The IRS has expanded upon its prior position and announced that employers are permitted to provide identity protection services to their employees before a data breach occurs and without treating such services as income.  IRS Announcement 2016-02.  In the IRS’ prior announcement issued in August 2015, the IRS stated that employers could pay for employees’ identity protection services after their information was compromised in a data breach without the value of such services needing to be included in employees’ gross income.  The 2015 Announcement went on, however, to solicit comments regarding whether organizations commonly provide identity protection services in situations other than as a result of a data breach, and whether additional guidance would be helpful in clarifying the tax treatment of the services provided in those situations.   

The comments received by the IRS in response to this inquiry included statistics that show the significant increase in the number of data breaches that result in unauthorized access to information systems containing personal information of employees and other individuals.  According to the comments and as some of us already knew, “despite heightened efforts by organizations to prevent data breaches using traditional information technology security features…, some organizations are making security decisions based on the belief that breaches are … inevitable.”  As a result, commenters shared with the IRS that they are now beginning to utilize identity protection services provided to employees and other individuals as a way to help detect any occurrence of a breach in their information systems and to minimize the impact to their operations.

As a result of these comments, the IRS has expanded its prior position and decided to treat identity protection services as non-income, regardless of whether it is being offered in conjunction with a known data breach.  Notably, both announcements go beyond employees and include “other individuals,” thus suggesting that this position may also apply beyond the employer-employee relationship.  The Announcement is not without limits, however.  It clarifies that this tax treatment does not apply to cash received in lieu of identity protection services or for proceeds received under an identity theft insurance policy, which are both governed by existing law.

This is good news for both employers and employees.  Employees may soon begin to see more and more employers offering free identity protection services as an additional benefit of employment.  Employers now have a tax-free tool at their disposal to not only compensate employees, but also to bolster their cybersecurity efforts to detect data breaches sooner.  This announcement is also noteworthy because it expresses the growing shift in the way organizations and the government view cybersecurity.  Given the rampant nature of data breaches, society is beginning to view data breaches as a “when” not “if” proposition.  This also exemplifies the growing shift in the way data security is approached to not only focus on prevention, but also early detection of incidents.  To keep with this trend, it is crucial that organizations and the government continue to focus on both aspects of cybersecurity to not only avoid unnecessary breaches, but also to mitigate the damage and exposure of breaches that are likely to occur.  Coupled with early detection, organizations are also wise to continue developing systems and procedures to rapidly respond to breaches when they occur.