Congress Passes Legislation to Alter Red Flags RuleDecember 9, 2010
By William T. Koustas –
The Red Flags Rule (“the Rule”) requires entities covered by it to establish and implement an identity theft prevention program. We have been following this issue for some time now and have previously reported that the FTC last delayed enforcement of the Rule to December 31, 2010 at the suggestion of members of Congress. It took up legislation in an effort to better define the entities covered by the Rule. Congress has now passed the Red Flag Program Clarification Act of 2010 (“the Act”) that amends the Fair Credit Reporting Act (“FCRA”) to more clearly define who the Rule applies to. Prior to this legislation being passed, the FTC determined that the Rule applied to a variety of entities that are not generally considered creditors, such as legal and medical practices, simply because they usually bill clients after the services are rendered.
The FCRA currently applies to creditors as defined in the Equal Credit Opportunity Act (“ECOA”) which defines a creditor as “any person who regularly extends, renews, or continues credit; any person who regularly arranges for the extension, renewal, or continuation of credit;” or “any person…who participates in the decision to extend, renew or continue credit.” ECOA § 702(e). The FTC interpreted this definition to apply to any entity that regularly bills customers or clients for services rather than requiring payment at the time the service is rendered. This effectively meant that companies and professions were creditors, although they had never considered themselves creditors before. As creditors, the Rule required that they create and implement a written program to prevent and mitigate identity theft.
However, the Act would amend the FCRA to clearly state that the definition of a creditor, for the purpose of the Rule, “does not include a creditor…that advances funds on behalf of a person for expenses incidental to a service provided by the creditor to that person.” Act § 2(a)(4). Therefore, billing customers or clients for services rendered would no longer be a basis for treating an entity as a creditor for the purpose of the Rule. We presume that the President will sign the Act before the end of the year.