AUDIT: Potential for Tax Data Abuse at Minn. Agency

Updated: 03/31/2013 3:03 PM KSTP.com By: Stephen Tellier

The safety of your personal information has been a hot topic in Minnesota recently.

Earlier this year, a state worker at the Department of Natural Resources illegally accessed the private driver's license information of more than 7,000 Minnesotans.
 
Now, with the April 15 filing deadline just a couple weeks away, how secure is your tax data after you submit it to the state?
 
Auditors found that overall, the Minnesota Department of Revenue is doing a good job of protecting the security of your tax return. But they also found dozens of state employees who had access to tax information and never should have.
 
"Taxpayer security is a top priority at the Department of Revenue," said Matt Massman, deputy commissioner at the DOR.
 
The complete audit report can be found here.
 
And while a recent audit did not find any evidence of abuse at the DOR, it did find the potential for abuse.
 
"Whenever an employee has access that they don't need to do their job, there is an increased risk that something could go wrong," said Cecile Ferkul, deputy legislative auditor at the Office of the Legislative Auditor.
 
The audit found, "The Department of Revenue had not implemented adequate controls to prevent and detect some inappropriate access to servers and databases supporting GenTax," the state's tax processing system.
 
Auditors found the DOR had delayed removing 34 users who had network access. It also found that four employees were allowed inappropriate access, and five had unnecessary privileges.
 
That access, the audit report states, "could negatively impact GenTax's operations and affect the integrity and confidentiality of its underlying data," also known as your tax information.
 
But Massman is quick to point out that just because a worker has access doesn't mean they used it.
 
"The auditor did not find that any employees had done anything inappropriate," Massman said.
 
Still, auditors told the state how to fix the issues, and Massman said they're on it.
 
"We have intentions of implementing all of those recommendations as early as we can," Massman said.
 
Massman said the DOR is now strengthening its own policies and procedures as a result of that audit. But he stressed that the department already has extensive training for all employees, a code of conduct, and their own internal auditor, to make sure taxpayer data is never accessed inappropriately.