On April 30, 2009, the FTC announced that it will again delay enforcement of the "Red Flags" Rule, this time until August 1, 2009. Last October, the FTC had announced that it was suspending enforcement of the Rule for six months to enable those entities who may be subject to the Rule "sufficient time to establish and implement appropriate identity theft prevention programs." Apparently, many of the same difficulties persist. Under the Rule, every "creditor" with "covered accounts" is required to have in place a written program that provides for the "identification, detection and response to patterns, practices or specific activities that could indicate identity theft." In its recent announcement, the FTC again defines "creditors" broadly to include "all entities that regularly permit deferred payments for goods or services" and specifically mentions automobile dealers, mortgage brokers, utility companies, telecommunications companies and businesses that provide services and bill later, including many lawyers, doctors and other professionals. The meaning of "covered accounts" may also be causing difficulties. First, they are broadly defined to mean "[a]n account that a financial institution or creditor offers or maintains, primarily for personal, family or household purposes, that involves or is designed to permit multiple payments or transactions." Unfortunately, a second category was introduced in the original FTC Regulations, namely, "any other account for which there is a reasonably foreseeable risk to customers or the safety and soundness of the financial institution or creditor from identity theft." This appears to cover almost everything (or nothing).
The FTC, according to its announcement, will issue additional materials, including a "compliance template" to assist businesses in their compliance efforts. Finally, a statement by FTC Chairman Jon Leibowitz indicates the difficulties the FTC is having with the implementation of the "Red Flags" Rule: "Given the ongoing debate about whether Congress wrote this provision too broadly, delaying enforcement of the Red Flags Rule will allow industries and associations to share guidance with their members, provide low-risk entities an opportunity to use the template in developing their programs, and give Congress time to consider the issue further."