Federal Trade Commission: Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003
Highlights
GAO reviewed the Federal Trade Commission's (FTC) new rule on identity theft red flags and address discrepancies under the Fair and Accurate Credit Transactions Act of 2003. GAO found that (1) the final rule requires each financial institution or creditor to develop and implement a written Identity Theft Protection Program to detect, prevent, and mitigate identity theft in connection with the opening of certain accounts or certain existing accounts, requires credit and debit card issuers to assess the validity of notifications of changes of address under certain circumstances, and provides guidance regarding reasonable policies and procedures that a user of consumer reports must employ when a consumer reporting agency sends the user a notice of address discrepancy; and (2) FTC complied with the applicable requirements in promulgating the rule.
Federal Trade Commission: Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003, GAO-08-1118R, August 29, 2008
The Honorable Christopher J. Dodd
Chairman
The Honorable Richard C. Shelby
Ranking Minority Member
Committee on Banking, Housing, and Urban Affairs
United States Senate
The Honorable Barney Frank
Chairman
The Honorable Spencer Bachus
Ranking Minority Member
Committee on Financial Services
House of Representatives
Subject: Federal Trade Commission: Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003
Pursuant to section 801(a)(2)(A) of title 5, United States Code, this is our report on a major rule promulgated by the Federal Trade Commission, entitled Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003 (RIN: 3084-AA94). We received the rule on
The final rule was jointly issued by the Federal Trade Commission (Commission); Office of the Comptroller of the Currency, Treasury; Board of Governors of the Federal Reserve System; Federal Deposit Insurance Corporation; Office of Thrift Supervision, Treasury; and the National Credit Union Administration. The final rule implements several sections of the Fair and Accurate Credit Transactions Act of 2003. The final rule requires each financial institution or creditor to develop and implement a written Identity Theft Protection Program to detect, prevent, and mitigate identity theft in connection with the opening of certain accounts or certain existing accounts. The final rule also requires credit and debit card issuers to assess the validity of notifications of changes of address under certain circumstances. Finally, the final rule provides guidance regarding reasonable policies and procedures that a user of consumer reports must employ when a consumer reporting agency sends the user a notice of address discrepancy.
Enclosed is our assessment of the Commission's compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. Our review indicates that the Commission complied with the applicable requirements.
If you have any questions about this report or wish to contact GAO officials responsible for the evaluation work relating to the subject matter of the rule, please contact Michael R. Volpe, Assistant General Counsel, at (202) 512-8236.
signed
Robert J. Cramer
Associate General Counsel
Enclosure
cc: Donald S. Clark
Secretary of the Commission
Federal Trade Commission
ENCLOSURE
REPORT UNDER 5 U.S.C. sect. 801(a)(2)(A) ON A MAJOR RULE
ISSUED BY THE
FEDERAL TRADE COMMISSION
ENTITLED
"IDENTITY THEFT RED FLAGS AND ADDRESS DISCREPANCIES
UNDER THE FAIR AND ACCURATE CREDIT TRANSACTIONS ACT OF 2003"
(RIN: 3084-AA94)
(i) Cost-benefit analysis
The Commission did not prepare a cost-benefit analysis. The Commission did determine that the annual costs of the information collection requirements would be over $150 million.
(ii) Agency actions relevant to the Regulatory Flexibility Act, 5 U.S.C. sections 603-605, 607, and 609
The Commission certified that the final rule will not have a significant economic impact on a substantial number of small business entities.
(iii) Agency actions relevant to sections 202-205 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. sections 1532-1535
As an independent regulatory and law enforcement agency, the Commission is not subject to title II of the Unfunded Mandates Reform Act of 1995.
(iv) Other relevant information or requirements under acts and executive orders
Administrative Procedure Act, 5 U.S.C. sections 551 et seq.
The Commission, along with the other agencies participating in the joint rulemaking, published a joint notice of proposed rulemaking in the Federal Register on
Paperwork Reduction Act, 44 U.S.C. sections 3501-3520
The Commission estimates that the portion of the final rule implementing section 114 will have an average annual information collection burden of 4,466,000 hours and an associated estimated annual labor cost of $142,925,000. FTC estimates that the portion of the final rule implementing section 315 will have an average annual information collection burden of 831,000 hours and an associated estimated annual labor cost of $13,296,000.
Statutory authorization for the rule
This final rule is authorized by sections 114 and 315 of the Fair and Accurate Credit Transactions Act of 2003. Pub. L. 108-159, 117 Stat. 1952. 15 U.S.C. sections 1681c, 1681m.
Executive Order No. 12,866
As an independent agency, the Commission is not subject to the review requirements of the order.