May 28, 2010

FTC Delays Enforcement Deadline for Red Flags Rule

By

The Federal Trade Commission announced today that it is further delaying enforcement of the “Red Flags” Rule through December 31, 2010.

 

Today’s announcement and the release of an Enforcement Policy Statement do not affect other federal agencies’ enforcement of the original November 1, 2008 deadline for institutions subject to their oversight to be in compliance, according to an FTC news release.

 

The American Medical Association (AMA), American Osteopathic Association (AOA) and the Medical Society of the District of Columbia (MSDC) filed a suit in federal court on May 21, 2010, seeking to prevent the Federal Trade Commission (FTC) from extending identity theft regulations to physicians.

The complaint targets the “red flags rule,” which requires creditors to implement safeguards against identity theft. The medical societies charge that the FTC’s rule exceeds the powers delegated to it by Congress and that its application to physicians is “arbitrary, capricious and contrary to the law.”

The suit follows two years of communications to the FTC from the AMA and AOA regarding the unintended consequences of the red flags rule. On January 27, the AMA and AOA joined other groups to petition the FTC to exclude physicians from the red flags rule. The FTC responded on March 25 saying it could not accommodate the request.

The Rule was developed under the Fair and Accurate Credit Transactions Act, in which Congress directed the FTC and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft. The resulting Red Flags Rule requires all such entities that have “covered accounts” to develop and implement written identity theft prevention programs to help identify, detect, and respond to patterns, practices, or specific activities – known as “red flags” – that could indicate identity theft.

 

The Rule became effective on January 1, 2008, with full compliance for all covered entities originally required by November 1, 2008. The Commission has issued several Enforcement Policies delaying enforcement of the Rule. Most recently, the Commission announced in October 2009 that at the request of certain Members of Congress, it was delaying enforcement of the Rule until June 1, 2010, to allow Congress time to finalize legislation that would limit the scope of business covered by the Rule. Since then, the Commission has received another request from Members of Congress for another delay in enforcement of the Rule beyond June 1, 2010.

 

“Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule – and to fix this problem quickly. We appreciate the efforts of Congressmen Barney Frank and John Adler for getting a clarifying measure passed in the House, and hope action in the Senate will be swift,” FTC Chairman Jon Leibowitz said in the FTC news release. “As an agency we’re charged with enforcing the law, and endless extensions delay enforcement.”

 

If Congress passes legislation limiting the scope of the Red Flags Rule with an effective date earlier than December 31, 2010, the Commission will begin enforcement as of that effective date.

Chuck Buck

Chuck Buck is the publisher of RACmonitor and is the program host and executive producer of Monitor Monday.

This email address is being protected from spambots. You need JavaScript enabled to view it.