Posted Date: September 5, 2017

Author:  Craig Munier, Assistant Director, Policy Liaison and Implementation, Federal Student Aid

Subject: Reminder to institutions of higher education and state agencies regarding the privacy and security of data from the Free Application for Federal Student Aid

In a May 3, 2017 Electronic Announcement we advised the community that in order to address both privacy and security concerns related to the Internal Revenue Service (IRS) Data Retrieval Tool (DRT), the IRS and Federal Student Aid (FSA) had agreed to implement a solution that would allow for the redeployment of the IRS DRT beginning with the 2018–2019 FAFSA cycle.  To provide for maximum access to the IRS DRT among all applicants, the solution limits the information that displays to the applicant in order to enhance the security and privacy of sensitive personal tax and income information.  As was explained in the May 3 Electronic Announcement, while the solution hides taxpayer information from an applicant’s view, Institutional Student Information Records (ISIRs) sent to institutions of higher education and to state grant agencies will continue to include all of the tax return information from the FAFSA.  In light of these changes, this Electronic Announcement is a reminder to our partners of our long-standing guidance and expectation that our partners protect the security and confidentiality of data used in all aspects of the administration of the Title IV Federal student financial aid programs. This includes having policies and practices in place that provide for adequate authentication of an applicant’s identity before disclosing any confidential information.  

In keeping with these expectations, institutions of higher education and state agencies must not disclose income and tax information from the FAFSA with the applicant (and, if applicable, his or her spouse or parents) unless the FAFSA applicant (and, if applicable, his or her spouse or parents) can authenticate their identity. A FAFSA applicant appearing in person and presenting an unexpired, valid government issued photo identification (e.g. a driver’s license, non-driver’s identification card, other State issued identification, or U.S. passport) is a secure way of doing so for purposes of disclosing FAFSA information. We recognize that institutions of higher education and state agencies may have policies and procedures in place that provide for authentication in a manner other than in person, or practices that guide staff interactions with students and families about how to answer questions from applicant’s and their families without compromising highly confidential information. To the extent that our partners lack confidence in their controls, institutions and state agencies may need to strengthen their internal controls and provide additional training for staff to ensure that confidential information is not inappropriately or inadvertently disclosed.

Our partners play a critical role in helping to ensure that malicious actors do not gain access to confidential information that could be used for illegal purposes and in so doing compromise the integrity of the financial aid process, the tax collection system, and the availability of the IRS DRT to assist applicants in completing their FAFSAs. We appreciate your continued cooperation and understanding as we work together to provide the best balance between access to federal student aid and protecting the privacy of personal information.


End of Page