Court allows tax data leak claims against IRS and Booz Allen to proceed

Safe Harbor International LLC v. Booz Allen Hamilton Inc. USDC for the District of Maryland. No. 8:25-cv-00139

Taxpayers may seek damages for unauthorized disclosure of return information by a contractor if there is evidence of government control or employer responsibility.

Holding

The Court rejected the motions to dismiss from the IRS, Treasury, and Booz Allen, so claims of wrongful disclosure under §6103 and §7431 will move forward.

Why It Matters

• Expands exposure beyond formal employees
  The decision allows plaintiffs to argue that a contractor may qualify as a government “employee” under common-law control principles.

• Confirms vicarious liability pathway
  Employers, including contractors like Booz Allen, can face liability for employee misconduct under §7431.

• Signals litigation risk from data breaches
  The ruling keeps alive large-scale claims tied to the Littlejohn disclosures, which involved high-profile taxpayer data.

• Procedural, but consequential
  This is a motion-to-dismiss ruling, not a final decision. Still, it clears a key hurdle and allows discovery to proceed.

Key Facts

• IRS contractor Charles Littlejohn accessed and leaked confidential tax return information.

• Disclosures included data shared with media outlets, including reporting on high-net-worth individuals.

• Littlejohn pleaded guilty to unlawful disclosure under § 7213 and received a 5-year sentence.

• IRS notified affected taxpayers in 2024.

• Plaintiffs filed a class action seeking damages under §7431 for violations of §6103 confidentiality rules.

Regulatory Framework

• §6103
  Requires tax returns and return information to remain confidential unless disclosure is authorized.

• §7431
  Allows civil damages for unauthorized inspection or disclosure of tax information.

  • §7431(a)(1): Claims against the United States for acts by federal employees

  • §7431(a)(2): Claims against non-government persons

• Control test
  A common-law agency standard used to determine whether a worker qualifies as an employee based on the degree of supervision and control.

Arguments

Taxpayer argued:

• Littlejohn served as a government employee because of the IRS's control over his work.

• IRS and Booz Allen failed to implement safeguards to protect taxpayer data.

• Booz Allen is liable for its employee’s actions under a vicarious liability theory.

Government argued:

• Sovereign immunity bars claims because Littlejohn was a contractor, not a government employee.

• §7431 does not permit extending liability under common-law agency principles.

Booz Allen argued:

• §7431 does not allow vicarious liability claims against employers.

• Littlejohn acted outside the scope of his employment.

Court’s Reasoning

• The complaint plausibly alleges that Littlejohn could qualify as a government employee under the control test.

• The IRS exercised detailed supervision, provided tools, and controlled access to systems.

• §7431 does not define “employee,” so courts apply common law agency principles.

• Sovereign immunity does not bar claims at this stage because plaintiffs plausibly allege an employee relationship.

• §7431(a)(2) does not preclude vicarious liability claims against non-government employers.

• The complaint plausibly alleges that Booz Allen failed to supervise and safeguard access to taxpayer data.

• Determining employment status and scope of employment requires factual development, not dismissal.

Result

Motions to dismiss by the IRS, Treasury, and Booz Allen are denied; the case proceeds.

The Takeaway

This decision makes it easier for taxpayers to bring data breach claims related to IRS systems.

If contractors work under government control or within an employer’s scope, both the government and private contractors could face real liability.

List of Citations

• 26 U.S.C. §6103
  Establishes the confidentiality of tax returns and return information

• 26 U.S.C. §7431
  Provides civil damages for unauthorized inspection or disclosure

• United States v. Littlejohn, No. 23-cr-343 (D.D.C.)
  Criminal case confirming unlawful disclosures

• Biden v. IRS, 752 F. Supp. 3d 97 (D.D.C. 2024)
  Supports use of common law agency principles in §7431 context

• Cilecek v. Inova Health Sys. Servs., 115 F.3d 256 (4th Cir. 1997)
  Defines the control test for employee status

• Community for Creative Non-Violence v. Reid, 490 U.S. 730 (1989)
  Provides common law factors for employment classification