Tax Benefit for Early Cybersecurity Protections

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.natlawreview.com/article/tax-benefit-early-cybersecurity-protections

In August 2015, the Internal Revenue Service announced (IRS Announcement
2015-22) that credit monitoring and other identity protection services
provided by employers to employees following a data breach are not
taxable.  In response to comments, the IRS has now expanded that decision
to include identity protection services offered before a breach occurs.

The comments received by the IRS noted that data breaches are a major
concern for companies, and despite heightened efforts to prevent breaches
from occurring, the reality is that companies must make decisions based on
the belief that data breaches are inevitable.  Because of this, more and
more organizations are providing identity protection services to employees
before a data breach to help detect problems and minimize the negative
impact to operations.  The comments asked the IRS to clarify if these
services would also be non-taxable, even if they were provided before an
actual data breach occurred.  In response, the Treasury Department and the
IRS have said yes, stating that:

“The IRS will not assert that an individual must include in gross income
the value of identity protection services provided by the individual’s
employer or by another organization to which the individual provided
personal information (for example, name, social security number, or banking
or credit account numbers). Additionally, the IRS will not assert that an
employer providing identity protection services to its employees must
include the value of the identity protection services in the employees’
gross income and wages. The IRS also will not assert that these amounts
must be reported on an information return (such as Form W- 2 or Form
1099-MISC) filed with respect to such individuals.”

This is a win-win; employers can provide these services without increasing
federal payroll taxes, and the employees receive a much needed service with
no added federal tax liability falling on them.  Nonetheless, the IRS
clarified that this treatment does not apply to cash received in lieu of
identity protection services, or to proceeds received under an identity
theft insurance policy.  Employers and employees will also have to consider
state and local tax implications.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
Need access to data breach details or alerts when new breaches happen? Risk Based Security's Cyber Risk Analytics 
portal, fueled by the RBS breach research team, provides detailed information on how data breaches occur and which 
vendors to trust. Contact us today for a demo.