White Papers
Identity Theft Red Flags Under the Fair and Accurate Credit Transaction Act (FACTA) 2003; Final Rule
The OCC, Board, FDIC, OTS, NCUA and FTC (the Agencies) jointly issued the final rules and guidelines implementing Section 114 of the Fair and Accurate Credit Transaction Act of 2003 (FACTA) and final rules implementing Section 315 of FACTA. The rules require each "financial institution" or "creditor" to develop and implement a written identity theft prevention program to detect, prevent, and mitigate identity theft in connection with certain accounts. The final rules and guidelines became effective January 1, 2008 with mandatory compliance of November 1, 2008. The official enforcement date for most businesses and industries was extended to May 1, 2009 final extension moved to August 1, 2009 in order to allow for certain industries to hear about the rule and to get their written identity theft programs in place. To read the Final Rules click here.
Federal Trade Commissions's Letter to the American Medical Association Regarding Mandatory Red Flags Compliance
The response letter correspondence in which the American Medical Association (AMA), along with 26 other medical associations, challenged the position taken by the Federal Trade Commission (FTC) regarding applicability of the Identity Theft Red Flags Rule ("Red Flags Rule" or "Red Flags Regulations") to physicians and healthcare providers. Outcome... "Congress would need to excluse physicians explicitly from FACTA's definition of creditor for them to be excluded from the Red Flags Rule." To read the entire letter click here.
FTC's Red Flags Rule Affects Colleges
Identity Theft: Red Flags Rule: -- In 2007, the Federal Trade Commission (FTC) and federal banking agencies issued a regulation known as the Red Flags Rule intended to reduce the risk of identity theft. Mandatory compliance with the Red Flags Rule for "creditors" or "financial institutions" that provide "covered accounts began on November 1, 2008 for some businesses and now August 1, 2009 for all others. Parts of the Rule cover many colleges and universities, and as discussed in this paper, the FTC stated that nonprofit and government entitles can be subject to parts of the Rule. Institutions should consult with their legal counsel on applicability of the Rule and should consider establishing an Identity Theft Prevention Program that meets the requirements. See details here
January 29, 2007
CRS Report for Congress, CRS Web
Summary: Personal data security breaches are being reported with increasing regularity. During the past few years, there have been numerous examples of hackers breaking into corporate, government, academic, and personal computers and compromising computer systems or stealing personal data, as well as medical and student records. These breaches occur not only because of illegal or fraudulent attacks by computer hackers, but often because of careless business practices, such as lost or stolen laptop computers, or the inadvertent posting of personal data on public websites. A recent infamous example occurred in May 2006, when a Veterans Affairs data analyst took home a laptop computer containing personal data of 26.5 million veterans, which was later stolen in a burglary. This report catalogs the U.S, data breaches recorded between 2000 - 2007 in the following industries: financial services, education, heath care, government and other business areas. Click here to read the report.
Recommended Practices on Notice of Security Breach Involving Personal Information
February 2007
California Office of Privacy Protection
Summary: Identity theft has been called the crime of the 21st century, favored, according to law enforcement, for its low risks and high rewards. Not only do identity theft victims have to spend money out of pocket to clear up their records, but they also must devote their time to doing so. Precisely how most identity theft occurs and the role of information security breaches is not clear. One academic study found that in over half of the crimes, insiders in organizations were involved. This article outlines recommendations that can serve as guidelines for organizations, to assist them in providing timely and helpful information to individuals whose personal information has been compromised while in the organization's care. Read more...
Remarks of Chairman Deborah Platt Majoras
Prepared by the Federal Trade Commission, September 20, 2006
The FTC Confronts New Security Challenges Through Enforcement, Education and Research
The FTC's goal is to create a culture of security for sensitive information so that businesses and other organizations (including government agencies) prevent potentially harmful data breaches.
Click here...
Vets: Delete Unsolicited Offers by Email: Don't Disclose Personal Information to Unsolicited Callers
FTC Consumer Alert
June 5, 2006, Written in response to the data breach that occurred at the Department of Veterans' Affairs
The FTC offers advice for veterans and their families to deter ill-meaning phishers and callers. Phishing is an email-based scam that appears to come from a bank or other organization that asks you to verify account information, and then directs you to a bogus website whose only purpose is to trick you into divulging your personal information. Click here to read the veteran alert. - Javelin Study & Research - Consumer Survey on Data Breach Notification June 2008
