The Federal Trade Commission has again delayed its enforcement of the "Red Flags" Rule until year-end at Congress' request, as lawmakers work on legislation to limit the scope of entities covered by the rule amid legal battles over its application.

The Red Flags rule, which requires certain businesses to develop and implement written identity theft prevention programs to help identify "red flags" that might indicate identity theft, stems from the Fair and Accurate Credit Transactions Act, which directed the FTC and other agencies to develop regulations requiring "creditors" and "financial institutions" to address the risk of ID theft. The rule became effective on Jan. 1, 2008, with full compliance for all covered entities originally required by Nov. 1, 2008.

The latest FTC delay comes as lawmakers continue efforts to reign in the broad scope of businesses subject to the rule's requirements following legal wrangling over the rule. Most recently, in May, the American Medical Association and several other medical groups filed a lawsuit in federal court seeking to prevent the FTC from extending the identity theft regulations to physicians. Last October, U.S. District Court Judge Reggie Walton granted a motion for summary judgment by the ABA for relief from the Rule's application to lawyers.

House lawmakers in October passed H.R. 3763, which would exclude from the Red Flag guidelines meaning of "creditor" any healthcare, accounting, or legal practice with 20 or fewer employees, as well as any other business which the FTC determines knows all its customers or clients individually; only performs services in or around the residences of its customers; or hasn't experienced incidents of ID theft, and identity theft is rare for businesses of that type. An identical bill, S. 3416 was introduced in the Senate on May 25.

Under the extension announced on May 28, the current FTC Red Flags enforcement deadline is Dec. 31. However, if Congress passes legislation with an effective date earlier than Dec. 31, the FTC said it will begin enforcement as of that effective date.

Under the previous delay announced last October, FTC enforcement of the rule was supposed to take effect June 1.

The FTC action doesn't affect other federal agencies' enforcement of the original Nov. 1, 2008, deadline for institutions subject to their oversight. The delay also doesn't extend to a rule regarding address discrepancies applicable to users of consumer reports or a rule regarding changes of address that applies to card issuers.

Topics