Taxpayer Data Protection Act

Summary

Restricts who may access Department of the Treasury systems that process public money (including Bureau of the Fiscal Service systems) by creating eligibility and security requirements for users and adding investigation and reporting requirements for unauthorized access. It requires most internal users to have at least one year of service and a satisfactory recent performance rating; other users must meet a set of clearance, ethics, training, and tenure conditions. The Treasury Inspector General must investigate each unauthorized access, report to Congress within 30 days, and include details, risk assessment, and any stopped payments.

• Limits who may access Treasury public-money receipt and payment systems and associated data.
• Internal Treasury users must have at least one year of service and a recent performance rating of at least "fully successful."
• Non-internal users can access systems only if they meet six strict conditions including security clearance, training, and an ethics agreement.
• Non-executive-branch users are treated as executive-branch employees for conflict-of-interest law (18 U.S.C. § 208) for these accesses.
• Treasury Inspector General must investigate every unauthorized access and report to Congress within 30 days with details and risk assessment.
• Reports must describe unauthorized actions, assess risks to privacy/cybersecurity/national security, and list any payments stopped during the incident.
• No new spending authorizations or tax code changes are included; the focus is personnel eligibility, security, and oversight.
• The measure may delay or restrict access for contractors and partner agency staff until they meet tenure, clearance, training, and ethics requirements.