Identity theft; Red Flags rule

I’ve had a couple questions recently related to “required training for staff on the Red Flags Rule” related to protecting accounts from identity theft. Please see the information pasted below. I really don’t think the training is necessary for library or government personnel (unless for some reason you access credit accounts, report to credit bureaus, or make loans)

See http://www.ftc.gov/bcp/edu/microsites/redflagsrule/faqs.shtm

· What if I work for a municipality, city, or county, and we've already determined our activities fall within the Rule's definition of "creditor" or "financial institution"? Do our taxes, fines, etc., become "covered accounts" under the Red Flags Rule?

No. These fees are not covered accounts under the Rule because a person is not establishing a relationship to get goods or services.

· Does the FTC have a sample training policy for employees?

No. That wouldn't be practical because each Program is unique. Your employee training policies should be based on the specific red flags you've identified in your business or organization and the procedures you've put in place for detecting and responding to those red flags.

---

The original act was updated December 18:

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the ‘‘Red Flag Program Clarification Act of 2010’’.

SEC. 2. SCOPE OF CERTAIN CREDITOR REQUIREMENTS.

(a) AMENDMENT TO FCRA.—Section 615(e) of the Fair Credit Reporting Act (15 U.S.C. 1681m(e)) is amended by adding at the end the following:

‘‘(4) DEFINITIONS.—As used in this subsection, the term ‘creditor’—

‘‘(A) means a creditor, as defined in section 702 of the Equal Credit Opportunity Act (15 U.S.C. 1691a), that regularly and in the ordinary course of business—

‘‘(i) obtains or uses consumer reports, directly or indirectly, in connection with a credit transaction;

‘‘(ii) furnishes information to consumer reporting agencies, as described in section 623, in connection with a credit transaction; or

‘‘(iii) advances funds to or on behalf of a person, based on an obligation of the person to repay the funds or repayable from specific property pledged by or on behalf of the person;

‘‘(B) does not include a creditor described in subparagraph (A)(iii) that advances funds on behalf of a person for expenses incidental to a service provided by the creditor to that person; and

‘‘(C) includes any other type of creditor, as defined in that section 702, as the agency described in paragraph (1) having authority over that creditor may determine appropriate by rule promulgated by that agency, based on a determination that such creditor offers or maintains accounts that are subject to a reasonably foreseeable risk of identity theft.’’.

http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=111_cong_bills&docid=f:s3987es.txt.pdf

---

I’m still not a lawyer but it does not seem that most libraries or agencies that do not regularly use or report to credit reporting agencies are in any way impacted by the law. I would expect those libraries dealing with recovery agencies (like Unique that do regularly report to credit agencies) would be hearing from those agencies to tighten the information they are provided.