Client Alert                                                                                                                                           

Privacy & Data
Protection

Global Sourcing                                                                                                                                                   July 30, 2009

FTC Again Extends Enforcement of Identity
Theft Red Flag Rule, to Nov. 1, 2009

On January 1, 2008, six federal agencies¹ issued final Rules on Identity Theft
Red Flags and Address Discrepancies Under the Fair and Accurate Credit
Transactions (FACT) Act of 2003.² The Rules implement § 114 and § 315
of the FACT Act, which specifically call for “establishment of procedures for
the identification of possible instances of identity theft” and “reconciling addresses.”³ Guidelines and supplemental information were released to assist
entities who were originally required to comply by November 1, 2008. Companies under FTC jurisdiction have been granted two extensions to date and
enforcement was set to begin on August 1, 2009. However, the deadline has
been extended again. FTC-regulated companies now have until November
1, 2009 to comply.

Many companies and industry groups have struggled with the question of whether they are required

to comply with the FTC’s Red Flag Rule (the “Rule”). The FTC extended the original enforcement deadline from November 1, 2008, to May 1, 2009, to provide additional time for companies under its jurisdiction
to achieve compliance. On April 30, 2009, the FTC further extended the enforcement deadline to August
1, 2009. Now, in a press released issued by the FTC on July 29, 2009, companies under the FTC’s
jurisdiction have an additional three months to comply.⁴ This most recent extension pushes the deadline
to November 1, 2009.

According to the FTC this latest extension comes on the heels of the House Appropriations Committee’s
recent recommendation that the Commission “defer enforcement in conjunction with additional efforts
to minimize the burdens of the Rule on health care providers and small businesses with a low risk of
identity theft problems.”⁵ The FTC expects to use the next three months to “redouble” its efforts to assist
small businesses and entities with a low risk of identity theft with their compliance obligations under the
Rule. Many of these organizations remain uncertain about their obligations. The FTC will release additional
compliance guidance shortly and a special link with additional information related to compliance by small
businesses and low risk entities is expected to be placed on the FTC’s Red Flags Web site.⁶

The Required Identity Theft Prevention Program

The Identity Theft Red Flag Rule applies to financial institutions and creditors and calls for them to develop and implement a written “Identity Theft Prevention Program” to detect, prevent and mitigate identity theft in connection with certain “covered accounts.” The Rule also requires credit and debit card issuers to
assess the validity of notifications of changes of address in conjunction with a request for a new card, and any user of consumer credit reports to implement reasonable policies and procedures when a consumer reporting agency sends a notice of address discrepancy.⁷

The question receiving most attention from industry has been whether a company has “covered accounts.”
According to the Rule’s definition, such accounts primarily include personal accounts designed to permit
multiple payments or transactions (e.g., credit card accounts, mortgages, loans, etc.) and any account for
which there is a foreseeable risk to customers or to the safety and soundness of the financial institution
or creditor from identity theft. Thus, although the Rule focuses on accounts held primarily for personal,
household or family purposes, it also includes some business accounts where there is a risk of identity
theft.

Because of the breadth of this definition, a wide variety of companies find themselves subject to the Rule.
Businesses extending credit to customers to buy goods on payment terms offered by the business likely
have “covered accounts.” Utilities or mobile telephone services are included in this Rule because they pro-
vide services which are billed monthly in arrears. But the Rule also encompasses other entities such as
restaurants which offer “house accounts” under which a prominent patron may dine and be billed monthly.
Likewise, a country club permitting meals, activities or accommodations to be charged to membership accounts which are then billed monthly would be subject to this Rule.

Some of the uncertainty that has prompted the latest deadline extension relates to the fact that the Rule
also applies to all health care providers and hospitals that accept insurance as payment in full or part for
health care services. This is due to the FTC’s determination that the acceptance of insurance by health
care providers constitutes the extension of credit to the providers’ patients. Therefore, those patients’
accounts are considered “covered accounts”, and the applicable providers are subject to the Rule.