Boy, did I get a surprise the other day.

I needed a specific tax document from a few years ago, and I knew the IRS would have it.  So, I went to the IRS site and was confronted with a new requirement.

I was ready with my name and my password, but this barrier was completely new.  It seems in its zeal to protect folks from having their identity hacked, the IRS decided to require facial recognition software to access one’s own data.

Now, I already knew that this software was squishy (read not truly capable of function- especially if one were not White).  And, what happens if someone didn’t have a computer with a camera or a smart phone?  So, why the heck was the IRS using this technology?

It seems that someone (I still don’t know who) at the IRS thought that using “video selfies” was the best protection.  And, if that weren’t enough of a concern, the whole process was farmed out to a company called ID.me.

And, I was not consoled by the statements made by IRS Commissioner Charles Rettig that they take my privacy concerns seriously and that they would ensure the videos remained secure.  Isn’t that what other government agencies have promised- just to have population data hijacked by nefarious folks?

Nevertheless, I prepared my video and got my data.  I needed my data.  Just like 70 million other Americans did. (ID.me provides the services for child tax credits, unemployment insurance, pandemic assistance, and then some.)

But, I was still irked.  (For what it’s worth, the GSA, the General Services Administration, of the government knows this technology is highly unreliable.)

And, it seems a slew of Congressfolks and Senators were also aghast at this practice.  Well, not really.  Their issue was that the IRS farmed this out to a private entity.  And, they wanted to know what would happen to this data, should the IRS terminate or not renew the contract.

And, then, I found out that this past summer the IRS had inked a two year,  $86 million contract with ID.me.   To perform just those services I mentioned.  Oh- and ID.me was going to keep this data for 7 years- supposedly because the Federal government required that.

Well, that’s all over now.  The IRS, in response to the vitriolic messages from the Congress, has abandoned this plan. And, it’s not clear what happens with this big two year contract ID.me has.

Except, even that didn’t answer the big question I had.  What happens to all the data that ID.me has already collected?   Where does it go?  Oh, and by the way, who is in control of this data?  Can police (or the CIA) obtain this data, as they have done with genetic analysis companies who provide ancestry services?

After all, there are no federal laws governing how facial recognition data is used or secured.  There are some states with rules- but they pertain mostly to how police and other public agencies can access the data.

Which is why the statement that ID.me is not only dropping the facial recognition component it’s been using, but will also remove the data from its collections upon request, is such welcome news.

Yet, we have to wait until 1 March.  And, we have to hope that ID.me makes this process easy.  Because there is not a solitary mention of this change on their website.

I plan to get my request in as soon as its legal to do so.

How about you?