Data breaches and identity theft are now so prevalent that I was amused, but not surprised, to find in my email inbox the other day an e-zine called, “Data Breach Today.”
Typically, when the holder of sensitive financial or other personal data suffers a data breach, it offers (often is required to offer) identity theft protection to people whose data was or even might have been breached. Employers have begun to proactively offer identity theft protection as a fringe benefit. The receipt by an individual of this sort of protection raises an important question:
Is the value of the identity theft protection taxable?
In a recent announcement, the IRS, without explicitly ruling that the value of identity theft protection is nontaxable, said that it won’t assert against any individual that he or she must include the value of the protection in gross income for federal tax purposes. Employers are not required to treat the value of the protection as taxable for income and payroll tax withholding purposes, nor are employers required to reflect the value on employees’ Forms W-2.
Lockton comment: An explicit determination that the value of identity theft protection is not taxable probably requires an act of Congress to amend the federal tax code to exclude the value of the protection from gross income for federal tax purposes. In lieu of that, the IRS announcement is the next best thing.
Four things we want you to understand about this announcement:
- In contrast to earlier guidance, the IRS won’t assert the taxability of identity theft protection even if the employer provides it before any data breach occurs.
- It does not apply to cash received in lieu of identity protection services, nor does it apply to proceeds received under an identity theft insurance policy. That does not necessarily mean those proceeds are taxable to the employee. The IRS says the taxability of insurance proceeds is determined “under current law.” There are good arguments in support of the notion that the proceeds are nontaxable, but that issue may be best left to the employee and his or her tax advisor.
- Many states follow the IRS’s lead in determining taxable income for state income tax purposes. But that doesn’t mean a state can’t take a contrary position here, and decline to “not assert” that the value of the identity theft protection is included in state wages, for income tax purposes. We suspect most states probably won’t do that, but employers will want to check with their payroll vendors or accountants regarding this issue.
- Identity theft protection is not a “qualified benefit” for purposes of cafeteria plans under section 125 of the federal tax code, so employees cannot purchase this protection on a pretax basis. On the other hand, identity theft protection is not a benefit subject to ERISA, so there’s no need for an employer to include the benefit in a wrap plan or to otherwise comply with ERISA reporting and disclosure rules (Form 5500 filings, summary plan descriptions, etc.) with respect to the benefit.