If the team hasn't received consent from their client to store the tax return info, there should be language in the definition explaining what they should / how they should obtain it or not to include it if they haven't received approval.