SECTION 7. EXAMPLES

.01 The application of this revenue procedure is illustrated by the following examples:

(1) Example 1 . Preparer P offers tax preparation services over the Internet. P wishes to use information the taxpayer provides during tax preparation of the taxpayer’s Form 1040 to generate targeted banner advertisements ( i.e., electronic advertisements appearing on the computer screen based on the taxpayer’s tax return information). In the course of advertising services and products, P also wishes to disclose to other third parties the information that the taxpayer provides.

(a) P posts, in pertinent part, the following consent on the computer screen for taxpayers to indicate approval. If a taxpayer does not indicate approval, the tax return preparation software does not permit the taxpayer to use the software.

PRIVACY STATEMENT

Your privacy is very important to us at P. We are providing this statement to inform you about the types of information we collect from you, and how we may disclose or use that information in connection with the services we provide. This Privacy Statement describes the privacy practices of our company as required by applicable laws. . . . During the course of providing our services to you, we may offer you various other services that may be of interest to you based on our determination of your needs through analysis of your data. Your use of the services we offer constitutes a consent to our disclosure of tax information to the service providers. If at any time you wish to limit your receipt of promotional offers based upon information you provide, you may call us at the following. . . . (b) Beneath this Privacy Statement, the following acknowledgment line appears next to two button images stating “yes” and “no:”

“I have read the Privacy Statement and agree to it by clicking here.”

(c) If the taxpayer clicks “no,” a message appears on the screen informing the taxpayer that tax return preparation will not proceed without the taxpayer agreeing to the company’s Privacy Statement.

(d) P has failed to comply with the requirements of § 301.7216–3 and this revenue procedure. P has attempted to obtain consent from the taxpayer by making the use of the program ( i.e., the provision of tax return preparation services) contingent on the tax

may consent to multiple uses within the same written document or multiple disclosures within the same written document. Disclosure consents and use consents must be provided in separate documents. Multiple disclosure consents and multiple use consents must provide the taxpayer with the opportunity, within the separate written document, to affirmatively select each separate disclosure or use. Further, the taxpayer must be provided the information in section 5.04 for each separate disclosure or use. The mandatory statements required in section 5.04(1) relating to disclosure or use need only be stated once in a multiple disclosure or multiple use consent.

.06 Disclosure of entire return. If, under § 301.7216–3(c)(2), a consent authorizes the disclosure of a copy of the taxpayer’s entire tax return or all information contained within a return, the consent must provide that the taxpayer has the ability to request a more limited disclosure of tax return information as the taxpayer may direct.

.07 Adequate data protection safeguard. Pursuant to § 301.7216–3(b)(4), a tax return preparer located within the United States, including any territory or possession of the United States, may disclose a taxpayer’s SSN to a tax return preparer located outside of the United States or any territory or possession of the United States with the taxpayer’s consent only when both the tax return preparer located within the United States and the tax return preparer located outside of the United States maintain an adequate data protection safeguard at the time the taxpayer’s consent is obtained and when making the disclosure. An adequate data protection safeguard is a management-approved and implemented security program, policy, and practice that includes administrative, technical, and physical safeguards to protect tax return information from misuse, unauthorized access, or disclosure and that meets or conforms to one of the following privacy or data security frameworks:

(1) The United States Department of Commerce “safe harbor” framework for data protection (or a successor program);

(2) A foreign law data protection safeguard that includes a security component ( e.g., the European Commission’s Directive on Data Protection);

(3) A framework that complies with the requirements of a financial or simi

lar industry-specific standard that is generally accepted as best practices for technology and security related to that industry ( e.g., the BITS, Financial Services Roundtable, Financial Institution Shared Assessment Program);

(4) The requirements of the AICPA/CICA Privacy Framework;

(5) The requirements of the most recent version of IRS Publication 1075, Tax In- formation Security Guidelines for Federal, State and Local Agencies and Entities ; or

(6) Any other data security framework that provides the same level of privacy protection as contemplated by one or more of the frameworks described in (1) through (5).