| -

WASHINGTON, D.C. — Even after multiple delays, the government is apparently not yet ready to enforce the Red Flags Rule. Another postponement for enforcement was issued on Friday after several members of Congress urged the Federal Trade Commission for yet another delay.

While the deadline for enforcement had been June 1, it has now been pushed off to Dec. 31 while Congress is apparently considering legislation that would impact the scope of the entities covered by the rule. However, if Congress comes to an agreement and announces an earlier date than Dec. 31, the FTC indicated enforcement will begin at that new specified time.

According to various industry experts, dealers should already have practices in place to protect themselves from enforcement. However, the latest delay will give dealers even more time to work out any kinks before federal agencies start to crack down.

"Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule — and to fix this problem quickly," said FTC Chairman Jon Leibowitz on Friday.

"We appreciate the efforts of Congressmen Barney Frank and John Adler for getting a clarifying measure passed in the House and hope action in the Senate will be swift," he added.

The Red Flags Rule was developed under the Fair and Accurate Credit Transaction Act, in which Congress directed the FTC and other agencies to develop regulations requiring creditors and financial institutions, which include dealers, to address the risk of identity theft.

The resulting Red Flags Rule requires that all entities, including dealers, have "covered accounts" to develop and implement written identity theft prevention programs to help identify, detect and respond to patterns, practices or specific activities, which could indicate identity theft.

Generally, dealers have been urged to appoint a staff member to be in charge of this and have been told that if they have processes in place to help prevent identity theft, then hopefully the risks of government investigation into their stores and fines will remain at a minimum.

While the Red Flags Rule actually became effective on Jan. 1, 2008, with full compliance for financial institutions and dealers required by Nov. 1, 2008, several subsequent delays have impacted the enforcement of the new rule.

"The commission urges Congress to act quickly to pass legislation that will resolve any questions as to which entities are covered by the rule and obviate the need for further enforcement delays," FTC officials stressed. "If Congress passes legislation limiting the scope of the Red Flags Rule with an effective date earlier than Dec. 31, 2010, the commission will begin enforcement as of that effective date."  

Meanwhile, FTC staff indicated it will continue to provide guidance through materials posted on www.ftc.gov/redflagsrule, and in speeches and participation in seminars, conferences and other training events with various groups.

The FTC also published a compliance guide for business and created a template that enables low-risk entities to create an identity theft program with an "easy-to-use" online form at www.ftc.gov/bcp/edu/microsites/redflagsrule/get-started.shtm.

Moreover, staff officials said they have also publishes numerous general and industry-specific articles, released a video explaining the rule and continues to respond to inquiries from the public.

Additionally, FTC staff has apparently worked with a number of trade associations that have chosen to develop model policies or specialized guidance for their members.