FTC Delays Enforcement of Red Flags Rule on Identity Theft Until Year's End

At the request of Congress, the Federal Trade Commission (FTC) will delay enforcement of the Red Flags Rule (Rule) until December 31, 2010, to allow lawmakers to consider legislation that would clarify, and possibly limit, its scope. The seven-month extension marks the fifth time the FTC has pushed back the enforcement deadline, and the second time that Congress has asked the FTC for more time to pass legislation related to the Rule.

“Several members of Congress have once again asked the Commission to delay the Rule’s enforcement, through the end of the year, to give Congress time to reach a consensus on the types of businesses that should be covered under the Rule,” the FTC stated in its May 29, 2010 Extended Enforcement Policy. “The Commission believes that a limited further postponement is warranted so that it does not begin to enforce a regulation that Congress plans to supersede.”

The December 31, 2010 extension applies only to entities subject to FTC oversight under the Rule. Many financial services companies and lending institutions, which are regulated by other agencies, already should have a compliance program in place.

Congress Considers Whether to Limit the Scope of the Rule

Aimed at detecting and preventing identity theft, the Rule went into effect on November 1, 2008. According to the FTC, it applies to a wide range of businesses, non-profit organizations and government entities – any company that provides goods or services on a deferred payment basis (e.g., net 30 days billing) may be required to comply.

The scope of the Rule has been the subject of ongoing discussion, however, as numerous organizations have lobbied the FTC and Congress for various exemptions.

The U.S. House of Representatives passed a bill in October 2009 that would exempt healthcare, accounting and legal practices from the Rule if the practice has 20 or fewer employees. On May 25, 2010, two Senators introduced a parallel bill that would exclude the same kinds of groups from the Rule. The Senate Committee on Banking, Housing, and Urban Affairs is considering the proposed legislation.

Several Organizations File Legal Challenges to the Rule

In the fall of 2009, the U.S. District Court for the District of Columbia ruled in favor of the American Bar Association in its lawsuit to stop the FTC from enforcing the Red Flags Rule against attorneys. The FTC has appealed that ruling.

Following on the heels of the ABA’s successful suit to stop the FTC from enforcing the Rule against lawyers, the American Medical Association, the American Osteopathic Association and the Medical Society of the District of Columbia have brought their own legal challenge. On May 21, 2010, these organizations filed a lawsuit in federal court alleging that the application of the Rule to physicians exceeds the FTC’s authority.

For a more detailed discussion about the Red Flags Rule, please see the Holland & Knight Red Flags Alert published on July 22, 2009.