A federal judge has found that the Internal Revenue Service violated federal law “approximately 42,695 times” when it shared confidential taxpayer addresses with immigration enforcement officials last summer.

U.S. District Judge Colleen Kollar-Kotelly issued the ruling Thursday as part of ongoing litigation over a data-sharing arrangement between the IRS and the Department of Homeland Security.

Federal law requires that before the IRS hands over a taxpayer’s address, a requesting agency must first provide the IRS with the name and address of the person it’s looking for. The requirement exists to ensure that the government can access confidential tax records only for individuals it has already specifically identified.

The ruling finds that DHS did not follow this law. The judge wrote that the vast majority of the nearly 47,300 taxpayer addresses the IRS shared with Immigration and Customs Enforcement in August were disclosed without the IRS confirming that ICE provided a valid address for the person whose records it was seeking.

“The IRS violated the [Internal Revenue Code] approximately 42,695 times by disclosing last known taxpayer addresses to ICE ... without confirming that ICE’s request set forth the ‘address of the taxpayer with respect to whom the requested return information relate[d],’” the judge’s opinion stated.