Background
Federal law generally makes tax returns and return information confidential. Under 26 U.S.C. § 6103(i)(2), the IRS may disclose return information for specified non-tax criminal investigations only after an agency head submits a written request containing required information, including the taxpayer’s name and address, the relevant taxable period, the statutory authority for the investigation, and specific reasons the information may be relevant. Disclosure is limited to agency personnel personally and directly engaged in the qualifying investigation.
In 2025, after entering a memorandum of understanding with Immigration and Customs Enforcement, the IRS created an automated Data-Exchange Procedure to process ICE requests for taxpayer addresses. ICE sought information concerning 1.28 million people, and the IRS disclosed 47,289 records before the district court intervened. The procedure treated any five- or nine-digit entry in an address field as sufficient and, when ICE supplied a taxpayer identification number, could disclose the IRS’s last known address without confirming that ICE had provided the taxpayer’s address. It also did not ensure that the listed ICE contact was personally and directly engaged in the relevant investigation.
The Center for Taxpayer Rights, Main Street Alliance, and two labor unions sued under the Administrative Procedure Act. The district court stayed the Data-Exchange Procedure, preliminarily enjoined disclosures except in strict compliance with § 6103(i)(2), and required advance notice to the court before the IRS responded to future Department of Homeland Security requests. The IRS appealed.
The Court’s Holding
The D.C. Circuit affirmed the preliminary relief. It held that the Center was likely to establish organizational standing because the data-sharing procedure predictably discouraged immigrant taxpayers from seeking its services, interfered with its core taxpayer-assistance work, and forced it to redirect staff and operating funds toward outreach. The court also held that the Data-Exchange Procedure was final agency action reviewable under the APA because it represented the consummation of the IRS’s decisionmaking, bound IRS personnel, governed ongoing disclosures, and altered taxpayers’ privacy protections.
The court concluded that the Internal Revenue Code’s civil-damages and criminal-penalty provisions did not displace APA review because they offered no mechanism to review, enjoin, or set aside an unlawful IRS policy. On the merits, the Center was likely to show that the procedure violated § 6103(i)(2), particularly because it permitted disclosures without a taxpayer address and failed to ensure that information went only to personnel personally and directly engaged in a qualifying investigation. ICE’s generic explanation accompanying 1.28 million requests also appeared insufficiently specific under the statute.
The remaining preliminary-relief factors favored the plaintiffs because the procedure hindered the Center’s time-sensitive representation of taxpayers, unlawful disclosures could not readily be undone, and the government had no legitimate interest in violating federal law. The court further held that Trump v. CASA did not foreclose a stay under 5 U.S.C. § 705 and that broader relief was necessary because the Center’s injury arose from the existence and operation of the procedure itself.
Key Takeaways
- An internal, automated agency procedure can constitute final agency action when it binds officials, governs ongoing conduct, and produces concrete legal consequences.
- Section 6103(i)(2) does not permit the IRS to disclose return information merely because ICE supplies a taxpayer identification number and placeholder digits instead of the taxpayer’s address.
- The Internal Revenue Code’s remedies against unlawful disclosures do not bar APA review of an IRS policy because they cannot set aside or enjoin the policy itself.
- A § 705 stay may operate against agency action as a whole when narrower relief would not redress the plaintiff’s injury.
Why It Matters
The decision reinforces the statutory confidentiality of taxpayer information across the executive branch and requires strict compliance with Congress’s conditions for sharing that information in non-tax criminal investigations. Agencies cannot replace those conditions with automated screening rules that accept incomplete or facially deficient requests.
The opinion also provides significant APA guidance: operational procedures may be reviewable final agency action even when unpublished or described as merely implementing another policy, and § 705 remains a potential basis for staying agency action beyond the immediate parties when necessary to prevent irreparable harm.