 Section 6103(j) – Disclosures for statistical purposes; 

•		 Section 6103(k) – Disclosures for certain miscellaneous tax administration purposes; 

•		 Section 6103(l) – Disclosures for purposes other than tax administration; 

•		 Section 6103(m) – Disclosures of taxpayer identity information (generally for Federal 

debt collection purposes); 

•		 Section 6103(n) – Disclosures to contractors for tax administration purposes; and 

•		 Section 6103(o) – Disclosures with respect to certain taxes. 

In addition to disclosures permitted under the provisions of Section 

6103, other provisions of the Code also authorize disclosure of tax information. 

For example, Section 6104 authorizes disclosure of certain tax information 

regarding tax-exempt organizations, trusts claiming charitable deductions, and 

qualified pension plans. Section 6110 authorizes disclosure of certain written 

determinations and their background files. 

Note: The use of Bank Secrecy Act data is governed by 31 U.S.C. §5319. 

(G) A thorough discussion of the policies, procedures, and guidelines that 

are in place or that are to be developed and applied in the use of such 

data mining activity in order to: 

(i)		protect the privacy and due process rights of individuals, such as redress 

procedures. 

42
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

All tax information is protected as required in 26 U.S.C. § 6103 (see E 

and F above). All employees who interact with tax return and other protected 

information are required to undergo yearly refresher training that details their 

responsibilities with respect to information protection and disclosure. In 

addition to covering 26 U.S.C. § 6103 disclosure provisions, this training 

module also includes information on the Privacy Act, E-Government Act, 

Freedom of Information Act, and policies related to protecting PII and other 

sensitive information. The use of BSA information is strictly controlled under 

the statute that directs its collection. 

The data resulting from queries or statistical analysis in IDEA, LCA, and 

CDW are used as a lead or as insights for actionable decisions and requires 

additional investigative steps to verify the quality of the information, as 

discussed above. IRS maintains an audit trail on all users’ access to case data. 

In addition, a full system log is maintained for any system level activities, 

including new data loads to IDEA, LCA, and CDW systems. 

RRP does not determine whether a return is fraudulent or whether a 

person is going to be subject to criminal prosecution. Once fraud is suspected, 

laws and administrative procedures, policies, and controls govern criminal 

investigations or any other ensuing actions. Due process is provided during any 

ensuing criminal investigation or civil action. 

(ii) ensure that only accurate and complete information is 

collected, reviewed, analyzed, or used and guard against any 

harmful consequences of potential inaccuracies. 

An individual/entity self-reports tax data when submitting the 

information to the government. FinCEN’s data are gathered from information 

compiled by the reporter based on information provided by their customer or 

based on the reporter’s personal experience. Investigators scrutinize the 

Suspicious Activity Reports filed by the subject companies and request grand 

jury subpoenas for the underlying documentation. The supporting records are 

examined, and individuals of interest are identified. 

IDEA, LCA, and CDW use data for investigative or research purposes 

under the IRS Internal Revenue Manual (IRM) standards and guideline. The 

data resulting from query searches is used as a lead or as insights for actionable 

decisions and requires additional investigative steps to verify the quality of the 

information. CI and RAAS use this data for generating leads and other datadriven insights that are subsequently verified by special agents or research 

analysts for further investigative or analytical work. 

CDW implements a standard set of rules during the extract, 

transformation, and load (ETL) process to ensure that data collected from 

authoritative systems is accurately replicated for research purposes. These 

include, but are not limited to, ensuring accurate row counts, identifying 

duplicate rows, applying consistent data types and database indexes, and 

standardizing common geographic attributes across database tables. 

43
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The tax return information and other information stored in RRP used for 

data mining are based on outside data sources. The only data generated in RRP 

is for system monitoring and diagnostics. Through a series of test case 

procedures executed through application qualification testing (AQT), systems 

acceptability testing (SAT), and final integration test (FIT), the IRS verifies that 

the data loaded into RRP matches the data from the input source and that the 

system accurately displays the data in the RRP end user applications. AQT, 

SAT, and FIT perform verification with each release of the system. IRS 

applications are required to have internal auditing capabilities. The internal 

audits track user access and queries performed with checks against misuse. 

Combined Reports Conclusion 

The Department of the Treasury is pleased to provide to Congress its 

Annual Privacy, Section 803 Report, and Data Mining Report, for Fiscal Year 

2021. Treasury, Office of Privacy, Transparency, and Records has reviewed the 

activities and programs described in this combined report and will continue to 

work closely with all Treasury bureaus and offices to protect individual privacy 

and civil liberties in all agency activities. 

Trevor Norris 

Acting Assistant Secretary for Management 

U.S. Department of the Treasury 

44
	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Appendix A: Department of the Treasury Semiannual Report on Privacy and Civil
	

Liberties Activities under Section 803 of the 9/11 Commission Act of 2007 April 1,
	

2021 through September 30, 2021
	

Reviews Advice and Response Complaints 

Type Number Type Number 

Response 

(Pending/ 

Accepted/ 

in 

Process) 

Type of claim or 

assertion in 

complaint 

# of complaints Disposition 

Privacy (and 

Civil Liberties) 

Threshold 

Analyses 

(PTAs/PCLTAs) 

33 

Provide advice and 

recommendation 

regarding proper 

handling of PII/limiting 

access based on need to 

know 

11 

Accepted: 

BEP (10) 

Advice In 

Process: 

MINT (1) 

Vaccination 

mandate 

reasonable 

accommodati 

on. 

Privacy (and 

Civil Liberties) 

Impact 

Assessments 

(PIAs/PCLIAs) 

81 

Provide advice and 

recommendation on 

relevance and necessity 

of data 

collection/ingestion 

2 

Accepted: 

BEP (1); 

MINT (1) 

PRIVACY: 

(Other 

Describe) 

1 

System of 

Records (SOR) 

Routine Use/ 

SOR Notices 

(SORNs) 

4 

Provided guidance to 

system owners or 

personnel on necessary 

privacy compliance 

documentation or 

appropriate NIST risk 

rating 

7 

In Process: 

BEP (7) 

PRIVACY: 

(Other 

Describe) 

0 

Computer 

Matching 

Agreements 

(CMAs) 

63 

Provide advice and 

recommendation on 

internal/external sharing 

of PII (including 

Privacy Act info) 

8 In Process: 

BEP (4) 

MINT (4) 

CIVIL LIBERTIES: 

Violation 1 st 

, 4 

th 

, 5 

th 

, 

6 

th 

, 14 th and/or 16 th 

Amendment rights 

(# of 

complaints/amendme 

nts alleged to have 

been violated) 

52 

PRIVACY: 

Unauthorized 

disclosure 

(internal/ 

external) 

0 

IRS: ID Theft 

complaint received 

9/29; Transferred 

to IRS ID Theft 

Office 

BEP (1): Open 

IRS (51): 33 

Pending final 

decision; 18 

resolved in favor 

of government 

0 

Section 508 

Internet Website 

Scan 

MINT (Internet): 

96% 

MINT (Intranet): 

41% 

Provide advice and 

recommendation on 

web privacy 

policies/privacy 

notices 

1 

In Process:
	

MINT (1)
	

CIVIL 

LIBERTIES: 

(Other: 

Describe) 

45