On December 18, 2010, President Obama signed the Red Flag Program Clarification Act of 2010.  Effective immediately, the act changes the definition of the word “creditor” in the FTC Red Flags Rule to exclude most professionals that take payment after rendering services.

The Red Flags Rule requires “creditors” and “financial institutions” to address the risk of identity theft by developing and implementing a written prevention program.  As originally written, the Rule defined “creditors” using a very broad definition covering all businesses or organizations that regularly defer payment for goods or services or provide goods or services and bill customers later.  As the FTC noted in its own guidance on the Rule, this definition included most lawyers, medical providers, accountants, and other professionals.  Professional organizations such as the American Bar Association objected in the courts and to Congress that the definition of creditor was broader than necessary to reasonably address identity theft, and pointed out that most legal, medical, and financial professionals are already subject to requirements to protect personal information.

The new definition eliminates from the scope of the definition businesses that merely bill consumers for services previously provided, which was the reason many professional organizations were covered.  Instead, the Act specifies that the term “creditor” applies only to a business or organization “that regularly and in the ordinary course of business— (i) obtains or uses consumer reports, directly or indirectly, in connection with a credit transaction; (ii) furnishes information to consumer reporting agencies, as described in section 623, in connection with a credit transaction; or (iii) advances funds to or on behalf of a person, based on an obligation of the person to repay the funds or repayable from specific property pledged by or on behalf of the person.” The third item does not include funds advanced on behalf of a person “for expenses incidental to a service provided by the creditor to that person.”

The Red Flags Rule was originally scheduled to take effect on March 1, 2008, but enforcement has been postponed several times.  Most recently, enforcement was delayed from June 1, 2010 to January 1, 2011 at Congress’s request.  Those entities that still qualify as creditors under the revised definition should be prepared to comply by the new year, as Congress's stated reason for the extension was to pass this legislation.

For a full summary of the Red Flags Rule, see the previous summary from Digestible Law.

© 2010 Perkins Coie LLP