Forum: pol
Page 3289
Subject: Curious to hear from those in the legal community.

  Posted by: sarge33rd - [42357299] Wed, Apr 29, 2009, 16:19
The FTC in 2007, published what they call the "Red Flags Rules (CFR 681) which took effect Jan 1, 2008 with a suspended FTC enforcement date of Nov 1, 2008. Then in Oct, they (the FTC) deferred enforcement until May 1, 2009 since it was apparent that HUGE numbersof companies had no idea they were subject to the law and had taken zero steps toward compliance. (Namely, public utilities and the like)

FTC press release dtd Oct 22, 2008

OK, here we are, a mere couple days before the FTC can begin handing down fines, and STILL I find most companies are entirely ignorant of the very existance of the law, let alone its applicability to them as a company. Te key, is thre federal definition of a "creditor". The ECOA, defines a creditor as "one who extends or arranges for the extension of credit". Now, this obviously applies to automotive dealerships. It also, applies to that national jewelry chain in the mall, where they call in credit card applications, to credit collection agencies (since in negotiating a repayment plan they are in affect extending credit), public utilities (in that they provide service and bill you after the fact and you have therefore purchased electricity on credit), etc etc etc


Now for my question: How many attorneys, are looking at this law as a license to file suit?
 
1DWetzel
      ID: 278201415
      Thu, Apr 30, 2009, 10:28 		Minor quibble--third paragraph, middle: "Accepting credit cards as a form of payment does not, in and of itself, make an entity a creditor."

So that would seem to exclude that jewelry company in the mall (except for the things they put on layaway, I guess).
 
2sarge33rd
      ID: 42357299
      Thu, Apr 30, 2009, 11:39 		Not at all. The taking of the credit application and calling it in for approval is what I refer to.

Jewelry store chains, big box retailers, ANYBODY who processes ANY application for credit; is subject to this law.
 
3sarge33rd
      ID: 42357299
      Thu, Apr 30, 2009, 11:44 		For ex; when we moved in and called the power copmany to start up...they wanted ful names and SSAn over the phone so they could run a credit check. ILLEGAL. There exists no mechanism of which I am w=aware; which would verify that the person on the other end of the phone *IS* in fact, the person whose confidential information is being provided. IOW, they have no means, of knowing if it is me giving my info, or me giving your info, or you giving my info, or....

W/O verification of the identity of the person providing the info; it is illegal to process the application. The bureau, is step one in processing and is therefore not eligible to be pulled.
 
4Seattle Zen
      ID: 183223010
      Thu, Apr 30, 2009, 12:23 		"Accepting credit cards as a form of payment does not, in and of itself, make an entity a creditor."

No, it would exclude the grocery store where you can swipe your CC to buy beer and tampons.

Sarge, this topic doesn't interest me as it does you. I doubt the law gives private attorneys the ability to file a lawsuit for damages if some place does not follow the rules. I would think if some place is not following the rules, the FTC could enforce them. It's a real yawner to me.

I didn't think a respectable power company would offer service to a gypsy like you :)



Here's a picture of sarge with one of his wives, motorcycle helmets are right behind them :)
 
5sarge33rd
      ID: 42357299
      Thu, Apr 30, 2009, 12:26 		The law requires "creditors" to install processes to "detect, prevent and mitigate" ID Theft. It also provides for damages equal to three-times the actual damages for those who "suffer loss" as a result of a creditors failure to properly comply.

This opens (in my world) HUGE cans of worms and not just for dealerships. But retailers of all sorts.
 
6Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 12:53 		This looks more like a pro-business set of rules than pro-consumer (it was promulgated by the Bush administration, so what are the odds?). Basically if a business has a two-page anti-identity theft procedure, then they are off the hook for damages. I assume that before this, a business could be sued for not using due diligence in accepting credit.
 
7sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 12:57 		2 pages???? lol Try 48 and counting.

Code specifies that the Bd of Directors is liable and must sign off on a "Compliance Officer" and on the Policy Manual. CO is tasked with establishing a formal training program and conducting the training for ALL relevant personnel, and maintaining documentation of such training. The FTC identifies 26 specific Red Flags and states that the list is not exhaustive. Each and every "Red Flag", must have a specific procedure in place for resolution before the application can proceed. The code further specifies that recurrent training must take place.

If a Red Flag is encountered and resolved, the business is responsible for notifying all 3 bureaus both of the Red Flag and the resolution.

With fines of 50k for having an improper manual, and 3500 per person not properly trained/documented; I hardly find this to be "pro business".
 
8Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 13:22 		Maybe we're doing it wrong, but that's totally different than our experience with it. If you feel the need to write that many pages, go for it. We run a very small business, and I work part time for another small business. My wife's also on two Denver metro area chambers of commerce. All the plans we've seen are about 3 to 8 pages. We basically just shared with several other companies' plans, deleted their names and added ours. Takes an hour or two. Lots of professional organizations and chambers of commerce have developed plans for their members. Just google for "sample Red Flag Rule plan" or similar. I just did and most are under 10 pages.
 
9sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 13:29 		Non-compliant. The Code states explicitly, that each creditor must have a manual specifically for its operation. Since it is almost impossible for 2 unrelated organizations (different ownership for ex), to have absolutely identical operational processes, it is equally impossible for two different organizations to have identical manuals.

If your manual is 2 pages long, rest assured, you are a long, LONG ways short of being compliant.
 
10Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 13:42 		All that means is you must fill in your company's name and the names of the responsible officers. What constitutes a red flag, the entities that you report them to, and the entitites that provide that information ARE the same for every company. The only thing that is different is who at YOUR company is responsible for following the rule.

You are reading way too much into this, Sarge. For example, here's the first hit on said google search, the policy developed by the American Medical Association for their members to use. It's four pages long. Now if you think you have a better grasp of the law than the AMA's lawyers, again, write a 40+ page procedure. We're not going to.
 
11Perm Dude
      ID: 343113011
      Thu, Apr 30, 2009, 13:49 		You are reading way too much into this, Sarge

Exactly.

This is pro-business because it offers companies protection if they follow the rules about protecting the private information about their customers. Businesses have been very, very lax about these kinds of procedures in the past, which is why over $1 billion/year is lost by consumers under various identity theft schemes.
 
12sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 13:51 		Oh I do. Consult with multiple civil suit lawyers heavily involved in the auto and powersports industries, coupled with more than a few seminars on this very topic would indicate to me that a HUGE number of so called "authorities" out there, don't have a clue.

The AMA would be far more heavily involved in HIPPA and the GLB Safeguards Rules, than they would with the RFR. Their requirements are not the same.

For ex, the RFR requires that each business verify that ALL of it's partner businesses (lenders and vendors) are compliant with RFR. Phone conversation with the FTC Enforcement personnel, indicate that a letter in the form of a sworn affadavit stating they are in compliance does NOT fulfill that obligation. In order to verify that your partner businesses are compliant, you MUST have on hand at your location, a copy of their RFR manual. And they in turn, must have a copy of yours. Rest assured, you send HSBC for ex a 2 pg manual, and they will respond by telling you that you are out of compliance.
 
13sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 13:53 		That some business entities have been lax is without question. But more than a few consumers have been terribly flippant about the security of their personal data as well. One of the favored methods of 'mining' for info, is to simply dumpster dive thru a residents trash.
 
14Perm Dude
      ID: 343113011
      Thu, Apr 30, 2009, 13:56 		The AMA is heavily involved in rules requiring protection of patients rights and private information.

In order to verify that your partner businesses are compliant, you MUST have on hand at your location, a copy of their RFR manual.

I don't believe this is true. You're getting scary untrue information.
 
15sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 13:58 		That info, came from a phone conversation I had with a member of the FTCs RFR Enforcement Division. Pretty sure, the info is sound, solid and correct.
 
16sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 14:07 		The AMA is heavily involved in rules requiring protection of patients rights and private information.

Very, very true. And why I said it involves HIPPA and the Graham-Leach-Bliley Safeguards Rues more than the RFR. RFR deals with the obtaining of personal info FOR THE EXPRESS PURPOSE of granting or arranging credit. Safeguards Rules, deals with how personal information is stored ONCE it is gathered. The two are complimentary, but not the same things.
 
17Perm Dude
      ID: 343113011
      Thu, Apr 30, 2009, 14:09 		No, it isn't. Either you misunderstood the requirements for verifying compliance, or the information was presented in a factually inaccurate way.

This section from the FTC should go some way toward lowering the panic level:

The Red Flags Rules provide all financial institutions and creditors the opportunity to design and implement a program that is appropriate to their size and complexity, as well as the nature of their operations. Guidelines issued by the FTC, the federal banking agencies, and the NCUA (ftc.gov/opa/2007/10/redflag.shtm) should be helpful in assisting covered entities in designing their programs. A supplement to the Guidelines identifies 26 possible red flags. These red flags are not a checklist, but rather, are examples that financial institutions and creditors may want to use as a starting point. They fall into five categories:
# alerts, notifications, or warnings from a consumer reporting agency;
# suspicious documents;
# suspicious personally identifying information, such as a suspicious address;
# unusual use of – or suspicious activity relating to – a covered account; and
# notices from customers, victims of identity theft, law enforcement authorities, or other businesses about possible identity theft in connection with covered accounts.



Note that these are guidelines (not rules), are intended to direct size and complexity-appropriate programs, and are intended as examples only.
 
18sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 14:16 		PD, I've attended multiple seminars, I've had phone cons WITH the FTC relative to this topic on multiple occassions. I consult with dealerships to make them compliant. The FTC identified 26 specific RedFlags and stipulates that at a minimum each of those must be covered by the RFR Manual. They further state, that they may be additional red Flags, depending upon the experience of the business entity involved.

True, that for some businesses, some of the specified Red Fags will not be applicable. This simply requires in the addendum elaborating on each Red Flag, that this particular one is N/A to our business model. It STILL must be addressed however in the manual.

The Code itself, is 314 pages long. How in the world, can one establish a policy manual n 2 pages, detailing processes to comply with a 300+ pg legal code? Easy answer is...you can't.

As for misunderstanding...not possible.

I specifically asked the FTC Investigator, if a sworn affadavit from the business partners/vendors would suffice, or do we need a copy of their manual or is there another method?

His answer was short and to the point...You need a copy of their manual, and they need a copy of yours.

Not much room there, for misunderstanding.
 
19Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 14:44 		Here's the National Independent Automobile Dealers Association's (NIADA) sample, simple, fill-in the blank policy for it's members. Seven pages total.
 
20Perm Dude
      ID: 343113011
      Thu, Apr 30, 2009, 14:58 		#18: Not much room there, for misunderstanding.

He's wrong. Can't get clearer than that. You need to verify, and the method is up to you. Having their manual is certainly the best way, but the language of the FTC rules make it clear that you have flexibility in all areas, including this one.

This may shock you that someone on the government payroll is wrong about the very area in which they are hired to operate. It is a rare but not-unheard of thing.

:)
 
21sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 15:31 		Of course PD. The FTC's RFR Enforcement Division is wrong, and you're not. *shrug* Ohhhhhhhhhh-Kay.

Let's examine this one aspect for a moment then. Since it is a given that the FTC will not accept a letter in the form of a sworn statement attesting to a business partners compliance; what would YOU do, to ensure that said business partner is compliant, so as to fulfill the obligation the RFR places upon you to ensure that you business partners are compliant? If not having a copy of their Manual, what then would you do specifically, to ensure compliance and thus be compliant yourself?


(There are reasons beyond the current banking fiasco that banks like Wells Fargo terminated ALL indirect lending through dealerships across the country, despite it's having long been very profitable for them. They had over 10,000 dealers writing loans indirectly. They really, REALLY didn't want to have to publish 10,000 extra copies of their multi-volume policy manual and distribute it to over 10,000 places; nor did they want to have store 10,000 plus manuals from others.)
 
22Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 15:36 		Sarge, here's NIADA's partner/vendor agreement form for RFR: linky

A simple letter/affidavit seems to work for them, but what do they know about automobile sales and finance? Oh wait....
 
23sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 15:40 		They may hope it's sufficient. But I have it directly from an FTC Investigator, that it is not. Now, whose word would you advise a client to take? Their national marketing groups, or that of the investigative authority?
 
24Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 15:43 		RE: 23
I'd advise them to follow the CFR, which every other industry seems to be doing, and not follow the unofficial, undocumented word of an anonymous "Investigator".

 
25Boldwin
      ID: 133532810
      Thu, Apr 30, 2009, 15:45 		This is pro-business - PD

Alternate universes just fascinate the cosmologist in me.
 
26sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 15:47 		Then answer the question posed in 23 above? How else would you verify compliance by anoth4r business, given that a letter/affadavit will get you fined for non-compliance?

I contacted the FTCs RFR Enforcement Division, after getting a hard-copy of a newsletter sent out by Har;ed-Davidson finance; advising it's dealer body that all they had to do to be compliant was to cease pulling credit reports and send applications ONLY to Harley-Davidson Financial Services. This newsletter contained contact information for it's author and was in direct conflict with my understanding of the then impending regulations. (Last Oct, prior to the enforcement date being deferred to May 1, 2009) The investigator and I had about a 1 hour phone-con and we have spoken multiple times since then, to further clarify various points of contention.
 
27Perm Dude
      ID: 343113011
      Thu, Apr 30, 2009, 15:48 		Don't stop at just three words, Baldwin.

#24: Exactly. No doubt, this "investigator" is looking to leave the FTC and drum up a business writing compliance documentation from the people he's scaring.
 
28sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 15:49 		Odd. The fines can start falling as early as tomorrow, and as recently as a month ago; he was still with the FTC.
 
29Boldwin
      ID: 133532810
      Thu, Apr 30, 2009, 15:51 		I propose we wrap PD in a giant ball of red tape, roll him down wall street, and make a viral you-tube explaining how red tape makes the business world go round.
 
30Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 15:55 		My point, Sarge, is that after 29+ years working with/for the Feds I know this, if it ain't in writing, it ain't true. You're doing yourself and your employer a disservice if you can't find this partner/vendor thingy in the CFR or don't have an official letter from the FTC verifying your phone conversation.
 
31Perm Dude
      ID: 343113011
      Thu, Apr 30, 2009, 15:56 		Baldwin, I propose you read each word in a post before responding. This might not be your usual method of communication, but IRL people actually have to hear something before finding it objectionable.

The whole point of what the FTC is doing is offering guidelines in the handling of private customer information (the handling of which is universally acknowledged to be lax). Maybe you consider the threat of lawsuits to be "pro-business"--I no longer care to know how your mind works. But protecting businesses from lawsuits through the compliance of measures designed to follow the law is a good thing for businesses.
 
32sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 16:01 		re 30...who said it isnt in the CFR? It is. The 'how; you verify their compliance is not specified, but since it seems you and others here take exception to my position (and that of the investigators), that a letter is insufficient; I have asked and am continuing to ask...how ELSE would you verify the compliance of a lender partner for ex, other than by having a copy of their policy manual?
 
33Boldwin
      ID: 133532810
      Thu, Apr 30, 2009, 16:02 		If you want to know how my brain processes this issue, just imagine a one man business trying to guarantee compliance at a reasonable cost in effort and to a reasonable degree of certainty.

It cannot be done.

This is another in a never ending series of pernicious big government meddling designed to freeze out the average man from participation in the capitalist system.
 
34sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 16:11 		Balrog...if in the course of oyur normal busness activity you do not access consumer credit reports then yes your manual/processes will be vastly simplified vs a company which does pull said reports. Why? Because you will never encounter an address discrepancy, or SSAN discrepancy, or employment history discrepancy since these all show up via the consumer credit report. Your manual would still though, have to be somewhere around 6-8 pages in total length minimum. As you must address each of the Red Flags identified and how you would handle them. If not pulling credit reports, you would simply list the specific Red Flag and then indicate N/A to your business model.

For my part however, every business I deal with DOES pull consumer credit reports and therefore must go into detail as to how they are to resolve each specific Red Flag. This adds HUGELY to the overall size of the final text.
 
35sarge33rd
      ID: 173573011
      Thu, Apr 30, 2009, 16:12 		Actually Boldy what it is, is yet again the individual is being largely excused from liability/responsibility and the onus is being put upon another entity. In this case, business.
 
36Boldwin
      ID: 133532810
      Thu, Apr 30, 2009, 16:22 		I consider each American a potential businessman.
 
37Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 16:51 		RE: 32

OK sarge, you've spent all this time preparing this 40+ page policy, you've been to all the seminars, etc. Surely you can give me a quick link to where in the CFR it says you have to have the manuals of all your financial/credit partners/vendors.

RE: 33

Again, as a small business OWNER ten years in, this is a good thing for business, IMHO.
 
38Perm Dude
      ID: 343113011
      Thu, Apr 30, 2009, 16:56 		Ditto. I've owned my own business for about 12 years, FWIW.

[Also FWIW, I'm running for Mayor of my town on a strictly pro-business platform]
 
39Tree
      ID: 41371322
      Thu, Apr 30, 2009, 17:12 		PD and Balrog are both clearly BOINOs. After all, Baldwin knows what he's talking about.
 
40sarge33rd
      ID: 563543016
      Thu, Apr 30, 2009, 17:55 		re 37:


Let me saym for about the 3rd time. The RFR as published state only that you as a creditor must ensure that all of your business patners are compliant. When I asked the FTCs Investigator (you know, the guy who is going to issue a fine or not for non-compliance?), if a letter form affadavit of compliance would suffice, or if my clients needed to have a hard copy of their partners manuals or if there was another means, what would he suggest.....his answer was "They need a copy of your manual and you need a copy of theirs"


Now, take that for what it is worth. But my clients, will not be fined, because they HAVE shared their manual with their business partners and they HAVE copies of those affiliated businesses manuals.


Maybe you get fined, maybe you dont. Maybe, you can even beat the fine if it comes. But my clients will NOT be fined, and THAT is my job as a consultant. (You want specfic chapter references etc like my clients get when I survey? That isnt free)
 
41sarge33rd
      ID: 563543016
      Thu, Apr 30, 2009, 19:02 		and FWIW,the NIADA is the National INDEPENDENT Auto Dealers Association. I've worked with Independents before. They aren't franchise dealers, because they dont like rules. Compliance, is the LAST thing they give a damn about.
 
42Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 20:07 		Just trying to help ya sarge. If you don't want help, then by all means, carry on.
 
43sarge33rd
      ID: 563543016
      Thu, Apr 30, 2009, 20:16 		Balrog, you have it bass-ackwards. It isn't me in need of help.
 
44Seattle Zen
      ID: 23363016
      Thu, Apr 30, 2009, 21:01 		That's the ol' sarge. Start a thread that's ostensibly a discussion over a regulation, but really it's just sarge telling us what the law IS in all-caps, gearing up to shout down anyone who joins in the conversation.

Sarge, you've been to the seminars, that's great. Not everyone is going to agree with the way you have interpreted these regulations and if you want to have a discussion about them, you might want to consider differing opinions.

I'm with Balrog, an offhand quote from a FTC employee is not the end of discussion.
 
45Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 21:09 		OK sarge, I admit, it's me that needs help. When I asked you for help on this regarding the codification of the "partner/vendor" manual thingy, you have thrice failed to point me to the lines in the CFR that ask for it. Your most direct response was "Who says it isn't in the CFR?"

Well, I say it isn't in the CFR. If I'm right, you're wrong. If you're right, prove it. It's all online. After all your research, you should have it at your fingertips.
 
46sarge33rd
      ID: 563543016
      Thu, Apr 30, 2009, 21:43 		Sect 1 (B), pg 3:

•
Identify those Red Flags that are relevant to detecting a possible risk of identity theft to customers or to the safety and soundness of the financial institution or creditor;
•
Verify the identity of persons opening accounts;
•
Detect the Red Flags that the financial institution or creditor identifies as relevant in connection with the opening of an account or any existing account;
•
Assess whether the Red Flags detected evidence a risk of identity theft;
•
Mitigate the risk of identity theft, commensurate with the degree of risk posed;
•
Train staff to implement the Program; and
•
Oversee service provider arrangements.

Section .90(b)(6) Definitions

6. Service Provider. The proposed definition of ‘‘service provider’’ is a person that provides a service directly to the financial institution or creditor.

There.
 
47sarge33rd
      ID: 563543016
      Thu, Apr 30, 2009, 22:06 		or read 681.2 (b)(10) and 681.2(e)(4)
 
48Balrog
      Dude
      ID: 02856618
      Thu, Apr 30, 2009, 23:55 		I may be stupid, but I don't see the "manual" thingy anywhere in your last post. I won't ask again for a fourth time, because I know you don't have anything except "some guy" told me. Sorry sarge, but I got a business to run. Don't have time for "some guy" said I have to do something.
 
49sarge33rd
      ID: 563543016
      Fri, May 01, 2009, 05:01 		You dont have time, for the FTC's own clarification? *IF* the sh*t hits the fan, please let us all know how well that defense works for you.
 
50sarge33rd
      ID: 563543016
      Fri, May 01, 2009, 05:12 		FTC Delays RFR Enforcement for 3 more months

I don't know I guess....seems to me, that 3 months more following the 6 months previously, which followed the 10 month initial deferral; would be excessive delay in enforcement if it were such a simple thing to comply with. Wonder if just maybe; compliance isn't ALL that friggin simple afterall?
 
51sarge33rd
      ID: 563543016
      Fri, May 01, 2009, 06:46 		That's the ol' sarge. Start a thread that's ostensibly a discussion over a regulation, but really it's just sarge telling us what the law IS in all-caps, gearing up to shout down anyone who joins in the conversation.


Actually SZ, I was indeed looking for input from those in the legal profession, not those who may or may not be impacted by this law; since there is SO much contrary information out there. Unless one is intimately familiar with it and has been working with it and the FTC for some time, the conflicting info out there is over-whelming.

That a singular individual within the FTC says something, does not make it so. This is true. However, when that singular individual is in the Enforcement Office for this very set of Rules; and is therefore one of those who would ostensibly be issuing the findings/fines; I think it only prudent to heed his/her advice. Could they be wrong? Of course. But how much time/money would one have to expend in fighting the fine in order to establish that? Compare that to what it costs to go with their advice in the first place, and which route would you be advising your clients to take?
 
52Frick
      ID: 3410551012
      Fri, May 01, 2009, 08:55 		They also could have been write with their interpretation before, but a new administration has decided to interpret the legislation differently.

And as for the delays, how many stations aren't ready to go all digital at this point? But when will it actually take effect? The delay isn't the result of technical issues, it's the result of the fear of political fall-out.