I. Executive Summary

The Treasury Department and the IRS are sensitive to the data security problems facing organizations, their employees and their customers and, as a result, have provided some welcomed taxpayer-favorable assistance. Specifically, the IRS will not assert that an individual must include in gross income the value of identity protection services provided by an organization to which the individual provided personal information (e.g., name, social security number (SSNs), or banking or credit account numbers), nor will the IRS assert that the value of such services must be included as wages or is otherwise reportable on an IRS Form W-2 or 1099-MISC.

II. Data Security Breaches

Data security is a major concern for all organizations, and for good reason. One study estimated that, in 2012, over 16 million individuals (or 7 percent of all U.S. residents) were victims of identity theft. Another study estimated that, in 2014, the average cost of a data breach to a large organization was approximately $5.9M. In California alone, between 2012 through 2015, approximately 557 data breaches were reported, affecting nearly 50 million records. Even the Federal government is not immune to these attacks – as the IRS recently reported that over 720,000 SSNs and other sensitive information may have been stolen from its database. The data most commonly involved in these breaches includes driver license numbers, medical information, credit/debit card data, banking information and SSNs. In short, the stakes are high as the likelihood that a data breach will impact your organization is material, and the resulting cost to you, your employees and your customers could be significant.

An increased number of organizations are taking heightened efforts to prevent breaches. Some continue to use traditional information technology security features – such as firewalls and antivirus software – while other organizations are making security decisions based on a belief that a data breach is inevitable. As a result, to help detect the potential occurrence of a breach in their information systems and to minimize the impact to their operations, certain of these latter organizations are providing identity protection services to those potentially impacted before a data breach occurs.

III. Federal Income Tax Treatment of Certain Data Protection Services

In general, absent any special rules to the contrary, an individual receiving data protection services from a third party would be left to determine whether the value of such services was includable in gross income. Although arguments exist for excluding such amounts from income (e.g., in the case of an employee, it is possible that the provision of identity protection services could be considered a “working condition fringe” under certain circumstances), absent guidance from the government, there is still a risk that amounts paid to employees would be treated as wages (reportable by the employer on IRS Form W-2) and amounts paid to customers would be treated as ordinary income (reportable by the organization providing the value of such service on IRS Form 1099-MISC).

Fortunately for all involved, the Treasury Department and the IRS have provided taxpayer-favorable guidance. In August, 2015, the IRS issued Announcement 2015-22, which provided that, in the case of a data breach, the IRS would not assert either (i) that an individual whose personal information may have been compromised in a data breach must include in gross income, whether as wages or otherwise, the value of the identity protection services provided by the organization that experienced the breach or (ii) that the value of such services must be reported by the organization on IRS Form W-2 or IRS Form 1099-MISC.

More recently, after receiving comments from the public, the IRS issued Announcement 2016-02, in which it extended Announcement 2015-22 to include data protection services provided before a data breach occurs. Accordingly, the IRS will not assert that an individual must include in gross income the value of identity protection services provided by an organization to which the individual provided personal information (e.g., name, SSN or banking or credit account numbers), nor will the IRS assert that the value of such services must be included as wages or is otherwise reportable on an IRS Form W-2 or IRS Form 1099-MISC.

The guidance does not, however, apply to (i) cash received in lieu of identity protection services or (ii) proceeds received pursuant to an identity theft insurance policy, which is governed by other provisions of the law.

Although IRS announcements do not carry the same weight as Internal Revenue Code statutes or Income Tax Regulations, and do not go so far as to exclude the value of identity protection services from the statutory definition of gross income, from a practical perspective taxpayers are not required to include such value in gross income for federal income tax purposes. Now, the only open inquiry is whether states may take a different position for state income tax purposes as states are not bound by IRS announcements.

All too often federal tax laws do not keep up with technological advances. However, in this situation, as data breaches continue, and as organizations pay for identity theft protection services for their employees and customers in preparation of, and following, a data breach, the Treasury Department’s and IRS’ position on these issues are welcomed news to the public that will hopefully be followed by states.