IRS Directs Online FOIA Requests to Biometric IDV Service, Drawing Scrutiny

The IRS is once again facing scrutiny over its support for biometric identity verification through its partnership with ID.me, this time for directing users filing Freedom of Information Act requests through its online portal to the digital IDV service.

The system employs facial recognition technology, and has been controversial among privacy advocates and members of Congress. While FOIA requests can still be submitted through other means such as FOIA.gov, mail, fax, or in-person, the IRS website directs online filers to use ID.me for faster service.

ID.me’s system requires users to upload a photo of their ID and either take a selfie or have a video appointment to confirm their identity. The process has raised concerns about the handling of biometric data, though the IRS asserts that this data is deleted within 24 hours for self-service verification and within 30 days for video chat verifications.

Alex Howard, director of the Digital Democracy Project, criticized the use of ID.me for FOIA requests, suggesting it could be seen as overreach and potentially a violation of the right to access information.

“While modernizing authentication systems for online portals is not inherently problematic, adding such a layer to exercising the right to request records under the FOIA is overreach at best and a violation of our fundamental human right to access information at worst, given the potential challenges doing so poses,” Howard said in an email to FedScoop. 

The IRS defended its choice, stating that ID.me follows National Institute of Standards and Technology (NIST) guidelines for credential authentication.

“The sole purpose of ID.me is to act as a Credential Service Provider that authenticates a user interested in using the IRS FOIA Portal to submit a FOIA request and receive responsive documents,” an IRS spokesperson said. “The data collected by ID.me has nothing to do with the processing of a FOIA request.”

Despite the criticisms, ID.me and the IRS maintain that these measures are necessary for secure online interactions with the agency.

Source: FedScoop

–

June 14, 2024 – by Tony Bitzionis