Congress Should Make the IRS Treat Taxpayer Privacy as Mandatory

President Donald Trump is suing the IRS for $10 billion over the leak of his tax returns by a government contractor. The number made headlines. But the real story is that the law protecting taxpayers’ most sensitive financial information is nearly worthless.

Every year, Americans file 250 million tax returns with the IRS, handing over their most sensitive personal data and information: Social Security numbers, income, investments, debts, property holdings, charitable giving, business dealings. They do so because federal law requires it, and because they trust the government to keep it confidential.

That trust rests on Section 6103 of the Internal Revenue Code, a post-Watergate reform that declared tax returns and return information confidential and off-limits to disclosure by government employees and contractors except in narrow, strictly construed circumstances. But when the IRS breaches that trust, the consequences are often negligible.

The Charles Littlejohn affair should have been a wake-up call to Congress. Littlejohn, a contractor working for the IRS through Booz Allen Hamilton, stole the tax records of thousands of wealthy Americans and leaked them to the press. The breach was unprecedented in scale.

ProPublica published more than 50 articles based on the stolen data. The New York Times ran a series on Trump’s returns that became a flashpoint in the 2020 election. Littlejohn received a five-year prison sentence, which is a serious criminal penalty (and a rare sanction in disclosure cases).

But do the victims have any recourse? Remarkably little. The statute caps damages at $1,000 per unauthorized disclosure. These claims are typically brought against the US for the conduct of IRS employees, but they can also be directed at non-government individuals and companies.

A taxpayer who wants more must prove “actual damages”—a legal burden that, in privacy cases, generally means hiring expensive experts to quantify reputational or business harm that is inherently difficult to measure. Attorneys’ fees are available only to taxpayers below strict net worth thresholds, which means the individuals most likely to be targeted by high-profile leaks are the least likely to recoup their litigation costs.

The math doesn’t work. That’s why, despite Littlejohn compromising the data of thousands of people, only a handful have sued. Ken Griffin, the billionaire investor, took the IRS to court and settled for an apology—no money, no fees. Kelcy Warren, the energy executive whose tax information was published in what he alleges are misleading articles, sued Booz Allen, not the IRS. That case remains ongoing.

For everyone else, the calculus is straightforward: Pursuing a claim would cost more than they could ever hope to recover.

This isn’t just a problem for the ultrawealthy. Section 6103 protects every taxpayer, and its failures affect everyone. Consider the recent controversy over the IRS sharing immigrant taxpayer data with Immigration and Customs Enforcement. Under a 2025 agreement, the IRS provided ICE with address information for roughly 47,000 individuals and recently admitted it improperly overshared taxpayer information. Two separate federal judges blocked the arrangement as likely unlawful.

The fallout has been immediate. Immigrants are increasingly reluctant to file tax returns, fearing their information will be used against them. The Institute on Taxation and Economic Policy estimated that undocumented immigrants paid nearly $100 billion in taxes in 2022. When taxpayers lose confidence that the system will protect their data, compliance drops and everyone pays the price.

The deeper structural problem is that the IRS rarely faces meaningful financial exposure when it mishandles taxpayer information. Federal courts are split on whether taxpayers must prove concrete monetary harm before they can seek punitive damages for the most egregious violations—those that are willful or grossly negligent. In some jurisdictions, a taxpayer whose data was deliberately leaked but who can’t quantify the resulting damage in dollars walks away with $1,000 and a lesson in futility.

We see this dynamic play out regularly in our tax controversy practice. We are currently litigating two matters in the US Court of Appeals for the Ninth Circuit involving the IRS’s disclosure of nonparty taxpayer information in court proceedings to gain a litigation advantage.

We argue that flouts the very confidentiality rules the agency is supposed to uphold. Unlike the Littlejohn prosecution, a rare case of genuine accountability, most violations result in little more than a slap on the wrist.

The fix is straightforward. Congress should amend the damages statute to make clear that taxpayers can recover punitive damages when the government’s conduct is willful or grossly negligent, without first having to prove a specific dollar amount of harm. It should also eliminate the net worth restrictions that bar many taxpayers from recovering attorney’s fees.

These changes wouldn’t reward frivolous claims, as the requirement to prove serious government misconduct remains a meaningful hurdle. But they would create real financial consequences for an agency that currently has every reason to treat taxpayer privacy as optional.

The IRS asks Americans to trust it with their most intimate financial details. It is long past time that the law gave that trust some backing.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law, Bloomberg Tax, and Bloomberg Government, or its owners.

Author Information

Kathy Pakenham is co-head of the Vinson & Elkins’ tax controversy practice.

Stephen Josey is counsel in Vinson & Elkins’ tax controversy and litigation practice.

Write for Us: Author Guidelines