‘Red Flags’ Deadline Delayed until June

WASHINGTON — The Federal Trade Commission has announced
— for the fourth time — that it will delay enforcement
of the so-called “Red Flags Rule” requiring implementation of
identity theft prevention measures. The deadline for compliance
would have been Nov. 1; that deadline has been moved to June 1,
2010.

An Oct. 29 letter from House Financial Services Chairman Barney
Frank, D-Mass., and other legislators asked the FTC to delay the
rule for at least 180 days, giving Congress time to consider its
application.

On Oct. 20, the House approved legislation that would exclude
some small businesses from the requirement and that would require
the FTC to issue new regulations allowing any company to apply for
an exemption. In addition to exempting small health care providers,
accounting firms and legal practices, the House bill would allow
any business to be exempted from the rule if the FTC determines
that the organization knows all of its customers or clients
individually; only performs services in or around the residences of
its customers; or has not experienced incidents of identity theft
and is part of an industry that rarely experiences the problem.

Similar legislation is now working its way through the Senate,
the lawmakers wrote in their letter. “Thus, to implement the rule
now and force these small businesses to comply with a regulation
that soon will exempt them is both burdensome and unnecessary.”

The rule was promulgated under the Fair and Accurate Credit
Transactions Act, in which Congress directed the Commission and
other agencies to develop regulations requiring “creditors” and
“financial institutions” to address the risk of identity theft. The
resulting rule requires all such entities that have “covered
accounts” to develop and implement written identity theft
prevention programs to identify, detect and respond to patterns or
practices — known as “red flags” — that could indicate
identity theft.

The rule was originally set to take effect Nov. 1, 2008, but
because of widespread confusion about whether the rule applies to
some companies, the FTC put off its deadline until May 1, 2009. At
the end of April, the agency pushed the deadline to Aug. 1 and set
up an educational Web site about the rule.

On Friday, the U.S. District Court for the District of Columbia
ruled that the FTC can’t apply the Red Flags Rule to attorneys. In
a release issued that day, the FTC said it would once again delay
enforcement of the rule.