On May 28, 2010, the Federal Trade Commission (FTC) announced that it would delay enforcement of the Red Flags Rule from June 1, 2010, to December 31, 2010, after members of Congress urged the FTC to give Congress time to consider the scope of entities covered by the rule.
This isn’t the first time the FTC has delayed enforcement of the Red Flags Rule. In October 2009, the FTC delayed enforcement in response to the U.S. House of Representatives unanimous passage of H.R. 3763, a bill that would exclude from coverage of the rule all law firms, accounting firms and medical practices with 20 or fewer employees. In the last week of May 2010, Senators Thune (R-SD) and Begich (D-AK) introduced S. 3416, a companion bill to H.R. 3763, in the Senate.
“Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule – and to fix this problem quickly. We . . . hope action in the Senate will be swift,” FTC Chairman Jon Leibowitz said. “As an agency we’re charged with enforcing the law, and endless extensions delay enforcement.” The Commission urged Congress to act quickly and said if Congress passes legislation limiting the scope of the Red Flags Rule with an effective date earlier than December 31, 2010, the Commission will begin enforcement as of that effective date.
The Red Flags Rule was developed under the Fair and Accurate Credit Transactions Act (FACT Act). Under the FACT Act, Congress directed the FTC and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft. The resulting Red Flags Rule requires all such entities that have “covered accounts” to develop and implement written identity theft prevention programs to help identify, detect and respond to patterns, practices or specific activities – known as “red flags” – that could indicate identity theft.
The Red Flags Rule became effective on January 1, 2008, with full compliance for all covered entities originally required by November 1, 2008. The Commission has issued several enforcement policies delaying enforcement of the Red Flags Rule. May 28, 2010, marked another such delay. As was the case previously, this enforcement delay is limited to the Red Flags Rule and does not extend to the rule regarding address discrepancies applicable to users of consumer reports (16 C.F.R.§641), or to the rule regarding changes of address applicable to card issuers (16 C.F.R.§681.2).