Advertising Law Blog

The Federal Trade Commission announced that it will suspend enforcement of the new "Red Flags Rule" until May 1, 2009, to give creditors and financial institutions additional time in which to develop and implement written identity theft prevention programs. Enforcement was slated to begin on November 1, 2009, but has been delayed because of industry confusion.

The Red Flags Rule was developed pursuant to the Fair and Accurate Credit Transactions (FACT) Act of 2003. Under the Rule, financial institutions and creditors with covered accounts must have identity theft prevention programs to identify, detect, and respond to patterns, practices, or specific activities that could indicate identity theft.

Importantly, the Rule goes beyond financial institutions - it also applies to creditors - defined as an entity that regularly extends, renews, or continues credit; an entity that regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who is involved in the decision to extend, renew, or continue credit. (Accepting credit cards as a form of payment does not, in and of itself, make an entity a creditor). Specific examples of creditors include utility companies, telecommunications companies, and non-profit and government entities that defer payment for goods or services.

Under the Red Flags Rules (16 CFR 681.2), covered companies are required to develop and implement written "identity theft prevention programs." The programs must provide for the identification, detection, and response to patterns, practices, or specific activities - known as "Red Flags" - that could indicate identity theft.

The delay in enforcement is limited to the Identity Theft Red Flags Rule and does not extend to the rule regarding address discrepancies applicable to users of consumer reports (16 CFR 681.1), or to the rule regarding changes of address applicable to card issuers (16 CFR 681.3).