Privacy & Information Security Law Blog

The November 1st deadline for compliance with the FTC’s Red Flags Rule Identity Theft Prevention Program requirements is rapidly approaching.  Of late, there has been a flurry of activity aimed at limiting the scope of the rule.  The Red Flags Rule, which was jointly promulgated by several federal agencies in November 2007, requires all “creditors” that offer or maintain a “covered account” to implement a written identity theft prevention program.  A “creditor” is defined broadly to include “any person who regularly extends, renews, or continues credit.”  In March 2009, the Federal Trade Commission (“FTC”) published a how-to guide for businesses to comply with the Red Flags Rule that confirmed the FTC will broadly construe the rule, stating that the definition of a “creditor” includes all businesses that “provide goods or services and bill customers later.”

Although numerous organizations such as the American Medical Association have expressed their objections to the scope of the rule, the American Bar Association (“ABA”) escalated matters in August 2009 by requesting a federal court to issue an injunction that bars the FTC from enforcing the Red Flags Rule with respect to attorneys.  The ABA argues in its complaint that there is no “legally supportable basis for application of the red flags rule to lawyers engaged in the practice of law.”  On September 23, 2009, the ABA filed a motion for summary judgment in the case, and the FTC responded by filing a memorandum in opposition that argues that “subjecting attorneys to the Red Flags Rule is based on the attorney’s billing arrangement with clients—essentially an accounting function—and not on some essential element of the lawyer-client relationship, such as the protection of client confidences.”  The District Court of the District of Columbia has scheduled a hearing on the ABA’s motion on October 29, 2009, just three days before the Red Flags Rule is set to take effect.

On October 20, 2009, the House of Representatives approved H.R. 3763, which amends the Fair Credit Reporting Act to exclude health care, accounting and legal practices with 20 or fewer employees from being deemed “creditors” subject to the Red Flags Rule.  In addition to the specific exemptions for small health care providers, accounting firms, and law firms, H.R. 3763 also allows the FTC to exclude any other business from the definition of “creditor” if the business applies for an exclusion and either (1) knows all of its customers or clients individually; (2) only performs services in or around the residences of its customers; or (3) has not experienced incidents of identity theft and identity theft is rare for businesses of that type.  Finally, the bill requires the FTC to issue regulations within 180 days of the enactment of the bill that set forth the process by which businesses may apply for these exclusions.  Despite the House’s passage of the bill, there has been no similar legislation introduced in the Senate and it is unclear whether there are any plans to do so before the November 1st deadline.