A privacy breach at the IRS: Taxpayer data wrongly shared with DHS, court filing says

The IRS inadvertently disclosed thousands of taxpayers’ private information to the Department of Homeland Security as part of a controversial data-sharing agreement aimed at identifying and deporting undocumented immigrants, according to a new court filing.

The disclosure was revealed in a declaration filed Wednesday by IRS Chief Risk and Control Officer Dottie Romo, who stated that the tax agency was only able to verify about 47,000 of the 1.28 million names that U.S. Immigration and Customs Enforcement (ICE) had submitted for cross-verification. For less than 5% of those individuals—amounting to potentially thousands of people—the IRS improperly provided ICE with additional address information that may have violated federal privacy protections for taxpayer data.

The data-sharing arrangement stems from an agreement signed last April by Treasury Secretary Scott Bessent and Homeland Security Secretary Kristi Noem. The agreement allowed ICE to submit names and addresses of suspected undocumented immigrants to the IRS for verification against tax records.

According to Romo’s filing, Treasury notified DHS in January about the error and requested assistance in “promptly taking steps to remediate the matter consistent with federal law.” This includes the “appropriate disposal of any data provided to ICE by IRS based on incomplete or insufficient address information.”

The revelation has intensified concerns among privacy and immigrant rights advocates who have been fighting the agreement since its inception. Public Citizen filed a lawsuit against both federal departments shortly after the agreement was signed last year, representing several immigrant rights organizations.

“This breach of confidential information was part of the reason we filed our lawsuit in the first place,” said Lisa Gilbert, co-president of Public Citizen. “Sharing this private taxpayer data creates chaos and, as we’ve seen this past year, if federal agents use this private information to track down individuals, it can endanger lives.”

Legal challenges to the data-sharing agreement have already yielded some results. Last November, a federal court blocked the IRS from sharing information with DHS, ruling that the tax agency had illegally disseminated tax data of some migrants during the summer. More recently, a Massachusetts federal court specifically ordered the IRS to stop sharing residential addresses with ICE.

The information-sharing agreement has been particularly controversial because it appears to conflict with longstanding legal protections for taxpayer information. Tax privacy laws were designed to encourage compliance with tax obligations regardless of immigration status, with strict limitations on how the IRS can share taxpayer data with other government agencies.

Tom Bowman, policy counsel for the Center for Democracy & Technology, emphasized the significance of the breach, stating that “the improper sharing of taxpayer data is unsafe, unlawful, and subject to serious criminal penalties.”

“Once taxpayer data is opened to immigration enforcement, mistakes are inevitable and the consequences fall on innocent people,” Bowman added. “The disclosure of thousands of confidential records unfortunately shows precisely why strict legal firewalls exist and have—until now—been treated as an important guardrail.”

The scale of the error is substantial within the context of the program. While ICE submitted 1.28 million names for verification, the IRS was only able to confirm matches for about 47,000 individuals—less than 4% of those submitted. This suggests significant challenges in the data matching process itself, raising further questions about the program’s efficacy and precision.

The IRS did not respond to requests for comment from the Associated Press, which initially reported on the court filing after The Washington Post broke the story.

The incident highlights the ongoing tension between immigration enforcement priorities and taxpayer privacy protections, a balance that courts are actively examining as litigation surrounding the data-sharing agreement continues.