The Federal Trade Commission (“FTC”) announced today that, for the third time, it will delay enforcement of the Red Flags Rule until November 1, 2009 – a year after the original November 1, 2008 compliance deadline. In delaying enforcement yet again, the Commission stated that it intends to engage in an “expanded business education campaign” in which the staff will “redouble its efforts to educate [businesses] about compliance.” Such a campaign is designed to “clarify whether businesses are covered by the Rule and what they must do to comply.” The delay does not affect companies subject to the enforcement authority of federal agencies other than the FTC.

The FTC acknowledged that many entities, particularly small businesses and other companies with a low risk of identity theft, remain uncertain about whether they are covered under the Rule, and, if so, what steps they must take to comply. As part of its education campaign, the FTC stated that it plans to create a link on its Red Flags Rule website to provide additional guidance regarding the Rule to small and low-risk entities.  To date, the FTC has provided, among other things, a how-to guide for businesses, FAQs, and an online do-it-yourself Identity Theft Prevention Program for low-risk entities. 

The delay underscores the difficulty the Commission staff has had in anticipating and explaining the precise scope of the Rule – namely what entities are covered the Rule. As a practical matter, the Rules, and the FTC’s interpretation of them, have cast a net so wide so as to ensnare businesses that have not encountered identity theft in their operations and that are not normally subject to the Commission’s jurisdiction.  Indeed, as we have discussed before on this blog, there has been confusion among companies regarding the scope of the Rule. And despite previous delays and additional FTC guidance, many businesses, as well as entire industries, have still been caught off-guard by the Rule.  Nevertheless, the FTC believes that this extension and the new guidance the Commission will provide “should enable businesses to gain a better understanding of the Rule and any obligations that they may have under it.”