FTC REQUIRES BUSINESSES TO ADOPT IDENTITY THEFT PROGRAMS
The Federal Trade Commission (FTC) recently adopted rules on identity theft “red flags” (i.e., warning signs) pursuant to the Fair and Accurate Credit Transactions (FACT) Act of 2003. The new rules, which require action by November 1, 2008, require any business with a “covered account” to adopt and implement an identity theft program. Most cities that operate a municipal utility will be affected by these new rules.
A covered account is one where an entity (such as a municipal utility) provides a service or good before the consumer pays for it. For example, most municipal water utilities provide water to the customer, then bill the customer later based on consumption.
A city with such accounts must, by November 1, 2008, adopt and implement a written program that: (1) identifies relevant identity theft “red flags” to the utility or other covered entity; (2) provides for detection of those red flags; (3) provides for appropriate responses to any red flags that are detected; and (4) ensures that the program is updated periodically to address changing risks.
Red flags may include unusual account activity, altered identity documents that are used to apply for an account, and a variety of other signs. Appropriate action in response to a red flag might include, among other actions, verification of personal information, contacting the customer, or other action that would prevent identity theft.
More information on the rules and identity theft programs can be found at http://www.ftc.gov/bcp/edu/pubs/business/alerts/alt050.shtm. Any questions can be directed to legal@tml.org or to the Federal Trade Commission at RedFlags@ftc.gov. Future editions of the TML Legislative Update will contain links to sample programs as they become available.