The FTC announced on Friday that it would, for the fourth time, delay enforcement of the “Red Flags” Rule. The deadline--previously set as today, June 1--has been extended to December 31, 2010, in order to allow for further congressional consideration of pending legislation that would limit the scope of covered entities.
The rule requires “creditors,” as defined in the Fair Credit Reporting Act, to develop identity theft prevention programs that recognize and respond to “red flags.” The FTC has adopted the position that “creditors” include “professionals, such as lawyers or health care providers, who bill their clients after services are rendered.” FTC Extended Enforcement Policy (see note 2). Accordingly, and unexpectedly, the rule currently requires legal, health care, and accounting practices to develop identity theft prevention programs and subjects them to penalties in the event of noncompliance. Previous enforcement delays responded in part to a lack of awareness on the part of these professions, heavily regulated by other agencies, that they might be subject to the “Red Flags” Rule.
Recently, the American Bar Association (ABA) successfully challenged the FTC’s characterization of lawyers as “creditors” in the US District Court of the District of Columbia, where Judge Reggie Walton held that Congress unambiguously did not intend to grant the FTC authority over attorneys pursuant to FACTA. See American Bar Association v. FTC. On appeal to the D.C. Court of Appeals, that decision will likely implicate separate lawsuits brought by the American Medical Association (AMA) and American Institute of Certified Public Accountants (AICPA) seeking to invalidate the FTC’s characterization of physicians and accountants, respectively, as “creditors” on similar grounds.
The House of Representatives has already passed legislation that would narrow the definition of “creditors” to exclude, among certain other businesses, legal, health care, and accounting practices with fewer than twenty employees (H.R. 3763). Similar legislation was recently introduced with bipartisan support in the Senate (S. 3416). The legislation’s exclusion of small practices might, however, imply the inclusion of larger practices, thereby undermining the ABA, AMA, and AICPA claims.
FTC Chairman Jon Leibowitz implores Congress to act quickly, complaining that, “as an agency we’re charged with enforcing the law, and endless extensions delay enforcement.” In the meantime, though, the FTC might avoid such “endless extensions” by responding to initial indications from both courts and Congress that it has overextended application of the “Red Flags” Rule.
For more perspective on this development, click here for an interview conducted a few days before the FTC announcement by Bloomberg Law's legal analyst Spencer Mazyck with Arnold & Porter attorney, Nancy Perkins.
- Nancy Perkins and Caroline DeCell
