Department of the Treasury 

2020 Consolidated Privacy and Civil Liberties Reports 
2

Message from the Deputy Assistant Secretary for Privacy, Transparency, and Records 

On behalf of the Senior Agency Official for Privacy and Chief Privacy 

and Civil Liberties Officer, I am pleased to present the Department of the 

Treasury’s 2020 Consolidated Privacy and Civil Liberties Reports. 

• Annual Privacy Report required by Section 522(a) of the 

Consolidated Appropriations Act of 2005; 

• Semiannual Privacy and Civil Liberties Report required by Section 

803 of the Implementing Recommendations of the 9/11 Commission 

Act of 2007; and 

• Annual Data Mining Report required by the Federal Agency Data 

Mining Reporting Act of 2007. 

The Department of the Treasury is committed to safeguarding and ensuring privacy compliance 

through integrated technology, policy, and high quality standards. As a collector of data on millions 

of individuals and companies, the Department strives to be a leader in privacy best practices and 

privacy policy. 

Inquiries about these reports may be directed to privacy@treasury.gov. These reports, as well as 

previous reports, can be found on the Department’s Privacy Act website. 

Ryan Law 

Deputy Assistant Secretary 

 Office of Privacy, Transparency, and Records 

 U.S. Department of the Treasury 
3

2020 Consolidated Privacy and Civil Liberties Reports 

Table of Contents 

Message from the Deputy Assistant Secretary for Privacy, Transparency, and Records ........................ ....2

Statutory Requirements ........................................................................................................................... 5

The Reporting Periods............................................................................................................................. 5

The Consolidated Appropriations Act of 2005 Annual Privacy Report ................................................. 5

The Implementing Recommendations of the 9/11 Commission Act of 2007. ........................................ 5

The Data Mining Reporting Act of 2007 Annual Report ........................................................................ 6

SECTION ONE: DEPARTMENT OF THE TREASURY CONSOLIDATED APPROPRIATIONS ACT

OF 2005 ANNUAL PRIVACY REPORT ....................................................................................................... 8

Complaints of Privacy Violations ........................................................................................................... 8

System of Records Notices (SORNs) ...................................................................................................... 8

Privacy and Civil Liberties Impact Assessments (PCLIA) ..................................................................... 8

Elimination of the Unnecessary Use of Social Security Numbers .......................................................... 9

Privacy Policies on Treasury Websites ................................................................................................... 9

Treasury Orders and Directives ............................................................................................................... 9

Privacy Awareness and Training: A Culture of Privacy Awareness.....................................................10

Treasury Computer Matching Programs ...............................................................................................10

SECTION 2: DEPARTMENT OF THE TREASURY SECOND SEMIANNUAL 2020 

IMPLEMENTING RECOMMENDATIONS OF THE 9/11 COMMISSION ACT OF 2007 PRIVACY 

AND CIVIL LIBERTIES ACTIVITIES REPORT FOR REPORTING PERIOD APRIL 1, 2020 TO 

SEPTEMBER 30, 2020 .................................................................................................................................. 12

Introduction ......................................................................................................................................................... 12

Privacy and Civil Liberties Reviews Undertaken .................................................................................12

Privacy and Civil Liberties Impact Assessments (PCLIA) .......................................................................... 14

System of Records Notices.....................................................................................................................14

Computer Matching Programs .......................................................................................................................... 15
4

Privacy Compliance Reviews ...............................................................................................................15

Advice and Responses ..........................................................................................................................16

Privacy Complaints and Dispositions ...................................................................................................17

Conclusions ...........................................................................................................................................17

SECTION 3: DEPARTMENT OF THE TREASURY FY 2020 DATA MINING REPORTING ACT OF

2007 ANNUAL REPORT ..............................................................................................................................18

The Role of the Treasury Chief Privacy and Civil Liberties Officer (CPCLO).................................... 18

Definitions ............................................................................................................................................. 18

FINCEN FY 2020 DATA MINING REPORT ..................................................................................... 19

ALCOHOL AND TOBACCO TAX AND TRADE BUREAU (TTB) FY 2020 DATA MINING 

REPORT .................................................................................................................................................. 31 

INTERNAL REVENUE SERVICE (IRS) FY 2020 DATA MINING REPORT ................................... 37

CONCLUSION ....................................................................................................................................... 47

APPENDIX A ..........................................................................................................................................48
5

Statutory Requirements 

In this report, Treasury consolidates the following three reporting requirements 

to reduce duplication and provide Congress and the public with a more comprehensive 

overview of Treasury’s privacy compliance and oversight activities:

(1) The Annual Privacy Report required by Section 522(a) of the Consolidated 

Appropriations Act of 2005; 

(2) The Annual Data Mining Report required by Section 804 of the Federal Agency 

Data Mining Reporting Act of 2007; and 

(3) The second semi-annual Privacy and Civil Liberties Report required by Section 803 

of the Implementing Recommendations of the 9/11 Commission Act of 2007. 

The Reporting Periods 

These reports cover Treasury activities during the 2020 fiscal year (FY20). The 

Annual Privacy Report and the Annual Data Mining Report cover the entire fiscal year 

while the Section 803 report covers the second half of FY 20 (April 1, 2020 to 

September 30, 2020); the first Section 803 report for FY20 is a standalone report and 

will be posted to the Treasury’s Privacy website at 

https://www.treasury.gov/privacy/annual-reports/Pages/default.aspx. 

The Consolidated Appropriations Act of 2005 Annual Privacy Report 

The Annual Privacy Report was prepared in accordance with Section 

522(a) of the Consolidated Appropriations Act of 2005, which includes the 

following requirement: 

Privacy Officer—

Each agency shall have a Chief Privacy Officer to assume primary 

responsibility for privacy and data protection policy, including—

* * * 

(6) preparing a report to Congress on an annual basis on activities of the 

Department that affect privacy, including complaints of privacy 

violations, implementation of section 552a of title 5, 11 United 

States Code, internal controls, and other relevant matters; 

* * * 

The Implementing Recommendations of the 9/11 Commission Act of 2007, 

Semi-Annual Privacy and Civil Liberties Report 

Section 803 of the 9/11 Commission Act sets forth the following requirements: 

(f) Periodic Reports –

(1) In General –

The privacy officers and civil liberties officers of each 

department, agency, or element referred to or described in subsection 
6

(a) or (b) shall periodically, but not less than semiannually; submit a 

report on the activities of such officers—

(A)(i) to the appropriate committees of Congress, including 

the Committee on the Judiciary of the Senate, the Committee on 

the Judiciary of the House of Representatives, the Committee on 

Homeland Security and Governmental Affairs of the Senate, the 

Committee on Oversight and Government Reform of the House 

of Representatives, the Select Committee on Intelligence of the 

Senate, and the Permanent Select Committee on Intelligence of 

the House of Representatives; 

(ii) to the head of such department, agency, or element; and 

(iii) to the Privacy and Civil Liberties Oversight Board. 

(B) which shall be in unclassified form to the greatest 

extent possible, with a classified annex where necessary. 

(2) Contents –

Each report submitted under paragraph (1) shall include 

information on the discharge of each of the functions of the officer 

concerned, including—

(A) information on the number and types of reviews undertaken; 

(B) the type of advice provided and the response given to such advice; 

(C) the number and nature of the complaints received 

by the department, agency, or element concerned for 

alleged violations; and 

(D) a summary of the disposition of such 

complaints, the reviews and inquiries conducted, and the 

impact of the activities of such officer. 

* * * 

The Data Mining Reporting Act of 2007 Annual Report 

The Federal Agency Data Mining Reporting Act of 2007, 42 U.S.C. § 

2000ee-3, includes the following requirement: 

(c) Reports on data mining activities by Federal agencies 

(1) Requirement for report - The head of each department or agency of the 

Federal Government that is engaged in any activity to use or develop 

data mining shall submit a report to Congress on all such activities of 

the department or agency under the jurisdiction of that official. The 

report shall be produced in coordination with the privacy officer of that 

department or agency, if applicable, and shall be made available to the 

public, except for an annex described in subparagraph (C).

(2) Content of report - Each report submitted under subparagraph (A) shall 

include, for each activity to use or develop data mining, the following 

information: 
7

(A) A thorough description of the data mining activity, its goals, and, 

where appropriate, the target dates for the deployment of the data 

mining activity; 

(B) A thorough description of the data mining technology that is being 

used or will be used, including the basis for determining whether a 

particular pattern or anomaly is indicative of terrorist or criminal 

activity; 

(C) A thorough description of the data sources that are being or will be used; 

(D) An assessment of the efficacy or likely efficacy of the data mining 

activity in providing accurate information consistent with and 

valuable to the stated goals and plans for the use or development 

of the data mining activity; 

(E) An assessment of the impact or likely impact of the implementation 

of the data mining activity on the privacy and civil liberties of 

individuals, including a thorough description of the actions that are 

being taken or will be taken with regard to the property, privacy, or 

other rights or privileges of any individual or individuals as a result 

of the implementation of the data mining activity; 

(F) A list and analysis of the laws and regulations that govern the 

information being or to be collected, reviewed, gathered, 

analyzed, or used in conjunction with the data mining activity, to 

the extent applicable in the context of the data mining activity; 

(G) A thorough discussion of the policies, procedures, and guidelines 

that are in place or that are to be developed and applied in the use of 

such data mining activity in order to—

(i) protect the privacy and due process rights of 

individuals, such as redress procedures; and 

(ii) ensure that only accurate and complete information is 

collected, reviewed, gathered, analyzed, or used, and guard 

against any harmful consequences of potential 

inaccuracies. 
8

SECTION ONE: DEPARTMENT OF THE TREASURY 

CONSOLIDATED APPROPRIATIONS ACT OF 2005 ANNUAL 

PRIVACY REPORT 

Complaints of Privacy Violations 

Section 522 of the Consolidated Appropriations Act of 2005 requires 

Treasury to address in its annual report complaints of privacy violations. Section 

803 of the Implementing Recommendations of the 9/11 Commission Act of 

2007 (“9/11 Commission Act”) requires Treasury to address both privacy and 

civil liberties complaints. Therefore, both privacy and civil liberties complaints 

will be addressed in the Section 803 Report in Section 2 of these consolidated 

reports. 

Implementation of the Privacy Act, 5 U.S.C., Section 552a. 

System of Records Notices 

A system of records is a grouping of paper or electronic records 

maintained by a federal agency from which information about an individual is 

retrieved by the name of the individual or another unique identifier assigned 

to the individual (e.g., Social Security number). Pursuant to 5 U.S.C. § 

552a(e)(4), agencies are required to publish a systems of records notice 

(SORN) in the Federal Register for each system of records. Treasury has 

published regulations describing how it collects, maintains, and discloses 

records about individuals that are maintained in a system of records. These 

regulations provide procedures by which individuals may request access to 

their information maintained by Treasury.1

A list of the Department’s SORNs is available on Treasury’sPrivacy 

Act website, at 

https://www.treasury.gov/privacy/issuances/Pages/default.aspx

Internal Controls 

Privacy and Civil Liberties Impact Assessments 

A Privacy and Civil Liberties Impact Assessment (PCLIA) is an 

analysis of how information is handled in compliance with legal, regulatory, 

and policy privacy requirements. This includes an analysis to ensure 

compliance with Privacy Act requirements. It allows the assessment of the risks 

associated with collecting, maintaining, and disseminating information and 

discusses the mitigation strategies used to address those risks. Section 208 of 

the E-Government Act of 2002 (E-Gov Act) requires agencies to conduct 

 

1 See 31 C.F.R. §§ 1.20-1.36 
9

PCLIAs for electronic information systems and collections that involve the 

collection, maintenance, or dissemination of information in identifiable form 

from or about members of the public. Links to the Treasury’s PCLIAs are 

available on Treasury’s website, at 

https://www.treasury.gov/privacy/PIAs/Pages/default.aspx

Elimination of the Unnecessary Use of Social Security Numbers 

The Social Security Number Fraud Prevention Act of 2017 requires 

Treasury to file an annual report for five years identifying all mailings that 

include the full Social Security Number (SSN). Treasury is required to update 

Congress annually on its progress in eliminating the mailing of full SSNs. 

Treasury recently submitted its 2019 report to Congress. For more information 

on Treasury’s usage of the SSN, please refer to pages 13-14, in Section 6 of 

this report. 

Privacy Policies on Treasury Websites 

Treasury maintains online privacy policies to provide notice to Treasury 

website visitors describing how Treasury collects, uses, shares, and disposes of 

information it collects on its websites. This includes providing notice about 

how certain information collected is handled in compliance with the Privacy 

Act. Treasury bureaus and Treasury’s Inspectors General maintain their own 

online privacy policies to address the unique information they collect on their 

websites. Links to Treasury bureau and office policies may be found on 

Treasury’s webpage at https://home.treasury.gov/subfooter/privacy-policy

Treasury Orders and Directives 

Treasury Orders (TO) and Treasury Directives (TD) serve as the 

controls by which Treasury ensures that appropriate stakeholders are involved 

in privacy and civil liberties policy development and implementation. 

Treasury Orders are documents signed by the Secretary or Deputy Secretary that: 

• delegate authority from the Secretary or Deputy Secretary to other 

senior Treasury officials; 

• define the organization of the Department and the reporting 

relationships among the most senior officials; and/or 

• establish Treasury policy. 

Treasury Orders relevant to this report are: 

Treasury Orders 

TO-102-25, Delegation of Authority Concerning Privacy and Civil Liberties
10

Treasury Directives and Publications are documents signed by the appropriate senior 

Treasury officials that: 

• further delegate authority from the most senior officials to other 

Treasury officials; and/or 

• provide processes for implementing legal obligations and Departmental policy 

objectives. 

Treasury Directives and Publications relevant to this report are: 

Treasury Directives and Publications 

TD 25-04, The Privacy Act of 1974, as Amended

TDP, 25-04, The Privacy Act Handbook

TD 25-06, Treasury Data Integrity Board

TD 25-07, Privacy Impact Assessments

TD 25-08, Safeguarding Against and Responding to the Breach of PII

TD 25-09, Privacy and Civil Liberties Activities Pursuant to Section 803 of the 

Implementing Recommendations of the 9/11 Commission Act of 2007, P.L. 110-53

TD 25-10, Information Sharing Environment Privacy and Civil Liberties Policy

Privacy Awareness and Training: A Culture of Privacy Awareness 

Subsection (e)(9) of the Privacy Act requires that agencies provide 

instruction to persons involved in the design, development, operation, or 

maintenance of systems of records. All Treasury employees are required to 

take the annual privacy training which includes information regarding the 

potential criminal penalties and civil liability for employees who do not 

comply with Privacy Act requirements. In FY20, 97% of all Treasury 

employees successfully completed this training. 

Treasury Computer Matching Programs 

Pursuant to the Computer Matching and Privacy Protection Act of 

1988,

2 Treasury maintains a Data Integrity Board (DIB) to oversee its computer 

matching programs. Computer matching programs provide a direct benefit to 

the public by assisting in the elimination of errors and in monitoring fraud, 

waste, and abuse. Matching agreements expire 18 months after execution unless 

renewed for an additional 12-month period. After a renewal period expires, an 

 

2 Pub. L. No. 100-503. 
11

agreement may be re-established for an additional 18 months. For 2020 data on 

Treasury’s computer matching agreements, please refer to page 13. Treasury’s

computer matching agreements can be found at: 

https://www.treasury.gov/privacy/Computer-Matching 

Programs/Pages/default.aspx
12

SECTION 2: DEPARTMENT OF THE TREASURY SEMIANNUAL 

2020 REPORTING ON PRIVACY AND CIVIL LIBERTIES 

ACTIVITIES PURSUANT TO SECTION 803 OF THE 

IMPLEMENTING RECOMMENDATIONS OF THE 9/11 

COMMISSION ACT OF 2007 FOR REPORTING PERIOD APRIL 1, 

2020 TO SEPTEMBER 30, 2020 

1. Introduction 

The Assistant Secretary for Management (ASM) is the 

Department of the Treasury’s (Treasury) Privacy and Civil Liberties 

Officer (PCLO). As the PCLO, the ASM is responsible for implementing 

the 9/11 Commission Act of 2007’s privacy and civil liberties 

requirements. 

To assist the ASM with these responsibilities, TD 25-04, “The 

Privacy Act of 1974, as amended,” designates the Deputy Assistant 

Secretary for Privacy, Transparency, and Records (DASPTR) as the 

ASM’s principal advisor on issues related to privacy and civil liberties. 

The DASPTR leads the Office of Privacy, Transparency, and Records 

(OPTR) and provides the ASM with day-to-day support in executing his 

PCLO duties. 

Section 803 of the 9/11 Commission Act, 42 U.S.C. § 2000ee-1, 

sets forth the following requirements: 

(f) Periodic Reports –

(1) In General –

The privacy officers and civil liberties 

officers of each department, agency, or 

element referred to or described in subsection 

(a) or (b) shall periodically, but not less than 

semiannually; submit a report on the activities 

of such officers—

(A)(i) to the appropriate committees of 

Congress, including the Committee on the 

Judiciary of the Senate, the Committee on 

the Judiciary of the House of 

Representatives, the Committee on 

Homeland Security and Governmental 

Affairs of the Senate, the Committee on 

Oversight and Government Reform of the 

House of Representatives, the Select 

Committee on Intelligence of the Senate, 

and the Permanent Select Committee on 
13

Intelligence of the House of 

Representatives; 

(ii) to the head of such department, agency, or 

element; and to the Privacy and Civil Liberties 

Oversight Board; and 

(B) which shall be in unclassified 

form to the greatest extent possible, 

with a classified annex where 

necessary. 

(2) Contents –

Each report submitted under paragraph 

(1) shall include information on the 

discharge of each of the functions of the 

officer concerned, including—

a) information on the number and types of reviews undertaken; 

b) the type of advice provided and the response given to such advice; 

c) the number and nature of the complaints 

received by the department, agency, or 

element concerned for alleged violations; 

and 

d) a summary of the disposition of such 

complaints, the reviews and inquiries 

conducted, and the impact of the activities 

of such officer. 

The Intelligence Authorization Act for Fiscal Year 2014, 

Pub. L. No. 113-126 (July 7, 2014), changed the reporting period 

from quarterly to semiannually. The semiannual reports cover the 

following time periods: April – September and October – March.3

2. Privacy and Civil Liberties Reviews Undertaken 

Treasury reviews programs and information technology 

(IT) systems that may present privacy risks. Privacy and civil 

liberties reviews include the following Treasury activities: 

a) Privacy and Civil Liberties Threshold Assessments are the 

Treasury mechanism for reviewing IT systems, programs, and 

other activities to determine whether the program is meeting 

information compliance requirements (civil liberties, privacy, 

records management, Section 508 compliance under the 

Rehabilitation Act of 1973, and Paperwork Reduction Act of 

1995), and to determine whether a more comprehensive Privacy 

 
14

and Civil Liberties Impact Assessment (PCLIA) is required; 

b) PCLIAs as required by the E-Government Act of 2002;4

c) System of Records Notices, and any associated Final Rules 

for Privacy Act exemptions, as required by the Privacy 

Act;4

d) Privacy Act Statements, ,5to provide notice to 

individuals at the point of collection, as required under 

the Privacy Act; 

e) Computer Matching Agreements, as required by the Computer Matching Privacy 

Protection Act;6

f) Data Mining Reports, as required by Section 804 of the 

9/11 Commission Act of 2007;7

g) Privacy Compliance Reviews; 

h) Privacy reviews of IT and program budget requests, including 

Office of Management and Budget Exhibit 300s; and 

i) Other privacy reviews, such as implementation 

reviews for information sharing agreements. 

3. Privacy and Civil Liberties Impact Assessments 

The Privacy and Civil Liberties Impact Assessments (PCLIA) 

process is one of Treasury’s key mechanisms to ensure that programs 

and technologies sustain, and do not erode, privacy protections. 

During FY20, Treasury published 15 new, updated, or renewed 

PCLIAs. All published Treasury PCLIAs are available on Treasury’s 

privacy website at: 

http://www.treasury.gov/privacy/PIAs/Pages/default.aspx.

4. System of Records Notices 

During the reporting period, Treasury published and updated 

3 SORNs. All Treasury SORNs, Notices of Proposed Rulemaking, 

and Final Rules for Privacy Act Exemptions are available on 

Treasury’s privacy website at: 

http://www.treasury.gov/privacy/issuances/Pages/default.aspx.

Treasury has determined that the information contained in its systems 

of records is accurate, timely, relevant, complete, and necessary to 

maintain the proper performance of documented agency functions. 

Please consult our website or the Federal Register for the full text of 

Treasury SORNs. 

 

4 5 U.S.C. § 552a(j), (k). See also Office of Management and Budget (OMB) Circular No. A-108, “Federal 

Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act,” 81 FR 94424 

(Dec. 23, 2016). 

5 5 U.S.C. § 552a(e)(3) 

6 5 U.S.C. § 552a(o)-(u) 

7 42 U.S.C. § 2000ee-3. 
15

5. Computer Matching Programs 

The computer matching provisions of the Privacy Act improve 

oversight and protect the due process rights of individuals whose Privacy 

Act records are shared in inter-agency information sharing arrangements 

known as “matching programs.” Treasury participates in 13 active 

computer matching programs in accordance with the requirements of the 

Privacy Act of 1974, as amended by the Computer Matching and 

Privacy Protection Act (CMPPA). To comply with the Act, as well as all 

relevant regulations and guidance, Treasury established a Data Integrity 

Board to review and approve Treasury matching agreements. All Treasury 

Computer Matching Agreements are available on Treasury’s privacy 

website at: https://www.treasury.gov/privacy/Computer-MatchingPrograms/Pages/default.aspx.

During the reporting period, the Data Integrity Board 

reviewed and approved a total of 61 12-month agreements (58 Reestablishments, 1 Renewal and 2 Federal Register Notices (FRN)). 

No CMAs were denied or had a lapse. 

6. Privacy Compliance Reviews 

Treasury conducts Privacy Compliance Reviews (PCR) to ensure 

that programs and technologies implement and maintain appropriate 

protections for personally identifiable information (PII). A PCR is a 

collaborative effort that helps improve a program’s ability to comply with 

existing privacy requirements by identifying and remediating gaps in 

compliance documentation, including PCLIAs, SORNs, and formal 

agreements, such as memoranda of understanding and memoranda of 

agreement. It also includes informal, ad hoc, situational advice sought by 

Treasury bureaus and offices on privacy and civil liberties issues. 

Treasury’s current PCR effort is analyzing departmental mailing of 

forms, letters, and other documents containing the Social Security Number 

(SSN). This analysis is required by the SSN Fraud Prevention Act of 2017. 

Treasury remains focused on eliminating the use of SSNs whenever possible 

and safeguarding SSNs that must be collected and maintained because no 

reasonable alternative to using the SSN exists. During the reporting period, 

Treasury continued its Department-wide review of the mailing of full SSNs. 

This exercise allowed Treasury to update its list of appropriate uses of the 

SSN and identify SSN uses that can be eliminated. Many Treasury systems 

remain unable to redact or truncate (shorten) SSNs in outgoing mail due to 

aging systems and budgetary limitations. During the next reporting period, 

Treasury will continue its analysis and update its progress as required by the 

SSN Fraud Prevention Act. 

7. Advice and Responses 
16

Treasury provides privacy advice to its bureaus and offices 

throughout the year. Examples of guidance are included below: 

a. The Departmental Offices provided the following 

advice and recommendations in compliance with the 

Privacy Act of 1974, 5 U.S.C. § 552a, and the 

operational and privacy-specific safeguards outlined 

in the NIST SP 800-122, Guide to Protecting the 

Confidentiality of Personally Identifiable Information 

(PII): 

• Worked with a Treasury program office that 

was contemplating expanding its creative 

cloud for enterprise presence. Notified the 

program of the privacy and other information 

management compliance requirements. The 

program accepted the advice and is 

completing a PCLIA to cover this activity. 

• Worked with a Treasury office to develop 

appropriate notice to members of the public 

to inform them that they were required to use 

a third-party website to verify their identity 

before they could access a Treasury IT 

environment to submit documentation 

required by law. The program office adopted 

the proposed notice. 

• Contact Recording (CR) - The Contact 

Recording platform records the spoken 

conversation between the taxpayer and Call 

Center agent. These recordings are used to 

perform quality reviews to improve the 

taxpayers' interaction experiences with 

Internal Revenue Service (IRS) Call Center 

agents. IRS Privacy Compliance & Review 

(PCR) worked closely with the business unit 

to address the accuracy and completeness of 

the Privacy & Civil Liberties Impact 

Assessment (PCLIA). After discussions with 

the business unit, the PII element biometric 

identifier was selected and described within 

the PCLIA.IRS PCR worked with an IRS 

business unit to address the accuracy and 

completeness of PCLIA. After an initial 

review of the PCLIA, IRS PCR identified 

several items that needed correction 

including: 
17

•Additional types of sensitive but 

unclassified information 

• Personally Identifiable 

Information (PII) that is 

disseminated 

Because of the IRS PCR recommendations, 

changes were made to the PCLIA.

8. Privacy Complaints and Dispositions 

For purposes of Section 803 reporting, complaints are written 

allegations of harm or violation of privacy and civil liberties compliance 

requirements filed with Treasury’s privacy and civil liberties programs (or 

the Office of General Counsel). The categories of complaints reflected in 

Appendix A are aligned with the categories detailed in the OMB 

Memorandum 08-21, FY 2008 Reporting Instructions for the Federal 

Information Security Management Act and Agency Privacy Management. 

U.S. citizens, lawful permanent residents, visitors, and aliens may submit 

complaints. 

9. Conclusions 

As required by the 9/11 Commission Act, and in accordance with the Intelligence 

Authorization Act for Fiscal Year 2014, Pub. L. No. 113-126 (July 7, 2014), this annual report 

summarizes Treasury’s privacy activities from April 1, 2020 through September 30, 2020. 

Treasury will continue to work with the Congress, colleagues in other federal departments and 

agencies, and the public to protect privacy in all its efforts. 
18

SECTION 3: DEPARTMENT OF THE TREASURY FY2020 DATA MINING 

REPORTING ACT OF 2007 ANNUAL REPORT 

The Role of the Treasury Chief Privacy and Civil Liberties Officer (CPCLO) 

The Department of the Treasury (Treasury or the Department) is 

providing this report to Congress pursuant to Section 803 of the Implementing 

Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act), 

entitled the Federal Agency Data Mining Reporting Act of 2007 (Data Mining 

Reporting Act or the Act). This report discusses activities currently deployed or 

under development in the Department that meet the Data Mining Reporting Act’s 

definition of data mining. The report also provides the information the Act 

requires with respect to each data mining activity. 

Definitions 

(1) DATA MINING. The term “data mining” means a program 

involving pattern-based queries, searches, or other 

analyses of one or more electronic databases, where: 

a. a department or agency of the Federal Government, 

or a non-Federal entity acting on behalf of the 

Federal Government, is conducting the queries, 

searches, or other analyses to discover or locate a 

predictive pattern or anomaly indicative of 

terrorist or criminal activity on the part of any 

individual or individuals; 

b. the queries, searches, or other analyses are not 

subject-based and do not use personal identifiers 

of a specific individual, or inputs associated with 

a specific individual or group of individuals, to 

retrieve information from the database or 

databases; and 

c. the purpose of the queries, searches, or other analyses is not solely—

i. the detection of fraud, waste, or abuse 

in a Government agency or program; 

or

ii. the security of a Government computer system. 

(2) DATABASE. The term “database” does not include 

telephone directories, news reporting, information that is

publicly available to any member of the public without 

payment of a fee, or databases of judicial and 

administrative opinions or other legal research sources.8

 

8

42 U.S.C § 2000ee-3(b)(1). “[T]elephone directories, news reporting, 
19

Three Treasury bureaus maintain systems using applications that meet the 

definition of data mining: the Financial Crimes Enforcement Network (FinCEN), 

the Internal Revenue Service (IRS), and the Alcohol and Tobacco Tax and Trade 

Bureau (TTB). These systems were discussed in previous Treasury data mining 

reports and can be found on Treasury’s privacy website at 

https://www.treasury.gov/privacy/annual- reports/Pages/default.aspx . 

FINCEN’s FY 2020 DATA MINING REPORT 

The Federal Agency Data Mining Reporting Act of 2007 requires the 

head of each Department or agency of the Federal Government that is engaged 

in any activity that uses or develops data mining to submit a report to Congress 

on all pattern-based data mining activities. Each report must include the 

following information for each activity where data mining is in use or in 

development: 

(A) A thorough description of the data mining activity, its goals, and, 

where appropriate, the target dates for the deployment of the data 

mining activity. 

The Financial Crimes Enforcement Network’s (FinCEN) mission is to 

safeguard the financial system from illicit use, combat money laundering, and 

promote national security through financial authorities’ strategic use and the 

collection, analysis, and dissemination of financial intelligence. To accomplish 

its mission, FinCEN provides financial intelligence, data stewardship, and 

support for law enforcement, the intelligence community, and our foreign 

financial intelligence unit (FIU) partners. FinCEN also engages in the detection 

of trends and typologies of money laundering and terrorist financing. 

In furtherance of this goal, as set forth in 31 U.S.C. § 310, FinCEN is 

required to maintain a government-wide data access service with a range of 

financial transaction information; to conduct analysis and dissemination of 

information in support of law enforcement at the federal, state, local, and 

international levels; to identify emerging trends and methods in money 

laundering and other financial crimes; to serve as the FIU of the United States to 

carry out other delegated regulatory responsibilities. FinCEN works to achieve 

its mission while avoiding collecting and indexing information on persons 

exercising their constitutional rights and civil liberties. 

FinCEN’s analysts use various data analysis techniques for generating 

leads on subjects or institutions whose activities warrant outreach, investigation, 

or other statutorily mandated activities. 

 

information publicly available to any member of the public without payment of 

a fee, or databases of judicial and administrative opinions or other legal research 

sources” are not “databases” under the Act. § 2000ee- 3(b) 
20

FinCEN has successfully developed algorithms to identify transactions 

associated with multiple types of illicit financial activity, including money 

laundering, terrorist financing, and cybercrime. FinCEN also uses algorithms to 

examine filing patterns across financial sectors. This analysis supports a broad 

range of objectives, identifying trends and patterns of illicit financial activity to 

the detection of institutions that may require additional regulatory oversight. 

FinCEN continues to develop and expand the use of automated business 

rules to surface high-value reports of illicit financial activity. The term “business 

rule” refers to automated queries or algorithms designed to screen incoming 

Bank Secrecy Act (BSA) filings against established criteria to identify high 

priority filings likely to require further review or analysis. FinCEN reviewed 

rule findings internally and distributed them to external stakeholders, such as 

domestic law enforcement and foreign FIU partners. FinCEN’s business rules 

play a vital role in identifying and disseminating timely financial intelligence to 

combat threats such as terrorist financing, money laundering, cyber threats, and 

other illicit financial activity. 

(B) A thorough description of the data mining technology that is being used 

or will be used, including the basis for determining whether a particular 

pattern or anomaly is indicative of terrorist or criminal activity. 

FinCEN leverages two principal methods for deriving information 

relevant to illicit financial activity from the BSA data. The first is contentdriven, searching for specific subject names, or term combinations used in 

reporting associated with various types of illicit financial activity. The 

second method is pattern-driven and can take various forms. FinCEN may 

derive patterns from searches for a subject in the data. FinCEN then 

identifies subjects that fit that same pattern and have certain filing profiles. 

Matching filing patterns across different types of BSA reports highlights 

anomalous behavior that leads to the identifying subjects for potential 

investigation. 

For content-driven data analysis, FinCEN staff use a web-based 

application called FinCEN Query. The application provides analysts with 

the capability to search for specific entity names and term combinations 

across all FinCEN’s records. For pattern-driven analysis, staff use 

commercial off-the-shelf (COTS), open-source, and custom developed 

tools with capabilities including statistical, social network, geospatial 

analysis, data modelling, visualization, and text analytics that aid in the 

analysis of BSA data. These tools enable analysts to deconstruct, 

manipulate, and flexibly analyze large volumes of data in order to discover 

underlying patterns of behavior involving potential illicit entities or 

networks. 

(C) A thorough description of the data sources that are being or will be used. 

The data that is collected under FinCEN’s BSA authorities (“BSA data”) 

form the underlying data for FinCEN’s manual and automated search methods 
21

and trend analysis activities. 

To accomplish its mission and give context to the data FinCEN extracts 

from its BSA database, FinCEN also considers other information available to it 

through various sources, including open source material, law enforcement 

information, other government information, and information obtained through 

subscription services. FinCEN uses this information to support or amplify 

conclusions or hypotheses derived from the analysis of BSA data. For example, 

commercially available databases are used to support or further identify 

information and to aid in the identification of potential illicit activity based on 

suspicious trends, patterns, or methods. FinCEN’s trend analysis may also use 

public source information, commercial database information, and third-party data 

sources, such as Census Bureau, Social Security Administration,9and Office of 

Foreign Assets Control data. 

(D)An assessment of the efficacy or likely efficacy of the data mining activity 

in providing accurate information consistent with and valuable to the 

stated goals and plans for the use or development of the data mining 

activity. 

FinCEN provides strategic and tactical products for several audiences: 

law enforcement, foreign FIU partners, financial regulators, the financial 

industry, and the general public. Each of these sets of consumers has different 

restrictions or guidelines under which FinCEN can provide BSA data or BSA 

data derived analysis. 

In FY 2020, FinCEN used BSA data to advance its investigations under 

Section 311 of the USA PATRIOT Act, further map out a range of illicit 

finance networks, and respond to specific requests for information from both 

law enforcement and intelligence community partners. FinCEN also used BSA 

data to identify potential BSA violations or programmatic deficiencies in 

furtherance or support of FinCEN examinations or enforcement investigations. 

In addition, FinCEN produced more than 2,000 financial intelligence products 

for law enforcement partners and responded to more than 1,000 requests for 

BSA information from foreign FIU partners. For domestic and foreign law 

enforcement partners, FinCEN provides high-value data analytics. FinCEN 

annually receives the results of surveys of its foreign Egmont Group10 member 

counterparts and domestic law enforcement agencies regarding the utility of its 

analytical products. These survey results consistently reflect positive feedback 

from our foreign and domestic stakeholders. FinCEN also receives feedback on 

 

9 The Death Master File is Social Security Administration (SSA) information used by medical researchers, 

hospitals, medical programs, and law enforcement agencies and other government agencies to verify a 

person’s death and to prevent fraud. Although it is SSA information, the National Technical Information 

Service in the Department of Commerce maintains the database. For more information, please visit the 

NTIS website. 

10 The Egmont Group is a united body of 165 FIUs. The Egmont Group provides a platform for the secure 

exchange of expertise and financial intelligence to combat money laundering and terrorist financing. 
22

individual reports from law enforcement and regulatory agencies on our efforts 

to combat terrorist financing, money laundering, and fraud against the U.S. 

government to include healthcare fraud and income tax fraud. 

• To combat illicit activity associated with the COVID19 pandemic, 

FinCEN has developed business rules designed to identify COVID19-

related fraud. These rules include fraud typologies such as consumer 

fraud, medical product fraud, securities fraud, and cyber fraud. The 

rules generate several hundred leads per month that FinCEN 

disseminates to our law enforcement and regulatory partners. Feedback 

on these reports has been extremely positive and have resulted in 

multiple new investigations by organizations such as the Department of 

Justice. 

• FinCEN has implemented a series of cybercrime-related business rules and 

continues to address emerging cyber threats and identifies potential vulnerabilities 

to financial institutions. FinCEN leverages business rules to monitor the volume of 

reported cyber threats actively, evaluate the potential risk these threats pose to 

financial institutions, and identify opportunities to increase threat preparedness. 

FinCEN has successfully leveraged cyber-related rules to track cyber criminals and 

develop financial intelligence products for law enforcement, identify the use of 

specialized malware associated with large-scale breaches and targeted attacks on 

payment systems, and review reporting of malware signatures and cyber intrusions 

affecting financial institutions. 

• To proactively combat significant money laundering and terrorist financing threats, 

FinCEN has implemented a series of algorithms designed to identify anomalous 

Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTR) that 

have not already been identified by law enforcement. The algorithms are designed 

to aggregate data on entities found in the BSA filings who may be using aliases 

and/or false identifiers to obfuscate their identities. The algorithms have been 

instrumental in generating high priority leads for FinCEN and external organization. 

FinCEN narrowly tailors its business rules to achieve its mission, and 

each rule is developed, tested, implemented, and re-tested for efficacy 

throughout its deployment. The Office of Chief Counsel and the Technology 

Division are engaged during the development of all business rules. FinCEN 

continues to receive strong positive feedback both from our domestic and 

international partners on the value of the financial intelligence derived from our 

business rules program. 

(E) An assessment of the impact or likely impact of the implementation of the 

data mining activity on the privacy and civil liberties of individuals, including 

a thorough description of the actions that are being taken or will be taken 

with regard to the property, privacy, or other rights or privileges of any 

individual or individuals as a result of the implementation of the data mining 

activity. 

The impact of FinCEN’s congressionally mandated mission on the 
23

privacy and civil liberties of individuals has been and will continue to be 

minimal. The Supreme Court has determined that financial information banks 

and other financial institutions hold—and that FinCEN collects and analyzes 

pursuant to its authority in 31 U.S.C. § 310 and the BSA (discussed in more 

detail in item (F) below)—carries no constitutionally protected expectation of 

privacy11. The Right to Financial Privacy Act of 197812 expressly provides no 

protection for financial records or information required to be reported in 

accordance with any federal statute or regulation, which includes information 

contained in BSA reports. Nevertheless, during the development of all business 

rules, analytical models, and algorithms, FinCEN considers whether the 

analytics will adversely affect an individual or entity’s (to the extent applicable) 

privacy, civil rights, or civil liberties. 

Significantly, FinCEN takes no adverse actions against individuals 

based solely on the existence of, or information contained in BSA data since a 

BSA13 report usually requires other data for there to be evidence of criminal 

activity. Therefore, in addition to considering it along with other information 

when taking actions under its own authorities, FinCEN provides the data, or 

analytical products analyzing the data, to outside agencies where the 

information may be relevant to current or potential investigations or 

proceedings under the jurisdiction of those agencies. 

The collected information is generally subject to the Privacy Act of 

1974,

14 which is discussed in more detail under item (F) below. FinCEN has 

developed policies and procedures to ensure that: (1) the analyzed information 

is used for purposes authorized by applicable law; and (2) the security of the 

information is adequately maintained. Analytical products produced by FinCEN 

are subject to clear restrictions regarding use and further dissemination of the 

products to ensure that the products will only be used by appropriate agencies 

for statutorily authorized purposes. To the extent such products reference 

information collected pursuant to the BSA, FinCEN has issued guidelines 

requiring user agencies to attach warning language to such products and to 

follow specific procedures for further dissemination of the BSA information. 

These procedures aim to ensure that: (1) only appropriate agencies will have 

access to the information; (2) the information will be used for statutorily 

authorized purposes; (3) agencies with access to FinCEN data are aware of the 

sensitivity of the material; and (4) FinCEN will be able to track which agencies 

have such materials in their possession. 

FinCEN posts Privacy Impact Assessments (PIA) on its public website, 

which informs the public of FinCEN’s activities and practices related to the 

 

11 United States v. Miller, 425 U.S. 435, 442 (1976). 

12 12 U.S.C. § 3401, et seq.

13 12 U.S.C. § 3413(d) (“Disclosure pursuant to Federal statute or rule promulgated thereunder: Nothing in 

this chapter shall authorize the withholding of financial records or information required to be reported in 

accordance with any Federal statute or rule promulgated thereunder.”)

14 5 U.S.C. § 552a. 
24

collection, processing, retention, and distribution of personally identifiable 

information (PII).15 The PII that FinCEN data repositories handle is necessary to 

assist regulators and law enforcement in identifying and monitoring the financial 

activities of individuals who are potentially committing financial crimes. 

(F) A list and analysis of the laws and regulations that govern the 

information being or to be collected, reviewed, gathered, analyzed, or 

used in conjunction with the data mining activity; to the extent 

applicable in the context of the data mining activity. 

The Bank Secrecy Act, 31 U.S.C. § 5311, et seq. (BSA) and implementing regulations, 

31

C.F.R. Chapter X, et seq: 

31 U.S.C. § 5311— Declaration of Purpose 

This section specifies that the purpose of the recordkeeping and 

reporting requirements in the BSA is to, “require certain reports where 

they have a high degree of usefulness in criminal, tax, or regulatory 

investigations or proceedings, or in the conduct of intelligence or 

counterintelligence activities, including analysis, to protect against 

international terrorism.”

31 C.F.R. § 1010.301 — Determination by the Secretary 

This regulation reflects the Secretary of the Treasury’s determination 

that the reports collected pursuant to the BSA have a “high degree of 

usefulness,” in criminal, tax, or regulatory investigations or 

proceedings. 

31 U.S.C. § 5319 — Availability of Reports 

This section makes it clear that, upon request, the Secretary of the 

Treasury (as delegated to FinCEN pursuant to Treasury Order 180-01) 

shall provide BSA information to an agency, including state financial 

institutions supervisory agencies, United States intelligence agencies, 

or self-regulatory organizations registered with the Securities and 

Exchange Commission or the Commodity Futures Trading 

Commission, for purposes consistent with the subsection. This section 

also provides that reports collected pursuant to the BSA are exempt 

from disclosure under the Freedom of Information Act, 5 U.S.C. § 

552. 

31 C.F.R. § 1010.950 — Availability of Information 

This section authorizes the Secretary to disclose BSA information for 

any reason consistent with the purposes of the BSA, and specifies that 

the recipients are to receive the information in confidence and shall 

 

15 For more information about FinCEN PIAs, please visit FinCEN’s website. 
25

not be further disclosed to any person except for official purposes 

relating to the investigation, proceeding or matter in connection with 

which the information is sought.

31 U.S.C. § 5313 — Reports on domestic coins and currency transactions

This section provides for the reporting by financial institutions of 

certain currency transactions in an amount, denomination, or amount 

and denomination, or under circumstances the Secretary (as delegated 

to FinCEN) prescribes by regulation.

31 C.F.R. §§ 1010.311; 1021.311 — Reports of transactions in currency

These regulations implement the reporting requirement of 31 U.S.C. 

§5313 and specify the amount of reportable transactions in currency 

at more than $10,000.

31 U.S.C. § 5316 — Reports on exporting and importing monetary instruments

This section requires reports by those that transport currency or other 

monetary instruments of more than $10,000 at one time from or 

through a place outside the United States into the United States, or 

from the United States to or through a place outside the United States.

31 C.F.R. § 1010.340 — Reports of transportation of currency or monetary instruments

This regulation implements the reporting requirement of 31 U.S.C. § 

5316 with respect to currency or other monetary instruments of more 

than $10,000 physically transported, mailed, or shipped into the 

United States or physically transported, mailed, or shipped outside the 

United States.

31 U.S.C. § 5314 — Records and reports on foreign financial agency transactions

This section authorizes the Secretary (as delegated to FinCEN) to

prescribe regulations requiring the reporting of certain types of 

foreign transactions and relationships with foreign financial 

institutions.

31 C.F.R. § 1010.350 — Reports of foreign financial accounts

This regulation, implementing 31 U.S.C. § 5314, requires that U.S. 

persons file reports of foreign bank accounts.

31 C.F.R. § 1010.360 – Reports of transactions with foreign financial agencies

This regulation provides that the Secretary (as delegated to FinCEN) 

may promulgate regulations requiring specified financial institutions 

to file reports of certain transactions with designated foreign financial 

agencies. These regulations may be kept confidential, and do not 

always have to be published in the Federal Register, so long as any 

financial institutions subject to the regulation will be named and 
26

personally served or otherwise given actual notice.

31 U.S.C. § 5318(g) — Reporting of suspicious transactions

This section authorizes the Secretary (as delegated to FinCEN), to 

require the reporting of suspicious transactions relevant to a possible 

violation of law or regulation. The section also provides for the 

confidentiality of such reports, barring financial institutions from 

notifying anyone involved in the transaction that the transaction has 

been reported. Government employees are subject to the same 

confidentiality restrictions, except as “necessary to fulfill the official 

duties” of such employees. The policies and procedures detailed 

above in response to item (E) are aimed, in large part, at maintaining 

the confidentiality of these reports.

31 C.F.R. §§1010.320; 1020.320; 1021.320; 1022.320; 1023.320; 1024.320; 

1025.320; 1026.320— Reports of Suspicious Transactions

These regulations implement 31 U.S.C. § 5318(g), requiring covered 

financial institutions to file suspicious activity reports and requiring the 

maintaining of strict confidentiality of the reports.

31 U.S.C. § 5331 — Reports relating to coins and currency received 

in nonfinancial trade or business

This section provides for the reporting of currency transactions of 

more than $10,000 by businesses other than financial institutions.

31 C.F.R. § 1010.330 — Reports related to currency in excess of 

$10,000 received in a trade or business

This regulation implements 31 U.S.C. § 5331.

12 U.S.C. § 1829b(b)(3) – International Funds Transfer Reporting Requirements

This section states that the Secretary and the Board of Governors of the 

Federal Reserve System shall jointly prescribe, after consultation with 

State banking supervisors, final regulations requiring that insured 

depository institutions, businesses that provide check cashing services, 

money transmitting businesses, and businesses that issue or redeem 

money orders, travelers’ checks or other similar instruments maintain 

records of payment orders which involve international transactions; and 

direct transfers of funds over wholesale funds transfer systems or on the 

books of any insured depository institution, or on the books of any 

business that provides check cashing services, any money transmitting 

business, and any business that issues or redeems money orders, 

travelers’ checks or similar instruments, that will have a high degree of 

usefulness in criminal, tax, or regulatory investigations or proceedings.

31 CFR § 1020.410(a) – Records to be made and retained by banks

This regulation implements 12 U.S.C. § 1829b(b)(3), and requires each 
27

bank covered by the regulation to retain records of funds transfers in 

the amount of $3,000 or more. 

31 U.S.C. § 5318A – Special measures for jurisdictions, financial 

institutions, international transactions, or types of accounts of primary 

money laundering concern 

The Secretary of the Treasury (as delegated to FinCEN) may require 

any domestic financial institution or financial agency to maintain 

specified records and file reports upon a finding that a jurisdiction 

outside of the United States, one or more financial institutions operating 

outside of the United States, one or more classes of transactions within, 

or involving, a jurisdiction outside of the United States, or one or more 

types of accounts is of primary money laundering concern, the Secretary 

of the Treasury (as delegated to FinCEN) may require any domestic 

financial institution or financial agency to maintain records, file reports, 

or both, concerning the aggregate amount of transactions, or concerning 

each transaction, with respect to the entity found to be of primary 

money laundering concern; beneficial ownership of any account opened 

or maintained in the United States by a foreign person or a 

representative of that foreign person that involves the entity found to be 

of primary money laundering concern; or information relating to certain 

correspondent accounts. 

Section 314a of the USA PATRIOT Act – Cooperative Efforts to Deter 

Money Laundering 

This section (located in the Notes to 31 U.S.C. § 5311) helps law enforcement identify, 

disrupt, and prevent terrorist acts and money laundering activities by encouraging 

further cooperation among law enforcement, regulators, and financial institutions to 

share information regarding those suspected of being involved in terrorism or money 

laundering 

31 CFR § 1010.520 – Information sharing between government agencies and financial 

institutions 

This regulation implements Section 314a of the USA PATRIOT Act and provides that a 

law enforcement agency investigating terrorist activity or money laundering may 

request that FinCEN solicit, on the investigating agency’s behalf, certain information 

from a financial institutions or group of financial institutions. The requesting agency 

must provide a written certification that each entity for which the agency is seeking 

information is engaged in, or is reasonably suspected based on credible evidence of 

engaging in, terrorist activity or money laundering along with specific identifies. 

FinCEN may also solicit, on its own behalf, and on behalf of appropriate components 

of the Department of the Treasury such information. 

The Privacy Act of 1974 (Privacy Act), 5 U.S.C. § 552a 
28

The reports that FinCEN collects pursuant to the BSA are “records” 

contained in a “system of records,”16 and are covered by the Privacy Act. 

Covered records may be disclosed without the permission of the individual to 

whom the record pertains if they are disclosed to individuals and 

organizations external to the U.S. Department of the Treasury pursuant to a 

“routine use,”17 and are disclosed for purposes for which the information was 

collected. FinCEN’s routine uses are included in three published Systems of 

Records Notices (SORNs) that cover the information it collects under the 

BSA: 

(1) Treasury/FinCEN .001, FinCEN Investigations and Examinations System,18

(2) Treasury/FinCEN .002, Suspicious Activity Report (SAR) System;19 and 

(3) Treasury/FinCEN .003, Bank Secrecy Act (BSA) Reports System.20

FinCEN followed Privacy Act procedures (including appropriate public 

notice and comment periods) to exempt certain records maintained in the SARs 

and BSA systems of records from specific provisions of the Privacy Act, 

including those allowing for subject’s access to the reports, notification to the 

subject when reports are shared, requests for correction of the contents of such 

reports by the subject, and the civil remedies covering these areas. These 

exemptions prevent individuals who are planning crimes from avoiding detection 

or apprehension or structuring their operations to avoid detection or 

apprehension. 

Other Relevant Provisions 

31 U.S.C. § 310 — Financial Crimes Enforcement Network 

This section establishes FinCEN as a bureau in the Department of the 

Treasury, sets out the duties and powers of the Director, and empowers the 

Director to administer the BSA to the extent delegated by the Secretary of the 

Treasury.21 This section also requires FinCEN to maintain a “government-wide 

data access service” for the information collected under the BSA, as well as 

records and data maintained by other government agencies and other publicly 

and privately available information.22

 

16 5 U.S.C. § 552a(a)(3) (defining a “record” to mean any item, collection, or grouping of information about 

an individual that is maintained by an agency, including, but not limited to, his education, financial 

transactions, medical history, and criminal or employment history and that contains his name, or the 

identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or 

voice print or a photograph and a “system of records” to mean a group of any records under the control of 

any agency from which information is retrieved by the name of the individual or by some identifying 

number, symbol, or other identifying particular assigned to the individual); 

17 5 U.S.C. § 552a(b)(3). 

18 79 Fed. Reg. 20969 (April 14, 2014). 

19 Id. at 20972. 

20 Id. at 20974 

21 Treasury Order 180-01, Financial Crimes Enforcement Network (July 1, 2014) (delegating to the 

Director of FinCEN various duties and responsibilities, including the authority to administer, implement, 

and enforce the BSA) 

22 31 U.S.C.§ 310(b)(2)(B). 
29

FinCEN is required to “analyze and disseminate” the data for a broad 

range of purposes consistent with the law.23 These purposes include identifying 

possible criminal activity; supporting domestic and international criminal 

investigations (and related civil proceedings); determining emerging trends and 

methods in money laundering and other financial crimes; supporting the conduct 

of intelligence and counterintelligence activities, including analysis, to protect 

against international terrorism; and supporting government initiatives against 

money laundering. 

The section further requires that FinCEN furnish research, analytical, 

and informational services to financial institutions and domestic and foreign law 

enforcement agencies for the “detection, prevention, and prosecution of 

terrorism, organized crime, money laundering and other financial crimes,” and 

provide, “computer and data support and data analysis to the Secretary of the 

Treasury for tracking and controlling foreign assets24.” The section also 

provides for the establishment of standards for making the information available 

through efficient means, and to screen appropriate users and appropriate uses25.

The activities and procedures described in this report adhere to the requirements 

of this statute. 

(G)A thorough discussion of the policies, procedures, and guidelines that 

are in place or that are to be developed and applied in the use of such 

data mining activity in order to: 

(i) protect the privacy and due process rights of 

individuals, such as redress procedures. 

A description of the policies, procedures, and guidance in place to 

ensure the privacy and due process rights of individuals that are the subject of 

FinCEN data mining activities is provided in subsection (E) above. 

(ii) ensure that only accurate and complete information 

is collected, reviewed, gathered, analyzed, or used, 

and guard against any harmful consequences of 

potential inaccuracies. 

FinCEN, through its data perfection procedures, ensures that information 

contained in the database of BSA reports is accurate and complete. In addition, as 

discussed in item (E) above, FinCEN does not take adverse actions against 

individuals (outside the context of enforcing the requirements of the BSA itself) 

based on the information contained in BSA reports. In addition, because user 

agencies only use BSA information in conjunction with other evidence, a BSA report 

is not used as the sole basis for user agencies’ adverse actions. 

As noted earlier in this report, individuals have not constitutionally protected 

 

23 Id. at § 310(b)(2)(C)(i)-(vii).

24 Id. at § 310(b)(2)(E), (G). 

25 Id. at § 310(c)(1) and (c)(2). 
30

“expectation of privacy” in FinCEN’s BSA data, and FinCEN takes no adverse 

actions against individuals based on the BSA data collected. Nevertheless, FinCEN’s 

BSA analyst training discusses the importance of confidentiality, safeguarding and 

non-disclosure of BSA data to unauthorized individuals or organizations. 

Additionally, all FinCEN staff are required to complete Privacy Awareness training 

annually which includes staff’s privacy responsibilities, including the Privacy Act 

handling and safeguarding responsibilities that apply to all BSA data. Accountability 

for the BSA data’s security and confidentiality and its handling are prominently 

articulated in all course materials. FinCEN also has mandatory training for its BSA 

data users, including secure handling and safeguarding of the information. FinCEN 

provides online training for all external users as a requirement for access to FinCEN 

Query. At a minimum, biennially, BSA data users must complete training as a 

requirement of continued system access. In addition to this online training, FinCEN 

hosts webinars as requested. 
31

ALCOHOL AND TOBACCO TAX AND TRADE BUREAU (TTB) FY 2020 

DATA MINING REPORT 

TTB Data Mining Activities 

(A) A thorough description of the data mining activity, its goals, and, where 

appropriate, the target dates for the deployment of the data mining 

activity. 

TTB performs two types of activities that together qualify as data mining as 

defined by the Federal Agency Data Mining Reporting Act of 2007: 

• Queries of commercial transactions recorded by tax and trade databases 

maintained by TTB and other federal agencies; and 

• Searches of commercial and law enforcement databases to discover 

criminal activity. 

The data is gathered through queries of registered individuals or 

businesses, and include some queries that are solely based on subject matter (for 

example, queries of all tobacco products imported over a given time period). 

TTB conducts these activities primarily for the purpose of compiling business 

intelligence reports and as part of a strategic risk-based approach to effectuate 

TTB’s mission to collect the revenue. Through data-driven analysis, TTB 

focuses on identifying the highest risk activity for audits and investigations. 

Continuous refinements to these data analytic reports combined with sound 

intelligence enable TTB to efficiently deploy its enforcement resources to 

address the most serious revenue threats. 

(B) A thorough description of the data mining technology that is being used 

or will be used, including the basis for determining whether a particular 

pattern or anomaly is indicative of terrorist or criminal activity. 

TTB uses commercially available data mining technologies to access 

and analyze information. The experience of TTB field staff determines 

whether a particular pattern or anomaly is indicative of violations that may be 

subject to further field review and investigation. 

Most data mining is conducted with a combination of statistical 

analysis software (SAS) and Oracle relational database systems. Data are 

retrieved with SAS data step programming and/or Structured Query Language 

(SQL) queries. Data fields are transformed with procedures that aggregate, 

correlate, cluster, and otherwise simplify available variables. Once data is 

collected and transformed, TTB develops reports that consolidate specific 

factors along with business rules that flag entities needing additional research. 

This additional research may serve as the basis of referral for further TTB 

action. 

(C) A thorough description of the data sources that are being or will be 
32

used. 

TTB uses data from its own databases, the databases of other federal 

agencies, and commercial data providers. The data sources include: 

Internal Data: 

• Integrated Revenue Information System (IRIS) – tax data submitted by 

TTB industry members; 

• Permits Online (PONL) – application data from businesses requesting a 

TTB permit; 

• AutoAudit and Case Management System – data from TTB’s audits and 

investigations; 

• Formulas Online (FONL) – data from businesses submitting formula 

approval requests; and 

• Certification/Exemption of Label/Bottle Approvals (COLAS) Online –

data from businesses submitting labels for approval. 

External Data: 

• International Trade Data System (ITDS) - data regarding imports of products 

regulated by TTB; 

• Census Export Data – data regarding exports of products regulated by 

TTB; 

• LexisNexis Accurint – a commercial database containing records of court 

proceedings, including some criminal cases, property holdings, and bankruptcies; and 

• Standard & Poor’s Capital IQ – commercial database containing company profiles, 

including ownership and financial information. 

(D)An assessment of the efficacy or likely efficacy of the data mining 

activity in providing accurate information consistent with and valuable 

to the stated goals and plans for the use or development of the data 

mining activity 

TTB’s data mining activity automates certain routine screening and 

monitoring processes to improve permit application reviews and detection of tax 

compliance violations. New analytic tools accurately identified cases with 

significant tax compliance violations, approximately 65% of the time. Other 

business intelligence reports automatically consolidate data and monitor 

operations, tax payments, and import and export activity patterns. These reports 

facilitate TTB oversight of a wider selection of its regulated industries and serve 

as the source of referrals for enforcement cases. For FY19, there was a 59% 

success rate of enforcement cases initiated using analytics. FY20 data is not yet 

available; however, mid-year results indicate a 37% success rate. This decline is 

primarily due to current enforcement policies driven by recent statutory changes 

to the tax code. TTB expects to review and refine analytic tools, measure 

methodologies, and/or enforcement policies in FY21. 
33

(E) An assessment of the impact or likely impact of the implementation of 

the data mining activity on the privacy and civil liberties of individuals, 

including a thorough description of the actions that are being taken or 

will be taken with regard to the property, privacy, or other rights or 

privileges of any individual or individuals as a result of the 

implementation of the data mining activity. 

TTB’s data mining activity has little impact on the privacy and civil 

liberties of individuals. Insights gained from the activity primarily result in 

actions against property, or the privilege to operate in regulated industries, after 

thorough review by experienced specialists with oversight authorities mandated 

by federal laws and regulations. The data sources mined are also limited to 

include only tax records, regulatory records, commercial records, and law 

enforcement records authorized for use in oversight and enforcement. 

Any data concerning individuals or businesses are vigorously protected 

against unauthorized use and disclosure. Policies and procedures prohibit the 

search of any database for reasons other than providing authorized oversight or 

enforcement. In cases when patterns in data are thought to be indicative of 

compliance issues, the data and circumstances are carefully reviewed by 

experienced staff before any adverse action is taken. TTB also continues to 

protect data against any unauthorized disclosure through all investigation and 

enforcement actions. 

Data gathered in data mining activities is considered private and 

confidential and 26 U.S.C. § 6103 protects it from disclosure. TTB handles this 

data consistent with that statute. Privacy protections are further assured by 

additional laws that provide for civil and criminal penalties for any unauthorized 

disclosure of taxpayer data. There are criminal penalties including: (1) felony 

for the willful unauthorized disclosure of tax information; (2) misdemeanor for 

the unauthorized inspection of tax information; and (3) civil cause of action for 

the taxpayer whose information has been inspected or disclosed in a manner not 

authorized. 

(F) A list and analysis of the laws and regulations that govern the 

information being or to be collected, reviewed, gathered, analyzed, or 

used in conjunction with the data mining activity; to the extent applicable 

in the context of the data mining activity 

TTB administers the provisions of the Internal Revenue Code (IRC) 

relating to distilled spirits, wine, and beer (26 U.S.C. Chapter 51), tobacco (26 

U.S.C. Chapter 52), firearms and ammunition excise taxes (26 U.S.C. § 4181, 

4182, and related portions of chapter 32), and the general rules of tax 

procedure with respect to these commodities (including related criminal 

provisions at 26 U.S.C. Chapters 68 and 75). In addition, TTB administers the 

Federal Alcohol Administration Act (27 U.S.C. chapter 8, subchapter I), which 

covers basic permits, unfair trade practices, and labeling and advertising of 
34

alcohol beverages; the Alcoholic Beverage Labeling Act of 1988 (27 U.S.C. 

chapter 8, subchapter II), which requires a specific “Government Warning” 

statement on alcohol beverage labels; and the Webb-Kenyon Act (27 U.S.C. §§ 

122-122b), which prohibits the shipment of liquor into a state in violation of 

state law. 

The IRC establishes qualification criteria to engage in the businesses 

relating to manufacturing and importing or exporting tobacco products, and 

manufacturing or importing processed tobacco, and require that persons obtain 

permits to engage in these activities. See 26 U.S.C. § 5713. A permit 

qualification requirement also applies to the production of distilled spirits and 

wine, as well as to the wholesaling and importation of all beverage alcohol 

products. See 26 U.S.C. §§ 5171(c) and (d), 5271; see also 27 U.S.C. §§ 201 et 

seq.

The Secretary of the Treasury originally retained the authority to 

collect excise taxes on imported alcohol and tobacco products through the 

Homeland Security Act of 2002 (See 6 U.S.C. §§ 212 and 215). Through 

Treasury Order 100–16, the Secretary of the Treasury delegates authority over 

“Customs revenue functions” to the Secretary of the Department of Homeland 

Security. The Homeland Security Act of 2002 defines these functions as 

“assessing and collecting customs duties (including antidumping and 

countervailing duties and duties imposed under safeguard provisions), excise 

taxes, fees, and penalties due on imported merchandise, including classifying 

and valuing merchandise for purposes of such assessment.” (6 U.S.C. § 

215(a)(1)). 

TTB is authorized pursuant to the Homeland Security Act of 2002, 

Pub. L. 107-296; Executive Order 13439, July 18, 2007; the Internal Revenue 

Code of 1986 (IRC); and the Federal Alcohol Administration Act, 27 U.S.C. 

chapter 8 (FAA Act) to access data within Customs and Border Protection 

(CBP) data systems necessary to fulfill its statutory mission. TTB is working 

in conjunction with CBP to fulfill its statutory mission as it relates to imported 

products subject to various taxes and to ensure taxpayers understand their tax 

responsibilities related to these products. Cooperative efforts across federal 

agency lines will accommodate the collection of data as it relates to imported 

commodities subject to federal taxes, including but not limited to retail, excise, 

manufacturers, and environmental taxes. 

When the data analyzed by the reports consists of taxpayer information, 

26 U.S.C. § 6103 governs the use of all tax-related data. Subsection (a) sets out 

the general rule of confidentiality. Subsection (b) sets forth definitions of terms 

commonly used throughout Section 6103. Subsections (c) through (o) of 

Section 6103 contain exceptions to the general rule of confidentiality. The use 

of confidential commercial, financial, or trade secrets information is governed 

by the Trade Secrets Act, 18 U.S.C. § 1905, which prohibits the unlawful 

disclosure of this information by any federal official, employee, or contractor. 
35

(G) A thorough discussion of the policies, procedures, and guidelines that are in 

place or that are to be developed and applied in the use of such data mining 

activity in order to: 

(i) protect the privacy and due process rights of individuals, such as 

redress procedures. 

All of TTB’s information collections are subject to the OMB review 

process and any forms that request personal information subject to the Privacy 

Act include a Privacy Act Statement. In addition, TTB’s privacy policy is 

posted on TTB’s website and is referenced on TTB’s Online Applications. 

TTB’s systems of record notice can be found in the Federal Register at 80 F.R. 

4637 (January 28, 2015). 

TTB data mining activities do not determine whether a person or entity 

will be subject to administrative enforcement action or criminal prosecution. 

Any audit or investigation that is initiated based, in part, upon data from the 

activities are governed by the laws, administrative procedures, policies, and 

controls that govern criminal investigations or any other ensuing actions. 

Information generated and accessed by the data mining activities is 

protected by internal controls that limit access to persons whose official duties 

require inspection of such information for tax administration purposes. The 

information is further protected by 26 U.S.C. § 6103, governing the 

confidentiality of returns and return information, and the Trade Secrets Act, 18 

U.S.C. § 1905, which protects confidential commercial, financial, or trade 

secrets information collected by the federal government. 

TTB notifies system operators of the requirements and legal 

consequences of accessing predictive models and/or analytic reports. The 

message states: 26 U.S.C. § 6103 Data Warning. Information contained in this 

report is tax return information protected from disclosure by 26 U.S.C. § 6103. 

By accessing this report, you hereby certify that your official duties require 

you to inspect such information for tax administration purposes. 

Users of analytic reports receive demonstrations of reports, user guides 

and/or product descriptions, as needed. Field Operations staff receive 26 

U.S.C. § 6103 and disclosure training. In addition, all TTB employees 

complete the annual Privacy Awareness and Cyber Security Awareness 

training. Finally, system sponsors and IT staff supporting development, 

maintenance, and operations of IT systems are required to take additional 

specialized security training each year. For all available governmental data 

sources, users must sign a non-disclosure agreement before receiving access. 

(ii) ensure that only accurate and complete information is 

collected, reviewed, gathered, analyzed, or used, and 
36

guard against any harmful consequences of potential 

inaccuracies. 

The data mining activities rely on information collected through 

systems that generate data quality reports and are subject to data cleansing 

procedures. TTB does not rely solely on information gathered to take any 

adverse action against any individual or entity. Rather, the reports are the 

first step in gathering data and this information is verified through 

subsequent research, and investigation and/or audits of companies before 

any action is taken. 

TTB documents and manages all data sets associated with its systems 

using the TTB Systems Development Life Cycle (SDLC). Checks and 

balances are inherent to the data correction process ensuring different teams 

handle different steps of the effort and include oversight by the Office of the 

Chief Information Officer Quality Assurance (OCIO QA) Team. When the 

system owner identifies inconsistencies with data, TTB’s OCIO may initiate 

a data correction. All changes are documented via the Request for Change 

process managed by the Configuration Management Team and work orders 

track the correction through its lifecycle (from request to development and 

through implementation), which includes confirmation of successful 

completion by the system owner. The process includes specific identification 

of the data to be corrected along with rationale for the change. SDLC 

artifacts (e.g., database scripts) supporting data corrections conform to Data 

Management (DM) standards. The Software Maintenance Team verifies 

analysis, development, and testing through a quality review process 

conducted by the DM Team to ensure the data correction is thoroughly 

documented. Once the DM Team has approved the data correction, the 

Operations Team executes the correction and the system owner verifies the 

correction. 

The Memorandum of Understanding with CBP contains language 

that both parties will notify one another if either agency discovers data 

issues. 
37

INTERNAL REVENUE SERVICE (IRS) FY 2020 DATA MINING 

REPORT 

(A) A thorough description of the data mining activity, its goals, and, 

where appropriate, the target dates for the deployment of the data 

mining activity. 

Four divisions of the IRS are engaged in data mining activities covered 

by the Act: IRS Criminal Investigation organization (IRS-CI); the IRS Small 

Business/Self-Employed Division (SB/SE); the IRS Wage and Investment 

Division (W&I); and the IRS Research, Applied Analytics, and Statistics 

Division (RAAS). In FY 2020, each of these IRS divisions used one or more 

data mining applications/computing environments to search for specific 

characteristics that are indicators of potential criminal activity: 

• Investigative Data Examination Application (IDEA) - formerly 

known as Investigative Data Analytics; 

• Lead and Case Analytics (LCA); 

• Return Review Program (RRP); 

• FinCEN Query; and 

• Compliance Data Warehouse (CDW) 

IRS-CI is tasked with protecting IRS revenue streams by detecting 

fraudulent activity and preventing recurrences. In FY 2020, IRS-CI used IDEA, 

LCA, and RRP systems to support this work. Data uncovered using these 

systems may be reflected in indictments and criminal prosecutions. 

IDEA is a data query tool currently in use at the CI Lead Development 

Centers (LDC), Scheme Development Centers (SDC) and field offices, and it 

provides CI analysts and special agents with the ability to quickly search 

electronic data through a single access point. By using the IDEA application, 

special agents and investigative analysts can proactively identify patterns 

indicative of illegal activities. This tool enhances investigation selection and 

supports investigative priorities in tax law enforcement, counterterrorism, and 

other high-priority criminal investigations. The IDEA application uses data for 

both reactive and proactive queries. Reactive queries are a result of specific, 

targeted investigations; proactive queries are the result of pattern matching to 

generate leads. Data available in the IDEA application enable users to detect 

suspicious financial transactions indicative of money laundering, terrorism, and 

other financial crimes. IDEA query results are used exclusively for generating 

leads. 

Any investigative process that results from these leads uses the corresponding 

data from the originating systems. 

LCA is a data query and visualization application that allows CI 

investigative analysts and agents to query and analyze large and disparate sets of 

data through a single access point. This enhances the analyst’s ability to develop 
38

a comprehensive picture of suspicious or criminal activity. The LCA application 

uses data for both reactive and proactive queries. Reactive queries are a result of 

specific, targeted investigations; proactive queries are the result of pattern 

matching to generate leads. Data available in the LCA application enable users 

to detect suspicious financial transactions indicative of money laundering, 

terrorism, and other financial crimes. The application presents information to the 

user visually, exposing associations between entities in the data that might 

otherwise remain undiscovered. The software used to create LCA allows users 

from the LDCs, SDCs, and field offices to create visualization diagrams, graphs, 

spreadsheets, reports, timelines and maps to enhance investigation selection. It 

also supports investigative priorities to proactively identify and develop leads 

for refund fraud, identity theft, counterterrorism, money laundering, offshore 

abusive trust schemes, and other financial crime, as well as Bank Secrecy Act 

(BSA) Suspicious Activity Report (SAR) reviews and Financial Crimes Task 

Force activity. 

IRS-CI and W&I use RRP to maximize detection of tax return fraud, tax 

noncompliance, and identity theft. As RRP receives returns, it loads and assigns 

a risk score to each tax return based on an array of models. Scores range from 

0.0 to 1.0, with a higher score indicating a greater potential for fraud/noncompliance/identity theft. In addition to models, RRP also includes multiple 

model scores and linking characteristics. IRS uses these analytics, including 

data mining, to systemically stop suspicious refunds from being automatically 

issued to taxpayers. In RRP, IRS-CI does not directly examine the scores, but 

does use returns that W&I determines to be potentially fraudulent as a basis for 

its criminal investigations. RRP employs multiple technologies for data mining 

activities. Each of these technologies use current year examples of identity theft 

(IDT), non-IDT tax fraud, and non-fraud to develop supervised models, 

unsupervised models, rules, and network analytics.

IRS-CI and SB/SE users access the FinCEN Query system (see 

FinCEN report herein) as the system of record for Bank Secrecy Act (BSA) 

data. 

CDW is an analytical computing environment managed by RAAS that is 

used by IRS researchers for high performance computing and advanced analytics. 

It simplifies access to over 50 legacy and third-party data sources through a selfservice analytical model that fosters collaboration among business units and 

better sharing of data assets. A large and diverse set of use patterns includes: 

• Machine learning and deep learning. Used to detect IDT and refund 

fraud patterns; develop return-based scores for compliance planning; 

identify anomalies for case selection; embed case routing and 

treatment strategies into collection processes; and predict journey 

events in the sequence of customer service interactions. 

• Natural language processing. Used to better understand behavioral 

factors in taxpayer decisions; categorize appeals determinations; 
39

identify related entities, material advisors, and other parties in complex 

business structures; compare third-party documents and classify topics 

in customer service case notes. Also used for language translation to 

convert machine-readable text from dozens of foreign languages to 

English to facilitate other analytical methods. 

• Graph analytics. Used to identify complex relationships and fraud patterns in 

corporate flow-throughs, tax shelters and entity establishments; detect 

noncompliance in preparer networks; develop risk-based models for multi-party 

transactions; and model the diffusion of tax law changes through internal orders, 

process controls, and policies. 

• Simulation. Used to perform what-if calculations for changes in tax policy; 

develop models of taxpayer choice for customer service channels; model tax 

evasion for pass-through entities; estimate taxpayer burden measures; better 

understand the impacts of labor migration; and facilitate improved workload 

planning for non-filer strategies. 

• Optimization. Used to create dynamic, next-best-case 

recommendation for workload delivery; develop enterprise staffing 

attrition models; and identify optimal post-of-duty locations. 

(B) A thorough description of the data mining technology that is being used or 

will be used including the basis for determining whether a particular pattern 

or anomaly is indicative of terrorist or criminal activity 

IDEA and LCA do not provide IRS with the ability to determine 

indicators of terrorist or criminal activity. Special agents and investigative 

analysts can query based on experience. Agents and analysts determine 

indicators of fraudulent activity based on previous successful investigations of 

money laundering, counterterrorism, and BSA violations. 

W&I employees use RRP to identity potentially fraudulent, 

noncompliant, and identity theft activity. IRS-CI uses the fraudulent tax returns 

identified by W&I as a basis for its criminal investigations. Paper refund 

returns come to RRP from the Generalized Mainline Framework (GMF).26

This allows W&I and SDC employees to review those returns for suspicious 

activities. 

If a return meets designated score tolerances and/or other criteria, W&I 

and IRS-CI personnel may examine the return for fraudulent activity. Once a 

return is verified to be false via screening, Taxpayer Protection Program 

authentication and/or the wage verification process, the fraudulent returns are 

added via Electronic Fraud Detection System Case Management systemically or 

by W&I and CI-IRS users to the Scheme Tracking and Retrieval System 

(STARS) component. IRS-CI investigative analysts review the returns in 

Discoverer and STARS to find possible schemes, or fraudulent patterns, which 

 

26 The Generalized Mainline Framework is a service center pipeline processing system that validates and 

perfects data from a variety of input sources. Tax returns, remittances, information returns, and adjustment 

and update transactions in the system are controlled, validated, corrected, and passed on for master file 

posting. 
40

may result in a referral to a CI field office for investigation. 

RRP employs multiple technologies for data mining activities. Each of 

these technologies use current year examples of IDT, non-IDT tax fraud, and 

non-fraud to develop supervised models, unsupervised models, rules, and 

network analytics: 

 

• SAS – RRP uses SAS as the workbench for developing and evaluating supervised 

and unsupervised models as well as for data exploration activities. RRP uses 

multiple SAS machine learning algorithms (e.g., decision trees, neural networks, 

logistic regression) to uncover patterns in the data associated with fraud. RRP also 

includes components of SAS’ High Performing Analytics (e.g., SAS Grid, SAS indatabase analytics) to develop and deploy models with greater complexity than 

what could be built on a traditional infrastructure. Greater complexity allows RRP 

models to display greater accuracy and robustness. Supervised models produce a 

score from 0.000 to 1.000 where a higher score represents a higher likelihood of a 

return being fraud. 

• Greenplum Data Computing Appliance (DCA) – All RRP models are 

deployed and run directly in the database. Deploying models directly to 

the database removes the network latency required to move data to a 

separate application tier server containing the models. Moreover, the 

Greenplum DCA provides massively parallel processing capabilities 

across multiple segment servers. In addition to models developed using 

SAS, RRP also develops models in the form of custom user-defined 

functions in the Greenplum DCA. 

a) RRP’s network analytics tool – Linked Return Analysis (LRA) – uses 

multiple custom built Greenplum functions to link returns that display 

common, suspicious characteristics. 

b) RRP builds “identity theft filters” using Greenplum functions. These 

functions combine the outputs of RRP models, rules and LRA to flag 

suspicious cases of identity theft treatment. 

• FICO Blaze Advisor (FICO BA) – RRP builds and maintains business rules using 

FICO Blaze Advisor. FICO BA provides transparency into the logic that drives 

business decisions. FICO BA houses the logic that drives RRP’s Systemic 

Verification process – the rule logic that matches taxpayer submitted Income 

Documents (IDOCs) to the document submitted by withholding party(ies) (e.g., 

employer submitted W-2s containing income and withholding information). 

CDW provides a state-of-the-art research and technology infrastructure to enable a 

full range of analytical use patterns, including large-scale analysis of historical records, 

distributed parallel computing of data stored across deep storage/memory architectures, and 

in-memory computing of large data structures, such as complex graphs. Major components 

of the CDW ecosystem include: 
41

• Traditional data warehousing – centered on SAP IQ, SAP HANA, and SAP Data 

Services to enable SQL-based analytics User-Defined Functions (UDFs). Other 

database technologies include Oracle, SQL Server, PostgreSQL, and MongoDB. 

• Analytical tools – Commercially licensed and open source software includes SAS, 

Stata, R, Python, Julia, Tableau, Zeppelin, ArcGIS, ExtendSim, NetLogo, Repast 

HPC, Cytoscape, Solr, ElasticSearch, Tesseract, Tensorflow, and BigSQL for 

machine learning, graph-based analytics, natural language processing, simulation, 

optimization, and advanced visualization. 

• High performance computing – Hadoop platform with Spark, SparklyR, PySpark, 

TensorFlow, and other Apache-based tools designed for Hadoop processing. 

• Image processing – centered on iPro, Kofax, Adobe, and IBM DataCap for image 

processing and Optical Character Recognition (OCR) services. 

• Knowledge management – use of GitLab, MVC Forum, and Wiki to enable code 

management, collaboration, and other information services for analytics. 

(C) A thorough description of the data sources that are being or will be used. 

The IRS-CI applications IDEA and LCA leverage the following data sources. 

• Taxpayer: The source is the electronically filed return, as 

transmitted through Modernized e- File (MeF) or a paper filed tax 

return. 

• Employers/Payers: Information from employers/payers captured on 

various forms as stored in the Information Returns Master File (IRMF). 

• Other Treasury sources: BSA data provided by FinCEN, Specially 

Designated Nationals’ data provided by the Office of Foreign Assets

Control. 

• Other IRS sources: Tax Exempt Organizations data, 

Voluntary Disclosures, Criminal Investigations data. 

The RRP application leverages the following data sources. 

• Taxpayer: The source is the electronically filed return (as transmitted 

through MeF) or a paper filed tax return. RRP also loads taxpayer data 

contained on the IRS Master File. 

• Employers/Payers: Information from employers/payers captured on 

Form W-2 and/or Form 1099 as stored in the IRMF. 

• Other federal agencies: Federal Bureau of Prisons for prisoner 

information; Social Security Administration for National Accounts 

Profile data for dates of births and deaths. 

• State and local agencies: All states and the District of Columbia 

prisons deliver prisoner listing information annually to IRS-W&I in 

electronic format. 
42

CDW leverages the following data sources: 

• Taxpayer: Tax returns from individuals, businesses, exempt organizations, and 

other taxpayers as transmitted through MeF or as a paper filed tax return. 

• Employers/Payers: Information from employers/payers captured on various forms 

as stored in the IRMF. 

• Other federal agencies. Social Security Administration for birth/death data, 

Department of Justice for sealed documents, Department of Transportation for 

excise-related information. 

• Other IRS sources: Tax Treaty organizations, Voluntary Disclosures, case 

management systems for examination, collection, and under reporter data. 

(D)An assessment of the efficacy or likely efficacy of the data mining activity 

in providing accurate information consistent with, and valuable to, the 

stated goals and plans for the use or development of the data mining 

activity. 

The data uncovered during the query searches are only leads and require 

additional investigative steps for quality verification. There is no empirical data 

on the efficacy of searches by the IDEA and LCA applications. 

The efficacy of RRP can be measured in terms of identity theft detection 

and ability to identify returns ready for non-identity theft compliance referral 

treatment. Two key metrics are used to assess RRP’s efficacy: lead generation 

and True Positive Rate. In PY 2020 (through October 14, 2020), RRP generated 

1,069,176 identity theft leads at a lead accuracy rate of 49 percent. Almost 5 out 

of every 10 returns flagged as IDT by RRP never receive a legitimate taxpayer 

identity authentication via the IRS’ web, phone, or in-person authentication 

processes. 

In addition to identity theft detections, RRP includes models to identify 

returns ready for non-identity theft compliance referral treatment. RRP 

expanded its capability in this area in 2020 by expanding the ability to reprocess certain returns when IRS receives taxpayer authentication or 

new/updated third party data (e.g., employer submitted W-2s) to cover all 

returns, not just those that claim refundable credits. During 2020, RRP increased 

the non-identity theft fraud leads by over 55 percent versus the same period in 

PY 2019 - an increase in over 360,000 new non-identity theft fraud leads: 

• RRP Non-Identity Theft Models/Filters: over 115,000 leads at 55% lead accuracy 

(lead accuracy represents 22 percentage points improvement compared to the same 

period in PY 2019) 

• EIC/ACTC Models/Filters: over 300,000 leads at 30% accuracy (similar lead 

accuracy to PY 2019) 

• RRP Business Rules Filters: over 29,000 leads at 45% lead accuracy (lead accuracy 

represents 17 percentage points improvement compared to the same period in PY 

2019) 
43

• RRP Frivolous Filer Rules: over 80,000 leads at 15%lead accuracy (lead accuracy 

represents two percentage points improvement compared to the same period in PY 

2019) 

• RRP Non-IDT Filter X “Can’t Verify”: over 2,637,000 leads 

• Over 1,944,000 identified for systemic release to taxpayer based on reprocessing/new third-party data. 

• Over 416,000 leads sent to treatment based on re-processing/new third-party data at 

42% lead accuracy. 

• RRP IDT False Positive Reprocessing: over 152,000 leads at 45% lead accuracy 

The efficacy of the FinCEN Query system is discussed herein in Section (D) of that report. 

For CDW, the results produced from data analysis represent insights or 

potential leads and require additional investigative steps for quality 

verification. There is no empirical data on the efficacy of searches by these 

applications. 

(E) An assessment of the impact, or likely impact, of the implementation of 

the data mining activity on the privacy and civil liberties of individuals, 

including a thorough description of the actions that are or will be taken 

with regard to the property, privacy, or other rights or privileges of any 

individual or individuals as a result of implementing the data mining 

activity. 

Once evidence of fraud is discovered, laws and administrative procedures, 

policies, and controls govern the ensuing actions. IDEA, LCA, and CDW 

applications use personally identifiable information (PII), where needed, for 

record matching and analysis in data-driven investigations. CI and RAAS follow 

the IRS security and privacy IRM standards and regulations for the use and 

protection of PII. 

The impact or likely impact of RRP data mining activities on privacy and 

civil liberties of individuals is governed by 26 U.S.C. § 6103, which provides 

general rules of maintaining confidentiality and permissible disclosures. Under 

this statute, all taxpayer data are private and confidential and protected from 

disclosure except under specific conditions. Additional laws provide for civil 

and criminal penalties for any unauthorized disclosure of taxpayer data. The 

penalties include (1) felony for the willful unauthorized disclosure of tax 

information, (2) misdemeanor for the unauthorized inspection of tax 

information, and (3) civil cause of action for the taxpayer whose information has 

been inspected or disclosed in a manner not authorized by Section 6103. The CI 

special agents receive periodic training on maximum sentencing and penalties 

for each criminal violation. Access to the system requires a background check. 

IRS has a system, Online 5081, that governs program access authorization. 

RRP data mining activities, including machine learning and scoring 

processes, do not directly use PII in determining whether a return is likely to be 
44

fraudulent. Scoring occurs on the characteristics of the return in question, not on 

PII. When performing investigative techniques, PII associated with the return is 

pulled to assist in validating the return was filed using the taxpayer account in 

question and to determine venue of the investigation. 

The tax returns that IRS-CI reviews are the subjects of criminal 

investigations and actions based on tax laws, policies, and criminal procedures. 

Other tax returns are subjected to IRS civil treatments and examination 

procedures that provide for due process and redress procedures through 

taxpayer notification, appeals, and tax court options. 

(F) A list and analysis of the laws and regulations that govern the 

information being collected, reviewed, gathered, analyzed, or used in 

the data mining activity.

The use of all tax data is governed by 26 U.S.C. § 6103. Subsection (a) 

sets out the general rule of confidentiality. Subsection (b) sets forth definitions 

of terms commonly used throughout Section 6103. Subsections (c) through (o) 

of Section 6103 contain exceptions to the general rule of confidentiality. These 

subsections permit disclosures as described generally below: 

• Section 6103(c) – Disclosures to taxpayer’s designees (consent);

• Section 6103(d) – Disclosures to state tax officials and certain state and local 

law enforcement agencies; 

• Section 6103(e) – Disclosures to the taxpayer and persons having a material 

interest; 

• Section 6103(f) – Disclosures to certain committees of Congress; 

• Section 6103(g) – Disclosures to the President and certain other persons; 

• Section 6103(h) – Disclosures to Federal employees and the courts for tax 

administration purposes; 

• Section 6103(i) – Disclosures to Federal employees for non-tax criminal law 

enforcement purposes and to combat terrorism, as well as the Government 

Accountability Office; 

• Section 6103(j) – Disclosures for statistical purposes; 

• Section 6103(k) – Disclosures for certain miscellaneous tax administration 

purposes; 

• Section 6103(l) – Disclosures for purposes other than tax administration; 

• Section 6103(m) – Disclosures of taxpayer identity information (generally for 

Federal debt collection purposes); 

• Section 6103(n) – Disclosures to contractors for tax administration purposes; 

and 

• Section 6103(o) – Disclosures with respect to certain taxes. 

In addition to disclosures permitted under the provisions of Section 6103, 

other provisions of the Code also authorize disclosure of tax information. For 

example, Section 6104 authorizes disclosure of certain tax information regarding 

tax-exempt organizations, trusts claiming charitable deductions, and qualified 
45

pension plans. Section 6110 authorizes disclosure of certain written 

determinations and their background files. 

Note: The use of Bank Secrecy Act data is governed by 31 U.S.C. § 

5319.

(G)A thorough discussion of the policies, procedures, and guidelines that 

are in place or that are to be developed and applied in the use of such 

data mining activity in order to: 

(i) protect the privacy and due process rights of individuals, such as redress 

procedures.

All tax information is protected as required in 26 U.S.C. § 6103 (see E 

and F above). All employees who interact with tax return and other protected 

information are required to undergo yearly refresher training that details their 

responsibilities with respect to information protection and disclosure. In 

addition to covering 26 U.S.C. § 6103 disclosure provisions, this training 

module also includes information on the Privacy Act, E-Government Act, 

Freedom of Information Act, and policies related to protecting PII and other 

sensitive information. The use of BSA information is strictly controlled under 

the statute that directs its collection. 

The data resulting from queries or statistical analysis in IDEA, LCA, 

and CDW are used as a lead or as insights for actionable decisions and requires 

additional investigative steps to verify the quality of the information, as 

discussed above. IRS maintains an audit trail on all users’ access to case data. 

In addition, a full system log is maintained for any system level activities, 

including new data loads to IDEA, LCA, and CDW systems. 

RRP does not determine whether a return is fraudulent or whether a 

person is going to be subject to criminal prosecution. Once fraud is suspected, 

laws and administrative procedures, policies, and controls govern criminal 

investigations or any other ensuing actions. Due process is provided during any 

ensuing criminal investigation or civil action. 

(ii) ensure that only accurate and complete information is 

collected, reviewed, analyzed, or used and guard against any 

harmful consequences of potential inaccuracies. 

An individual/entity self-reports tax data when submitting the information to the 

government. FinCEN’s data are gathered from information compiled by the reporter based 

on information provided by their customer or based on the reporter’s personal experience. 

Investigators scrutinize the Suspicious Activity Reports filed by the subject companies and 

request grand jury subpoenas for the underlying documentation. The supporting records are 

examined, and individuals of interest are identified. 

IDEA, LCA, and CDW use data for investigative or research purposes 
46

under the IRS Internal Revenue Manual (IRM) standards and guideline. The 

data resulting from query searches is used as a lead or as insights for actionable 

decisions and requires additional investigative steps to verify the quality of the 

information. CI and RAAS use this data for generating leads and other datadriven insights that are subsequently verified by special agents or research 

analysts for further investigative or analytical work. 

CDW implements a standard set of rules during the extract, 

transformation, and load (ETL) process to ensure that data collected from 

authoritative systems is accurately replicated for research purposes. These 

include, but are not limited to, ensuring accurate row counts, identifying 

duplicate rows, applying consistent data types and database indexes, and 

standardizing common geographic attributes across database tables. 

The tax return information and other information stored in RRP used 

for data mining are based on outside data sources. The only data generated in 

RRP is for system monitoring and diagnostics. Through a series of test case 

procedures executed through application qualification testing (AQT), systems 

acceptability testing (SAT), and final integration test (FIT), the IRS verifies 

that the data loaded into RRP matches the data from the input source and that 

the system accurately displays the data in the RRP end user applications. 

AQT, SAT, and FIT perform verification with each release of the system. IRS 

applications are required to have internal auditing capabilities. The internal 

audits track user access and queries performed with checks against misuse. 
47

Combined Reports Conclusion

The Department of the Treasury is pleased to provide to Congress its 

Annual Privacy, Section 803 Report, and Data Mining Report, for Fiscal Year 

2020. Treasury, Office of Privacy, Transparency, and Records has reviewed the 

activities and programs described in this combined report and will continue to 

work closely with all Treasury bureaus and offices to protect individual privacy 

and civil liberties in all agency activities. 

Ryan Law 

Deputy Assistant Secretary 

Office of Privacy, Transparency, and Records 

U.S. Department of the Treasury 
48

Appendix A: Department of the Treasury 

Semiannual Report on Privacy and Civil 

Liberties Activities under Section 803 of the 9/11 

Commission Act of 2007 April 1, 2020 through 

September 30, 2020 

Reviews Advice and Response Complaints 

Type Number Type Number 

Response 

(Pending/ 

Accepted/

in 

Process) 

Type of claim or 

assertion in 

complaint 

# of complaints Disposition 

Privacy (and Civil 

Liberties) Threshold 

Analyses 

(PTAs/PCLTAs) 

29

Provide advice and 

recommendation regarding 

proper handling of 

PII/limiting access based 

on need to know 

32 31 Accepted 

1 In Process 

 MINT Internal: 1 

 IRS Internal: 1 

 IRS External: 1 

 BEP External: 1 

MINT: 

Reported to DASPTR 

IRS: 

Addressed/Closed-No 

further activity or 

inquiry from 

complainant. 

IRS: 

Closed letter sent to 

taxpayer explaining 

plan and progress on 

masking SSNs on IRS 

notices 

BEP: Open 

PRIVACY: 

Unauthorized 

disclosure 

(internal/ 

external) 

Privacy (and Civil 

Liberties) Impact 

Assessments 

(PIAs/PCLIAs) 

15

Provide advice and 

recommendation on 

relevance and necessity of 

data collection/ingestion 13 Accepted 

PRIVACY: 

(Other 

Describe) 

2

MINT: Ongoing 

System of Records (SOR) 

Routine Use/ SOR 

Notices (SORNs) 3

Provided guidance to 

system owners or 

personnel on necessary 

privacy compliance 

documentation or 

appropriate NIST risk 

rating 

9

8 Accepted 

1 In Process 

PRIVACY: 

(Other 

Describe) 

0

Computer Matching 

Agreements (CMAs) 61

Provide advice and 

recommendation on 

internal/external sharing of 

PII (including Privacy Act 

info) 

14 13 Accepted 

1 In Process 

CIVIL LIBERTIES:

Violation 1

st

, 4

th

, 5

th

, 

6

th

, 14

th

 and/or 16

th

Amendment rights

(# of 

complaints/amendme

nts alleged to have 

been violated) 

38

IRS (20):

Pending final 

decision 

IRS (16): 

Resolved in favor 

of the Government. 

MINT (1): 

Grievance settled. 
49

Section 509 Internet Website 

Scan 

MINT 

(Internet): 

97% 

MINT 

(Intranet): 

40% 

Provide advice and 

recommendation on web 

privacy policies/privacy 

notices 10

8 Accepted 

2 In Process 

CIVIL 

LIBERTIES: 

(Other: 

Describe) 

0