Phone: 630-495-2282 Fax: 630-495-2260 Map/Directions

Record crowd attends CATA seminar on Red Flags Rule compliance

November 17, 2010

With the clock ticking closer to a Nov. 1 compliance deadline, a don’t-tell-the-fire-marshal sized crowd squeezed into the CATA offices recently for guidance on meeting the requirements of the latest federal mandate.

By Nov. 1, every dealership must draft an Identity Theft Prevention Program, and the dealership’s board or appropriate board committee must approve the ITPP. If the dealership does not have a board, a senior management employee must approve the ITPP.

It’s all part of the Red Flags Rule, which is the Federal Trade Commission’s next step following the 2003 "Safeguards Rule." The Safeguards Rule forces dealers to protect the sensitive information collected from customers, so that identity theft cannot be committed. The Red Flags Rule examines the other side of the coin: If a dealer encounters an ID thief, take steps to halt any transaction.

The new Rule forces "financial institutions" and "creditors" to comply with the Rule. Dealerships are swept up in the matter because the FTC defines dealers as creditors.

In summary, if a dealer can’t form a reasonable belief under his ITPP that a credit report relates to the customer before him, the transaction must be aborted.

About 200 people packed the CATA on Oct. 3 for a review of the new mandate by Bradley Miller, an attorney with the National Automobile Dealers Association. The NADA produced an invaluable pamphlet on the matter in August called "A Dealer Guide to the FTC Red Flags and Address Discrepancy Rules: Protecting AgainstIdentity Theft."

"You don’t have a duty not to do business with someone, but you do have a duty not to allow identity theft," Miller said.

Miller, in his presentation, continuously referenced the publication, which includes an ITPP template that a dealer would have to customize for his dealership. The NADA mailed the publication to all its members in August. Additional copies can be purchased for $40 for NADA members; $80 for nonmembers. Call 800-252-6232 ext. 2.

An ITPP must contain reasonable procedures to identify, detect and respond to "red flags" that indicate the possibility of identify theft. Senior management must be involved in approving the initial written program and implementing and administering the program thereafter.

The program must be updated periodically to reflect changing identity theft risks; staff must be trained to implement the program; and appropriate oversight of any service providers must be exercised.