701—5.10(17A,22,421,422) Personally identifiable information collected and stored by the department. The department collects and maintains both open records and confidential records that contain personally identifiable information. This rule describes the nature, extent, retrieval, storage, and processing of personally identifiable information within the department’s record systems.
	5.10(1) Nature and extent. All record systems maintained by the department may contain personally identifiable information concerning matters such as income, property holdings, exchanges, financial transactions, and demographic information such as address and number of dependents.
	5.10(2) Retrieval. Personal identifiers are used to retrieve information from any of the record systems that the department maintains that contain personally identifiable information.
	5.10(3) Means of storage. Paper, microform, and various electronic means of storage are used to store records containing personally identifiable information.
	5.10(4) Comparison. Electronic or manual data processing may be used to match, to collate, or to compare personally identifiable information in one system with personally identifiable information in another system of records or with personally identifiable information within the same system.
	5.10(5) Comparison with data from outside the department. Personally identifiable information in systems of records maintained by the department may be compared with information from outside the department when specified by law. Permitted comparisons include, but are not limited to, comparisons for the purpose of setoffs.
	5.10(6) Records containing personally identifiable information.
	a. 	Personally identifiable information is collected from documents, returns, and any other record filed with the department, as well as from outside sources, including state and federal agencies. Authority to collect this information is found throughout Iowa Code chapters 8A and 17A and Title X of the Iowa Code, including Iowa Code section 421.17(35). Such information is stored within the department, in electronic or physical format. The chart below describes department records that contain personally identifiable information and identifies which records are open records, confidential records, partially open or partially confidential. A single record may contain information from several categories in the chart. This information is compiled for the purposes of Iowa Code section 22.11.

Code………Meaning	
O………….The records are open for public inspection.	
C………….The records are confidential and are not open to public inspection.	
O/C……….The record is partly open and partly confidential.	

Description of Record	Type of Record	Legal Authority for Confidentiality	
State tax returns, return information, permit records, tax liability and penalty records, tax policy, tax research records, and all related records	O/C	Iowa Code Title X, including Iowa Code sections 422.20 and 422.72	
Nontax collection records	O/C	Iowa Code Title X, including Iowa Code sections 422.20 and 422.72, and contractual authority	
Federal tax returns and return information	C	26 U.S.C. §6103	
Department personnel records, communication records, budget records, and payroll records	O/C	Iowa Code section 22.7	
Minutes of closed meetings of a government body	C	Iowa Code section 21.5(4)	
Records that constitute attorney work product or attorney-client communications or are otherwise privileged	C	Iowa Code section 22.7(4), Iowa Rule of Civil Procedure 1.503, Federal Rule of Civil Procedure 26(b)(3), and case law	
	b. 	The procedure for public records request may be found in rule 701—5.3(17A,22,421,422).
	c. 	The procedure for allowing a person to have additions, dissents, or objections entered in the record will be determined on a case-by-case basis.
	d. 	The subject of the confidential record may either request the record independently and give it to the named third party or authorize the third party to request the subject’s confidential information under Iowa Code section 421.59, 422.20(7), or 422.72(9).
	e. 	The department will utilize information, including confidential information, in executing its duties under the Iowa Code. Subjects of the information will not be notified when the information is used. Persons outside of the department receiving confidential information are held to the same confidentiality standard as departmental employees. Whether information is required or optional will be indicated along with the request for information. Failing to provide required information may result in penalties or interest being charged.
	f. 	The department utilizes more than one data processing system, and information is matched between systems.
This rule is intended to implement Iowa Code chapters 17A, 22, 421, and 422.
[ARC 6583C, IAB 10/5/22, effective 11/9/22]