When an employer is responding to a breach of their employees’ personal information, one of the last things they may think about is whether the value of the credit monitoring or other identity protection services they make available to affected employees should be considered taxable to the employees and reported as such. In Announcement 2015-22, the Internal Revenue Service clarified that it will not consider the value of such services provided by the employer to employees to be gross income or wages to the employees. The IRS also stated it will not take the position that the employees should include the value of such services as gross income on their personal income tax returns.

Providing identity protection services is a common step companies take to mitigate harm following a data breach and, depending on the state laws triggered, can be required. In general, Section 61 of the Internal Revenue Code describes gross income very broadly to include compensation for services including fees, commissions, fringe benefits, and similar items, and pensions. However, the IRS will not be asserting that individuals affected by a data breach must include in gross income the value of the identity protection services provided by the organization that experienced the data breach. This position likely applies to the tax treatment of such services provided to individuals by any organization following a data breach.

The IRS announcement states, however, this position will not apply to cash received in lieu of identity protection services, or to identity protection services received for reasons other than as a result of a data breach, such as identity protection services received in connection with an employee’s compensation benefit package. In those cases, the cash received or the value of the services provided likely would be taxable income. The announcement also does not affect the tax treatment of proceeds received under an identity theft insurance policy which is governed by existing law.

Note that state income taxes potentially could apply, although many states “piggy-back” on federal tax law and may follow the IRS Announcement here. Organizations and individuals should confirm with their tax advisors the tax treatment for these services at the state level.