Red Flag Rule Exemption Unlikely to Include Most Colleges

Last December, the Red Flag Clarification Act of 2010 was enacted, in an attempt to limit the entities required to develop and implement written identity theft prevention programs.  Some college officials thought they might be excused from the Red Flag rules, which are primarily targeted to financial institutions and creditors. However, it now appears unlikely that most colleges will be excused after all.

Under the Red Flag rule, creditors and financial institutions have to comply with the red flag requirements of their regulatory agency.  For colleges, this is the Federal Trade Commission (FTC).

The partial exemption legislation offered by Sen. John Thune (R-S.D.), supported by the American Medical Association and American Bar Association, was intended to exempt doctor's and lawyer's practices, as well as small businesses.  According to Thune's staff, the bill also was supposed to exempt colleges from the red flag rule that went into effect for colleges as of January 1, 2011. That may not be the case, though, since Thune's exemption applies to only a subgroup of all the creditors and financial institutions that must comply with the red flag legislation.

The legislation provides three definitions of a creditor, and the exemption applies only to the third of the three. A creditor is one who:  (1) uses consumer reports in connection with a credit transaction, (2) furnishes information to consumer reporting agencies, or (3) advances funds based on an obligation of the recipient to repay.

The exemption to (3) is for a creditor that advances funds on behalf of a person for expenses incidental to a service provided by the creditor to that person. It does include, however, any other type of creditor that the creditor's regulatory agency determines offers or maintains accounts that are subject to a reasonably foreseeable risk of identity theft.  Whether or not colleges are exempt under (3), some experts think that colleges still may not qualify because they have to report to credit bureaus (2), or because they provide loans.

In the meantime, many colleges are already in compliance.  NAICU has initiated various requests for clarification of the clarification.  From what we understand, the FTC may issue its own clarification of the exemption, but we don't yet have clarification on when this might happen.

For more information, please contact:
Maureen Budetti