Red Flag Rule Deadline Extended to December 31, 2010

At the request of several members of Congress, the Federal Trade Commission has delayed enforcement of the "Red Flags" identity theft rule from June 1 through Dec. 31, 2010. The rule requires certain "creditors" to develop and implement written identity theft prevention programs to help identify, detect and respond to patterns or activities (red flags) that could indicate identity theft.

The rule became effective on Jan. 1, 2008, with full compliance for all covered entities originally required by Nov. 1, 2008, but the FTC has delayed enforcement several times to allow Congress time to pass legislation that would limit the scope of business covered by the rule.

"Congress needs to fix the unintended consequences of the legislation establishing the red flags rule—and to fix this problem quickly. We appreciate the efforts of Congressmen Barney Frank and John Adler for getting a clarifying measure passed in the House, and hope action in the Senate will be swift," FTC Chairman Jon Leibowitz said. "As an agency we're charged with enforcing the law, and endless extensions delay enforcement."

The commission urged Congress to act quickly to pass legislation that will resolve any questions as to which entities are covered by the rule and obviate the need for further enforcement delays.

In the interim, FTC staff has provide guidance about the rule on its website and created a template that enables low risk entities to create an identity theft program with an easy-to-use online form. —ROBERT VARELA, APPA