Podcasts

Community Associations & the United States Red Flag Rule

By David J. Byrne

In 2003, President Bush signed the "Fair & Accurate Credit Transactions Act" into law.   The law was enacted to stem the tide of what was deemed "rampant identity theft".  Congress empowered the Federal Trade Commission ("FTC") to promulgate rules to effectuate the law.  The FTC spent years working on the rules, purportedly trying to balance the need to protect the public against the need to minimize the regulatory burden on business.  Relevant rules were eventually adopted and given a November 1, 2008 effective date.  The concerns of various groups and business leaders vis a vis these rules led to the enactment of the Red Flag Clarification Act.  This law clarified various aspects of this program, including what entities may be a 'creditor'.   
 

The related federal regulations can be found at 16 C.F.R. Sec. 681.  This "Red Flag" rule applies to "Financial Institutions" and "Creditors" (defined as "Covered Entities").  A "creditor" is one that "regularly and ordinarily in the course of business (as relevant to community associations and those who manage them) advances funds on behalf of a person, based on the obligation to repay (does not include a creditor that advances funds on behalf of a person for expenses incidental to a service provided by the creditor to the person.  A "creditor" also includes any other type of creditor as the agency (FTC) may determine appropriate based on a determination that such creditor offers or maintains accounts that are subject to a reasonably foreseeable risk of identity theft.  It is likely that the FTC would consider a community association, and a community association management company, to be a "creditor" for the purpose of the Red Flag rule. 
 

A creditor must develop a written program intended to prevent or mitigate identity theft.  This program must identify the red flags related to the accounts and/or information the creditor maintains.  It must detect the red flags within the program, respond appropriately to any red flags identified and/or detected and ensure the program is updated periodically to reflect changes in risks to customers, members and to protect them from identity theft.  "Red Flags" include:  (1) alerts, notifications and credit reporting agency warnings; (2) suspicious documents; (3) suspicious personal identifying information; (4) suspicious account activity; and (5) notice from other sources (i.e., law enforcement).  Management companies and their community association clients must consider the need for a "Red Flag" privacy officer.  They must review and analyze their dishonesty, errors & omissions, directors and officers and liability policies in relation to this.  Management companies should consider how their existing boilerplate contracts protect them, if at all.  Management companies should also ensure that their compliance with this - and their warnings/directions to boards - are documented. 

Full post as published by New Jersey Law Blog on February 24, 2011 (boomark / email).