Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Since 2008, the Federal Trade Commission (&ldquo;FTC&rdquo;) has announced multiple times that it would delay enforcement of the Red Flags Rule.&nbsp; The last <a href="http://www.ftc.gov/opa/2010/05/redflags.shtm">Enforcement Policy</a>&nbsp; announced a delay through December 31, 2010, so that Congress could consider legislation regarding the scope of entities covered by the Rule.&nbsp;<img class="mt-image-left" style="float: left;margin: 0 20px 20px 0" src="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2010/12/images.jpg" alt="images.jpg" width="124" height="124" /> The Rule applies to &ldquo;financial institutions&rdquo; and &ldquo;creditors&rdquo; that maintain &ldquo;covered accounts,&rdquo; and it requires covered entities to implement a written program designed to detect patterns and practices that indicate possible identity theft&mdash;&ldquo;Red Flags.&rdquo;&nbsp; Because the Rule initially broadly defined &ldquo;creditor&rdquo; (an entity that regularly extends credit) and &ldquo;covered account&rdquo; (a consumer account that permits multiple transactions or a commercial account where there is a &ldquo;reasonably foreseeable risk&rdquo; of identity theft), a wide range of businesses were required to comply with the Rule (e.g. car dealers, health care providers, accountants, law firms, mortgage brokers, utility companies, and telecommunication companies).&nbsp; After lawsuits were filed by groups representing health care providers, attorneys, and accountants seeking to enjoin the FTC from applying the Rule to their members, the House and Senate introduced legislation to limit the scope of the Rule.&nbsp; On December 18, President Obama signed the <a href="http://www.govtrack.us/congress/billtext.xpd?bill=s111-3987">Red Flag Program Clarification Act of 2010</a>, which limited the scope of the Rule by amending the definition of &ldquo;creditor.&rdquo;&nbsp; The amended definition of &ldquo;creditor&rdquo; specifically excludes creditors &ldquo;that advance funds on behalf of a person for expenses incidental to a service provided by the creditor to that person.&rdquo;&nbsp; The amended definition also includes a provision that will allow regulating authorities to promulgate a rule defining entities they regulate as a &ldquo;creditor&rdquo; upon making a &ldquo;determination that such creditor offers or maintains accounts that are subject to a reasonably foreseeable risk of identity theft.&rdquo; Essentially, the amended definition of &ldquo;creditor&rdquo; exempts service providers like lawyers, doctors, and accountants from complying with the Rule.&nbsp; According to Sen. Mark Begich, D-Alaska, who sponsored the legislation in the Senate with Sen. John Thune, R-S.D., the basis for excluding service providers from complying with the Rule is that service providers generally do not offer or maintain accounts that pose a reasonable risk of identity theft. The legislative amendment to the definition of &ldquo;creditor&rdquo; likely clears the way for the FTC to begin enforcement of the Rule on January 1, 2011.&nbsp;

FTC Enforcement of the Red Flags Rule Likely to Begin January 1