New proposals would allow third-party contractor to hold onto U.S. taxpayers’ identifying information for up to three years after their accounts are closed, inviting privacy concerns