13 January 2016 Tax-free status of identity protection services now applies even before a data breach occurs In Announcement 2016-02, the IRS expands on its guidance in Announcement 2015-22 by stating that the value of identity protection services is also excluded from taxable income when provided to individuals before a data breach occurs. As we previously reported (Tax Alert 2015-1614), in August 2015, the IRS announced (Announcement 2015-22) it will not assert that (1) an individual whose personal information may have been compromised in a data breach must include in income the value of identity protection services provided by the organization that experienced the data breach, or (2) an employer must include in employees' gross income and wages the value of any identity protection services the employer provides to its employees after a data beach. Public comments on Announcement 2015-22 led the IRS to extend its position and clarify that identity protection services that an employer provides before any breach occurs will also not be considered taxable income to the employee. The IRS received several comments indicating that data breaches and security have become a significant concern, to the extent that "some organizations are making security decisions based on the belief that breaches of their information systems are inevitable" and "an increasing number of organizations are combating data breaches by providing identity protection services to employees or other individuals before a data breach occurs." Announcement 2016-02 will not apply to cash received in place of identity protection services or to proceeds received under an identity theft insurance policy. The IRS cautions that the exclusion from gross taxable income doesn't apply to cash in lieu of identity protection services or when identity protection services are provided for reasons other than a data breach (e.g., given in connection with an employee's compensation benefit package).
Document ID: 2016-0086 | ||||||||||||||||||||
