Electronic Enterprise Fax (EEFAX), Privacy and Civil Liberties Impact Assessment (Date of Approval: 06/05/2025) (IRS)
Summary
A Privacy and Civil Liberties Impact Assessment by the Internal Revenue Service for the Electronic Enterprise Fax (EEFAX) system, Questionnaire Number 1933, with a Date of Approval of 06/05/2025. It describes EEFax as a fax utility that lets IRS employees, taxpayers and taxpayer representatives send, receive, store, review and work fax documents from their computers. It states that the system handles Personally Identifiable Information and Federal Tax Information as image files with no data parsed or extracted, that inbound faxes are delivered to a printer, SharePoint, file storage or a mailbox, and that activity logs sit in a JobTrack database on SQL servers. It answers that the system uses no artificial intelligence or cloud computing, interacts with the public, and relies on the consent individuals give when filing tax returns.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
Date of Approval: 06/05/2025
Questionnaire Number: 1933
Basic Information/Executive Summary
What is the name of your project (system, database, pilot, product, survey, social media
site, etc.)?
Electronic Enterprise Fax
Acronym:
EEFAX
Business Unit
Information Technology
Preparer
# For Official Use Only
Subject Matter Expert
# For Official Use Only
Program Manager
# For Official Use Only
Designated Executive Representative
# For Official Use Only
Executive Sponsor
# For Official Use Only
Executive Summary: Provide a clear and concise description of your project and how it
will allow the IRS to achieve its mission.
The Electronic Enterprise Fax (EEFax) system acts as a “fax utility” or service
and provides the fax handling infrastructure for the IRS. EEFax allows IRS
employees, taxpayers and taxpayer representatives (referred to from here on as
“TP”) to send, receive, store, review and work a “fax document” from their
computers. It handles faxes inbound to the IRS and outbound to TPs. EEFax may
use a unique telephone number or barcode provided to the TP for electronic
delivery to the correct IRS recipient. This service provides many benefits to the
IRS, including +Increased employee efficiencies through eliminating: --the
amount of time walking to and from physical printers and fax machines, --
eliminating an employee sorting through a pile of paper faxes at the physical fax
machine, which will also reduce disclosure errors, and --reducing reliance on
paper records. +More efficient use of technology by reducing --the unintentional
storage of faxes at the machine, --telecommunications costs, and --reliance on
paper records. +EEFax is projected to provide services for the entire enterprise
and handle approximately 20M million fax pages per month. This will provide a
substantial cost savings by eliminating standalone fax hardware and its use of
consumables such as paper, and ink/toner.
Personally Identifiable Information (PII)
Will this project use, collect, receive, display, store, maintain, or disseminate any type of
Sensitive but Unclassified (SBU), Personally Identifiable Information (PII), or Federal
Tax Information (FTI)?
Yes
Please explain in detail how this project uses sensitive data from inception to destruction
(data lifecycle).
EEFax electronically sends and receives facsimiles using the same fax protocols
as on a traditional facsimile machine. Fax documents are handled as image files,
and no data is parsed or extracted from the fax files. On the IRS end, EEFax
traffic is handled through the Microsoft Outlook Exchange environment. When
faxes are received, they are delivered to 1) High-speed printer, 2) SharePoint
Uniform Resource Locator (URL), 3) Universal Naming Convention (UNC) File
Storage, 4) Individual or 5) Organizational mailbox. Inbound faxes are retained
for one of two periods. First, faxes destined for a high-speed printer are retained
for a period of five days so faxes may be reprinted in case there is a printer
malfunction. Second, for the other four destinations, faxes are stored only long
enough for the system to verify delivery. Outbound faxes are sent unencrypted
without a digital signature and are also retained only long enough for the system
to verify delivery. EEFax will maintain employee Standard Employer IDentifier
(SEID) and e-mail address information in the activity logs to track provide audit
trails on all fax activity. No TP PII or sensitive information is contained in the
audit logs. They are stored in the JobTrack database within SQL servers in
EEFax. Logs are available to be searched, analyzed and audited. Audit logs are
also kept for users with administrator level access (Enterprise Operations) to
EEFax Servers. All audit logs are sent to Splunk.
Please select all types of Sensitive but Unclassified data (SBU)/Personally Identifiable
Information (PII)/Federal Tax Information (FTI) that this project uses.
Address
Bar Codes
Centralized Authorization File (CAF)
Citizenship or Migration Status
Credit Card Number
Document Locator Number (DLN)
Driver's License Number
Education Information
Email Address
Employer Identification Number
Employment Information
Family Members
Federal Tax Information (FTI)
Financial Account Number
Geographical Indicators
Global Intermediary Identification Number (GIIN)
Individual Taxpayer Identification Number (ITIN)
Language
Medical History/Information
Name
Non-Tax Proprietary data
Official Use Only (OUO) or Limited Office Use (LOU)
Online Identifiers
Passport Number
Patient Number
Personal Characteristics
Photograph
Preparer Taxpayer Identification Number (PTIN)
Professional License Number
Protected Information
Social Security Number (including masked or last four digits)
Standard Employee Identifier (SEID)
Tax ID Number
Telephone Numbers
Universal Unique Identifier (UUID)
Vehicle Identification Number (VIN)
Cite the authority for collecting SBU/PII/FTI (including SSN if relevant).
PII for federal tax administration - generally IRC Sections 6001 6011 or 6012
PII for personnel administration - 5 USC
SSN for personnel administration IRS employees - 5 USC and Executive Order
9397
SSN for tax returns and return information - IRC section 6109
Product Information (Questions)
1 Is this PCLIA a result of the Inflation Reduction Act (IRA)?
No
2 What type of project is this (system, project, application, database, pilot/proof of
concept/prototype, power platform/visualization tool)?
System
3 What Tier designation has been applied to your system?
2
4 Is this a new system?
No
4.1 Is there a previous Privacy and Civil Liberties Impact Assessment (PCLIA) for this
project?
Yes
4.11 What is the previous PCLIA number?
6791
4.12 What is the previous PCLIA title (system name)?
Electronic Enterprise Fax, EEFax, EEFAX
4.2 You have indicated this is not a new system; explain what has or will change and
why. (Expiring PCLIA, changes to the PII or use of the PII, etc.)
Expiring PCLIA
5 Is this system considered a child system/application to another (parent) system?
No
6 Indicate what OneSDLC State is the system in (Allocation, Readiness, Execution) or
indicate if you go through Information Technology's (IT) Technical Insertion Process and
what stage you have progressed to.
Execution
7 Is this a change resulting from the OneSDLC process?
No
8 Please provide the full name and acronym of the governance board or Executive
Steering Committee (ESC) this system reports to.
User and Network Services (UNS) Executive Steering Committee
9 If the system is on the As-Built-Architecture (ABA), what is the ABA ID number of the
system? If this PCLIA covers multiple applications shown on the ABA, please indicate
the ABA ID number(s) for each application covered separated by a comma. If the system
is not in the ABA, then contact the ABA (https://ea.web.irs.gov/aba/index.html) for
assistance.
211307
10 If this system discloses any PII to any third party outside the IRS, does the system
have a process in place to account for such disclosures in compliance with IRC
6103(p)(3)(A) or Subsection c of the Privacy Act?
No
11 Does your project/system involve any use of artificial intelligence (AI), including
virtual assistant, chat bot, and robotic process automation, as defined in Executive Order
13960 and 14110?
No
12 Does this system use cloud computing?
No
13 Does this system/application interact with the public?
Yes
13.1 If the system requires the user to authenticate, was a Digital Identity Risk
Assessment (DIRA) conducted?
No
13.11 Please upload the approved DIRA report using the Attachments button. Select
"Yes" to indicate that you have or will upload the signed DIRA form.
No
13.2 If individuals do not have the opportunity to give consent to collect their information
for a particular use, why not?
Individuals have given consent to collection of their information when filing tax
returns and/or during tax administration when EEFax would be used.
13.3 If the individual was not notified of the following items prior to the collection of
information, why not? 1) Authority to collect the information 2) If the collection is
mandatory or voluntary 3) The purpose for which their information will be used 4) Who
the information will be shared with 5) The effects, if any, if they don't provide the
requested information.
All facsimile data is transmitted (to IRS) to address specific taxpayer/entity
requirements, whether in response to direct IRS request (which details authority,
mandatory/voluntary nature, purpose, potential dissemination, and potential
effects), or via IRS published forms and/or directives (also detailing the same).
14 Describe the business process allowing an individual to access or correct their
information. (Due Process)
"Your Rights as a Taxpayer” explains the rights of the taxpayer, which includes
the right to challenge the IRS position and be heard; and the right to appeal an
IRS decision in an independent forum. EEFax is only a transmission method for a
taxpayer to submit data as requested by the IRS so if they wanted to correct their
submission, they can re-send the corrected form to the IRS. If the taxpayer wants
to correct this data, they would need to contact the requesting authority within the
IRS or use the procedure as described within the original request.
15 Is this system owned and/or operated by a contractor?
Yes, the contractors maintain the system.
15.1 If a contractor owns or operates the system, does the contractor use subcontractors;
or do you require multiple contractors to operate, test, and/or maintain this system?
No
16 Identify what role(s) the IRS and/or the contractor(s) performs; indicate what access
level (to this system's PII data) each role is entitled to. (Include details about completion
status and level of access of the contractor's background investigation was approved for.)
Users - Read Managers - Read
Administrators - Read & Write
Contractors - Read & Write / Access level - input Low / Background
Investigation Complete
17 The Privacy Act of 1974 (5 USC § 552a(e)(3)) requires each agency that maintains a
system of records, to inform each individual requested to supply information about
himself or herself. Please provide the Privacy Act Statement presented by your system or
indicate a Privacy Act Statement is not used and individuals are not given the opportunity
to consent to the collection of their PII.
The legal right to ask for information is Internal Revenue Code sections 6001,
6011, and 6012(a), and their regulations. These sections state that individuals
must file a return or statement with IRS for any tax for which they are liable, and
response is mandatory. Any privacy statements would be provided by the IRS
entity that is requesting the information on the applicable tax form.
18 How many records in the system are attributable to IRS Employees? Enter "Under
50,000", "50,000 to 100,000", "More than 100,000" or "Not Applicable".
More than 100,000
19 How many records in the system are attributable to contractors? Enter "Under 5,000",
"5,000 to 10,000", "More than 10,000" or "Not Applicable".
Not Applicable
20 How many records in the system are attributable to members of the public? Enter
"Under 100,000", "100,000 to 1,000,000", "More than 1,000,000" or "Not applicable".
More than 1,000,000
22 How is access to SBU/PII determined and by whom?
Users are provided access to the EEFax system through use of the Business
Entitlement Access Request System (BEARS) process. User requests are
approved by their managers, which are then routed to the EEFax Project
Management Office (PMO) queue for approval. The EEFax PMO determines
what resources the user needs access to and is annotated in the BEARS request.
Once approved by the EEFax PMO, the request is then routed to the EEFax
System Administrators, who in turn add the user's domain account information to
the EEFax system. Once a user no longer requires access to the system, the user
performs a BEARS DELETE request which is approved by the EEFax PMO and
routed to the EEFax System Administrators and the user’s access privileges are
removed. EEFax PMO employees and contractors have access to the EEFax
system database tables for running reports. EEFax PMO employees and
contractors obtain access by using the BEARS process. Employee and contractor
requests are approved by the EEFax PMO and then by their managers. When
access to the database tables is no longer needed, EEFax PMO employees and
contractors submit a BEARS DELETE request and access rights to the database
are removed.
23 Is there a data dictionary on file for this system? Note: Selecting "Yes" indicates an
upload to the Attachment Section is required.
Yes
24 Explain any privacy and civil liberties risks related to privacy controls.
There are no privacy and civil liberties risks related to privacy controls.
25 Please upload all privacy risk finding documents identified for the system (Audit trail,
RAFT, POA&M, Breach Plan, etc.); click "yes" to confirm upload(s) are complete.
No
26 Describe this system's audit trail in detail. Provide supporting documents.
There are advanced audit logs that are saved for each outgoing and incoming fax.
These audit logs are stored with the Job Track data base that is stored within
Structured Query Language (SQL) servers on the EEFax infrastructure. This data
is available to be searched, analyzed and audited but these logs do not contain any
PII or other sensitive information that would be subject to any other external
auditing systems as the data is not identifiable. There are user logs for users with
admin level access for Enterprise Operations (EOps) to the EEFax Servers that are
sent to Splunk.
The Job Track data captures all metadata associated with receiving the fax:
- Job ID - Unique key for the system
- Computer Name - ID of the Faxcom Server that received the fax
- Creation Date - The Greenwich Mean Time (GMT) date and time the fax was
received
- Status Value - The result of the fax reception
- Transmitting Station Identifier (TSI) - Phone number passed by the sending fax
- Caller ID - Phone number from Caller ID service
- Connect Time - Length of time the call is connected while the fax is sent
- Transfer Rate - Data transfer rate in baud, or symbols per second
- Fall Back - Boolean value, a logical data type having one or two values, true if
the final transfer rate is lower than the one originally negotiated
- Pages - Number of pages (including the cover) received as part of the fax
- Fax Port - Port number on which the fax is received
- Direct Inward Dial (DID) - Dial number that the fax sender dialed
- bActive - Boolean value, true until the fax has been delivered to its destination
- bError - Boolean value, true if any route were to fail.
27 Does this system use or plan to use SBU data in a non-production environment?
No
Interfaces
Interface Type
Forms
Agency Name
Analog Telephony System
Incoming/Outgoing
Both
Transfer Method
Enterprise Fax (eFax)
Interface Type
IRS Systems, file, or database
Agency Name
Enterprise File Storage (EFS)
Incoming/Outgoing
Outgoing (Sending)
Transfer Method
Electronic File Transfer Utility (EFTU)
Systems of Records Notices (SORNs)
SORN Number & Name
IRS 00.001 - Correspondence Files and Correspondence Control
Files
Describe the IRS use and relevance of this SORN.
The legal right to ask for information is Internal Revenue Code
sections 6001, 6011, and 6012(a), and their regulations. These
sections state that individuals must file a return or statement with
IRS for any tax for which they are liable, and response is
mandatory.
Records Retention
What is the Record Schedule System?
Non-Record
What type of Records is this for?
Electronic
Please provide a brief description of the chosen GRS or RCS item.
The system does not retain records
What is the disposition schedule?
Information is only (temporarily) stored for the purpose of
transmission and receipt.
Data Locations
What type of site is this?
System
What is the name of the System?
Splunk
Please provide a brief description of the System.
Splunk is an IRS system that pulls audit logs as it relates to server
operations.
What are the incoming connections to this System?
Splunk can pull audit logs further analysis
What are the outgoing connections from this System?
None
What type of site is this?
System
What is the name of the System?
JobTrack Database
Please provide a brief description of the System.
The JobTrack database collects and stores metadata from fax
transmissions but does not store any PII
What are the incoming connections to this System?
The EEFax system sends fax transmission and receipt metadata to
this system.
What type of site is this?
System
What is the name of the System?
Enterprise Electronic Fax
What is the sensitivity of the System?
Federal Tax Information (FTI)
Please provide a brief description of the System.
EEFax electronically sends and receives facsimiles. The
information that comes in sent and received on a traditional
facsimile machine is the same information that comes into EEFax
(i.e. the same fax protocols). No data is parsed or extracted from
the fax files. Possible information could include (but not limited
to) taxpayer information in the form of signature documents, tax
returns, and income verification requests. The files fax messages
are stored only long enough for the system to verify delivery to the
final destination. The only exceptions to this rule are faxes sent to
high-speed printers. Faxes destined for printing are retained for a
period of five days so faxes can be reprinted in case there is a
printer malfunction. When faxes are received, they are delivered to
High-Speed Printer(s), SharePoint Uniform Resource Locator
(URL), Universal Naming Convention (UNC) File Storage,
Individual or Organizational Mailbox. The majority of the EEFax
traffic is to and from the Exchange email environment. EEFax
messages delivered to Individual or Organizational mailboxes are
unencrypted. EEFax messages sent from Outlook clients are
unencrypted and without a digital signature. EEFax is projected to
provide services for the entire enterprise and handle approximately
20M fax pages per month. EEFax will maintain employee standard
employer identifier (SEID) and employee e-mail address
information in the activity logs to track audit trails on fax activity.
These audit logs are stored in the JobTrack data base that is stored
within SQL servers in EEFax. This data is available to be searched,
analyzed and audited but these logs do not contain any PII or other
sensitive information that would be subject to any other external
auditing systems as the data is not identifiable. There are user logs
for users with admin level access (EOPS) to the EEFax Servers
that are sent to SPLUNK.
What are the incoming connections to this System?
Analog Phone (via Public Switch Telephone Network (PSTN))
What are the outgoing connections from this System?
Analog Phone, VoIP, FoIP via PSTN
File and source
- File
- eefax-pia.pdf
- Size
- 126,773 bytes
- SHA-256
- ef4cabc53aab67c8644f283ec653e0dbfa1e37543610c76cc4cb52fd68f75aae
- Our copy
- eefax-pia.pdf
- Original
- www.irs.gov