Virginia’s data breach notification laws have been expanded to include improper access to individual tax returns. Va. Code Ann. § 58.1-341.2, effective July 1, 2018, provides that income tax return preparers who prepare individual Virginia income tax returns must notify the state’s Department of Taxation if they learn of a breach of “return information.” “Return information” is defined as “a taxpayer’s identity and the nature, source, or amount of … income, payments, receipts, deductions, exemptions, credits, assets, liabilities, net worth, tax liability, tax withheld, assessments, or tax payments.” The notice requirements include (i) name and taxpayer identification number of any affected taxpayer, (ii) preparer’s name and (iii) preparer tax identification number.
This is the second recent amendment to Virginia’s data breach notification laws that is intended to address growing concerns regarding tax-related identify theft. An amendment to Va Code Ann. § 18.2-186.6 went into effect last year and addressed breaches that resulted in unauthorized disclosures of Virginia tax payers’ identification numbers along with their tax withholdings. Tax-related identity theft occurs when a person files a tax return under another person’s name fraudulently claiming a refund. In many instances taxpayers are not aware of such activity until they are notified by the Internal Revenue Service.