Privacy & Cybersecurity Law Blog

On November 30, 2012, the Federal Trade Commission announced the issuance of an interim final rule (“Interim Final Rule”) that makes the definition of “creditor” in the FTC’s Identity Theft Red Flags Rule (“Red Flags Rule”) consistent with the definition contained in the Red Flag Program Clarification Act of 2010.

The Red Flags Rule, which was initially promulgated in 2007, requires “financial institutions” and “creditors” to develop identity theft prevention programs that detect potential “red flags” that identity theft may be occurring. The term “creditor,” which was broadly defined in the Red Flags Rule to include “any person who regularly extends, renews, or continues credit,” has been a subject of consistent controversy. Notably, in 2009, the U.S. District Court for the District of Columbia held that attorneys and law firms are not considered “creditors” under the Red Flags Rule, and thus do not have to comply with the Red Flags Rule’s requirements.

In late 2010, President Obama signed the “Red Flag Program Clarification Act of 2010,” which modified the Fair Credit Reporting Act and limited the application of the Red Flags Rule to creditors that regularly and in the ordinary course of business: (1) obtain or use consumer reports, directly or indirectly, in connection with a credit transaction; (2) furnish information to consumer reporting agencies in connection with a credit transaction; or (3) advance funds to or on behalf of a person, based on a person’s obligation to repay the funds or on repayment from specific property pledged by or on the person’s behalf. The revised definition of “creditor” also excluded creditors “that advance funds on behalf of a person for expenses incidental to a service provided by the creditor to that person.”

In the text of the Interim Final Rule, the FTC noted that, while it believes that public comment on the Rule “is unnecessary because the Commission has merely codified” the definition of a “creditor” under the Red Flag Program Clarification Act of 2010, it nonetheless will invite comments to the Rule for a sixty-day period “in order to promote good and open government.” After reviewing any comments received, the Interim Final Rule will then become final.