What changed between these versions
A substantive narrowing of data access and a shift in authority. v3 removes provisions that would have granted the Treasury direct access to specific IRS and Social Security Administration data for the Do Not Pay system and deletes the entire section on Treasury data access. It also shifts lead responsibility for certain regulations and guidance from the Secretary of the Treasury to the Director of the Office of Management and Budget, while extending some implementation deadlines.
Overview
A handful of significant changes, primarily focused on data access and administrative authority, alongside several minor clarifications. · The overall direction of v3 is a narrowing of the Do Not Pay system's direct data access capabilities and a shift in administrative oversight for certain aspects, while also extending some implementation timelines.
The most significant change in v3 is the complete deletion of Section 5 from v2, which would have granted the Treasury Department direct access to specific IRS tax information and Social Security Administration data for the Do Not Pay system. Additionally, v3 removes specific IRS and SSA data assets from the list of data the Do Not Pay system is mandated to access. Several modifications within the Do Not Pay system's operational provisions shift lead responsibility for issuing regulations and guidance from the Secretary of the Treasury to the Director of the Office of Management and Budget and extend implementation deadlines. The core requirements for agencies regarding pre-payment fraud prevention and the single report on first-time use of funds remain unchanged.
Deletions
These paragraphs mandated that the Secretary of the Treasury have access to information made available pursuant to a request under section 6103(i)(9)(A) of the Internal Revenue Code of 1986 and information made available by the Commissioner of Social Security pursuant to section 235 of the Social Security Act.
The deletion removes the explicit mandate for the Do Not Pay system to access these specific data assets from the IRS and SSA, which were intended to enhance fraud prevention and improper payment identification. This directly impacts the data sources available to the system.
This section contained two main parts: (a) amendments to Section 6103(i) of the Internal Revenue Code of 1986 to allow the Secretary of the Treasury to disclose limited return information (taxpayer identity, identity theft related to TIN) to the Do Not Pay system for improper payment prevention, and (b) amendments to Title II of the Social Security Act to require the Commissioner of Social Security to enter an agreement with the Treasury to confirm the validity of names and social security account numbers for the Do Not Pay system.
This deletion significantly narrows the scope of data access for the Do Not Pay system. It removes the statutory authority for the Treasury to obtain specific tax and Social Security information directly from the IRS and SSA, which would have been critical for verifying payee identities and preventing fraud. This reduces the system's ability to cross-reference sensitive but highly relevant data points.
Modifications
This change refines the legal and procedural language around how data assets are managed and shared within the Do Not Pay system, emphasizing disclosure from the system rather than access to it, which could have implications for privacy and data governance.
Before
Stated that the Secretary shall publish a System of Records Notice identifying data assets, the routine use authority under which they are accessed, and that a data asset may not be accessed before publication of applicable routine use.
After
Clarifies that the System of Records Notice identifies 'routine uses under which the data asset is disclosed from that system of record', and that a data asset may not be 'disclosed from' the Do Not Pay system before publication of the applicable routine uses.
This modification introduces a requirement for the Secretary to consult with the Director of OMB when designating new data assets, thereby sharing authority. It also refines the criteria for designation, potentially narrowing the scope of what can be added by requiring a substantial assistance to agency requirements.
Before
Allowed the Secretary to designate additional categories of data assets for inclusion in the Do Not Pay system to address risks of fraud and improper payments.
After
Requires the Secretary to act 'in consultation with the Director' when designating additional categories of data assets and specifies the purpose as 'that substantially assist agencies in carrying out the requirements of paragraph (1)' (preventing and recovering improper payments, preventing financial fraud).
This change shortens the timeframe for public input on the designation of sensitive data assets, potentially accelerating the process but reducing the window for public and stakeholder review.
Before
Required public notice and an opportunity for comment for not less than 30 days prior to designating data assets that include personally identifiable or law enforcement sensitive information.
After
Reduces the required public notice and comment period for such designations to 'not less than 15 days'.
This modification provides a more precise definition of what constitutes 'non-sensitive' data for the purpose of discretionary inclusion in the Do Not Pay system, ensuring consistency with Privacy Act requirements.
Before
Stated that data assets that do not include personally identifiable or law enforcement sensitive information may be added at the discretion of the Secretary without designation.
After
Clarifies the exclusion criteria by adding 'or information subject to section 552a of title 5' to the list of types of information that, if not included, allow for discretionary addition of data assets.
These changes reinforce the strict limitations on data handling within the Do Not Pay system, explicitly addressing data retention and making the prohibition on unauthorized access more definitive, which could enhance privacy protections.
Before
Stated that the Do Not Pay system provides match-based queries with minimum data exchanged, and individuals may not retrieve underlying records beyond what's necessary.
After
Clarifies that the system exchanges and 'retains' the minimum data necessary to conduct the verification match and any associated responsibility under section 552a(p) of title 5. It also changes 'any individual described in subparagraph (A) may not retrieve' to 'any individual described in subparagraph (A) is prohibited from retrieving'.
This modification transfers primary responsibility for establishing privacy and other requirements for State and local government access to the Do Not Pay system from the Treasury Secretary to the OMB Director, potentially centralizing oversight of privacy aspects under OMB.
Before
Stated that the Secretary, in consultation with the Director, shall issue regulations for State and other governmental use of the Do Not Pay system.
After
Shifts the lead responsibility to 'The Director, in coordination with the Secretary,' for issuing these regulations.
This change adds a consultation requirement with the OMB Director for the quarterly reports, ensuring broader executive branch input, and clarifies that the reports should cover the system's governmentwide operation, enhancing oversight.
Before
Stated that the Secretary shall submit quarterly reports on the operation of the Do Not Pay system.
After
Requires the Secretary to submit reports 'in consultation with the Director' and specifies the reports are 'on the governmentwide operation of the Do Not Pay system'.
This modification extends the deadline for establishing the computer matching agreement template, providing more time for development, and shifts the lead responsibility to the OMB Director, centralizing the development of this standardized process.
Before
Required the Secretary of the Treasury, in consultation with the Director, to establish a standard computer matching agreement template not later than 90 days after the effective date.
After
Changes the deadline to 'Not later than 180 days' and shifts lead responsibility to 'the Director, in coordination with the Secretary of the Treasury'.
This change extends the deadline for OMB guidance, allowing more time for comprehensive development, and explicitly requires the guidance to include the computer matching agreement template, ensuring its integration into broader policy.
Before
Required the Director, in consultation with the Secretary, to issue guidance to implement this paragraph not later than 60 days after the effective date.
After
Changes the deadline to 'Not later than 180 days' and adds 'including the computer matching agreement template' to the guidance requirements.
Scope
Meaningful expansion or narrowing — Changes are concentrated within Section 3, which details the Treasury Do Not Pay System, and involve the complete removal of a separate section (original Section 5). — Yes, v3 represents a meaningful narrowing of the policy direction regarding the Do Not Pay system's direct access to sensitive data from the IRS and SSA. It also shifts some administrative authority for implementation and oversight. — The deletion of Section 5 from v2 removes the statutory basis for the Do Not Pay system to access specific IRS and SSA data, directly impacting the data assets mentioned in Section 3(a)(2) of v2. The shifts in authority between the Secretary and the Director for various regulations and guidance also interact with the overall administrative framework for the Do Not Pay system.
Impact analysis
The Department of the Treasury (specifically the Fiscal Service operating the Do Not Pay system)
Loss of direct data access and associated tools for fraud prevention.
The Do Not Pay system will no longer have explicit statutory authority to directly access specific IRS return information (taxpayer identity, identity theft related to TIN) or Social Security Administration information (name and SSN validation) as mandated in v2.
Executive agencies utilizing the Do Not Pay system for pre-award and pre-payment procedures
Reduced data resources for fraud prevention efforts.
These agencies will not benefit from the enhanced data verification capabilities that would have been provided by direct IRS and SSA data access through the Do Not Pay system, as envisioned in v2.
The Office of Management and Budget (OMB) Director
Increased authority and responsibility.
The Director gains increased lead responsibility and consultation requirements for designating additional data assets, issuing privacy regulations for State/local government use, and establishing the standard computer matching agreement template and associated guidance.
The public and stakeholders providing comments on data asset designations
Reduced opportunity for public input.
The public notice and comment period for designating sensitive data assets is reduced from 30 days to 15 days.
Agencies and the Treasury responsible for implementing the expedited computer matching process
Extended implementation timelines.
The deadlines for establishing the standard computer matching agreement template and issuing related OMB guidance are extended from 90/60 days to 180 days.