83 FR 39096 - Agency Information Collection Activities; Proposed Collection; Comment Request

FEDERAL TRADE COMMISSION

Federal Register Volume 83, Issue 153 (August 8, 2018)

Page Range		39096-39100
FR Document		2018-16936

The FTC intends to ask the Office of Management and Budget (``OMB'') to extend for an additional three years the current Paperwork Reduction Act (``PRA'') clearance for the information collection requirements in the FTC Red Flags, Card Issuers, and Address Discrepancies Rules \1\ (``Rules''). That clearance expires on November 30, 2018. ---------------------------------------------------------------------------

Federal Register, Volume 83 Issue 153 (Wednesday, August 8, 2018)

[Federal Register Volume 83, Number 153 (Wednesday, August 8, 2018)]
[Notices]
[Pages 39096-39100]
From the Federal Register Online [www.thefederalregister.org]
[FR Doc No: 2018-16936]

-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

Agency Information Collection Activities; Proposed Collection;
Comment Request

AGENCY: Federal Trade Commission (``FTC'' or ``Commission'').

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The FTC intends to ask the Office of Management and Budget
(``OMB'') to extend for an additional three years the current Paperwork
Reduction Act (``PRA'') clearance for the information collection
requirements in the FTC Red Flags, Card Issuers, and Address
Discrepancies Rules \1\ (``Rules''). That clearance expires on November
30, 2018.
---------------------------------------------------------------------------

\1\ 16 CFR 681.1 (Duties regarding the detection, prevention,
and mitigation of identity theft); 16 CFR 681.2 (Duties of card
issuers regarding changes of address); 16 CFR 641.1 (Duties of users
of consumer reports regarding address discrepancies).

---------------------------------------------------------------------------
DATES: Comments must be submitted by October 9, 2018.

ADDRESSES: Interested parties may file a comment online or on paper by
following the instructions in the Request for Comment part of the
SUPPLEMENTARY INFORMATION section below. Write ``Red Flags Rule, PRA
Comment, Project No. P095406'' on your comment. File your comment
online at https://ftcpublic.commentworks.com/ftc/RedFlagsPRA by
following the instructions on the web-based form. If you prefer to file
your comment on paper, mail your comment to the following address:
Federal Trade Commission, Office of the Secretary, 600 Pennsylvania
Avenue NW, Suite CC-5610 (Annex J), Washington, DC 20580, or deliver
your comment to the following address: Federal Trade Commission, Office
of the Secretary, Constitution Center, 400 7th Street SW, 5th Floor,
Suite 5610 (Annex J), Washington, DC 20024.

FOR FURTHER INFORMATION CONTACT: Requests for additional information
should be addressed to Mark Eichorn, Assistant Director, Division of
Privacy and Identity Protection, Bureau of Consumer Protection, (202)
326-3053, Federal Trade Commission, 600 Pennsylvania Avenue NW,
Washington, DC 20580.

[[Page 39097]]

SUPPLEMENTARY INFORMATION:

I. Overview of the Rules

The Red Flags Rule requires financial institutions and certain
creditors to develop and implement written Identity Theft Prevention
Programs (``Program''). The Card Issuers Rule requires credit and debit
card issuers (``card issuers'') to assess the validity of notifications
of address changes under certain circumstances. The Address Discrepancy
Rule provides guidance on what users of consumer reports must do when
they receive a notice of address discrepancy from a nationwide consumer
reporting agency (``CRA''). Collectively, these three anti-identity
theft provisions are intended to prevent impostors from misusing
another person's personal information for a fraudulent purpose.
The Rules implement sections 114 and 315 of the FACT Act, Public
Law 108-159, which amended the Fair Credit Reporting Act (``FCRA''), 15
U.S.C. 1681 et seq., to require businesses to undertake measures to
prevent identity theft and increase the accuracy of consumer reports.
Since promulgation of the original Rule, President Obama signed the
Red Flag Program Clarification Act of 2010 (``Clarification Act''),
which narrowed the definition of ``creditor'' for purposes of the Red
Flags Rule. Specifically, the Clarification Act limits application of
the Red Flags Rule to creditors that regularly and in the ordinary
course of business: (1) Obtain or use consumer reports, directly or
indirectly, in connection with a credit transaction; (2) furnish
information to consumer reporting agencies in connection with a credit
transaction; or (3) advance funds to or on behalf of a person, based on
an obligation of the person to repay the funds or to make repayment
from specific property pledged by or on behalf of the person. This
third prong does not include a creditor that advances funds on behalf
of a person for expenses incidental to a service provided by the
creditor to that person.

II. Description of Collection of Information

A. FACT Act Section 114

The FTC Red Flags and Card Issuers Rules implement requirements
under Section 114 of the FACT Act. The Red Flags Rule requires
financial institutions and covered creditors to develop and implement a
written Program to detect, prevent, and mitigate identity theft in
connection with existing accounts or the opening of new accounts. Under
the Rule, financial institutions and certain creditors must conduct a
periodic risk assessment to determine if they maintain ``covered
accounts.'' The Rule defines the term ``covered account'' as either:
(1) A consumer account that is designed to permit multiple payments or
transactions, or (2) any other account for which there is a reasonably
foreseeable risk of identity theft. Each financial institution and
covered creditor that has covered accounts must create a written
Program that contains reasonable policies and procedures to identify
relevant indicators of the possible existence of identity theft (``red
flags''); detect red flags that have been incorporated into the
Program; respond appropriately to any red flags that are detected to
prevent and mitigate identity theft; and update the Program
periodically to ensure it reflects change in risks to customers.
The Red Flags Rule also requires financial institutions and covered
creditors to: (1) Obtain approval of the initial written Program by the
board of directors; a committee thereof; or, if there is no board, an
appropriate senior employee; (2) ensure oversight of the development,
implementation, and administration of the Program; and (3) exercise
appropriate and effective oversight of service provider arrangements.
In addition, the Card Issuers Rule requires that card issuers
generally must assess the validity of change of address notifications.
Specifically, if the card issuer receives a notice of change of address
for an existing account and, within a short period of time (during at
least the first 30 days), receives a request for an additional or
replacement card for the same account, the issuer must follow
reasonable policies and procedures to assess the validity of the change
of address.

B. FACT Act Section 315

In implementing section 315 of the FACT Act, the Address
Discrepancies Rule requires each user of consumer reports to have
reasonable policies and procedures in place to employ when the user
receives a notice of address discrepancy from a CRA. Specifically, each
user must develop reasonable policies and procedures to: (1) Enable the
user to form a reasonable belief that a consumer report relates to the
consumer about whom it has requested the report; and (2) in certain
circumstances, provide to the CRA from which it received the notice an
address for the consumer that the user has reasonably confirmed is
accurate.

II. Burden Estimates

Under the PRA, 44 U.S.C. 3501-3521, Federal agencies must get OMB
approval for each collection of information they conduct or sponsor.
``Collection of information'' includes agency requests or requirements
to submit reports, keep records, or provide information to a third
party. 44 U.S.C. 3502(3); 5 CFR 1320.3(c). The figures below reflect
FTC staff's estimates of the hours burden and labor costs to complete
the tasks described above that fall within reporting, disclosure, or
recordkeeping requirements. FTC staff believes that the Rules impose
negligible capital or other non-labor costs, as the affected entities
are likely to have the necessary supplies and/or equipment already
(e.g. offices and computers) for the information collection described
herein.
Overall estimated burden hours regarding sections 114 and 315,
combined, total 2,296,863 hours and the associated estimated labor
costs are $92,465,982.

A. FACT Act Section 114

1. Estimated Hours Burden--Red Flags Rule
As noted above, the Rule requires financial institutions and
certain creditors with covered accounts to develop and implement a
written Program. Under the FCRA, financial institutions over which the
FTC has jurisdiction include state chartered credit unions and certain
insurance companies, among other entities.
Although narrowed by the Clarification Act, the definition of
``creditor'' still covers a broad array of entities, and application of
the Rule depends upon an entity's course of conduct, not its status as
a particular type of business. For these reasons, it is difficult to
determine precisely the number of creditors subject to the FTC's
jurisdiction. There are numerous small businesses under the FTC's
jurisdiction that may qualify as ``creditors,'' and there is no formal
way to track them. Nonetheless, FTC staff estimates that the Rule's
requirement to have a written Program affects 6,278 financial
institutions \2\ and 157,585 creditors.\3\
---------------------------------------------------------------------------

\2\ The total number of financial institutions is derived from
an analysis of state credit unions and insurers within the FTC's
jurisdiction using 2015 Census data (``County Business Patterns,''
U.S.) and other online industry data.
\3\ The total number of creditors (157,585) is derived mostly
from an analysis of 2015 Census data and industry data for
businesses or organizations that market goods and services to
consumers or other businesses or organizations subject to the FTC's
jurisdiction, reduced by (1) entities not likely to obtain credit
reports, report credit transactions, or advance loans; and (2)
entities not likely to have covered accounts under the Rule.

---------------------------------------------------------------------------

[[Page 39098]]

To estimate burden hours for the Red Flags Rule under section 114,
FTC staff divided affected entities into two categories, based on the
nature of their business: (1) Entities that are subject to high risk of
identity theft, and (2) entities that are subject to a low risk of
identity theft, but have covered accounts that will require them to
have a written Program.
a. High-Risk Entities
FTC staff estimates that high-risk entities \4\ will each require
25 hours to create and implement a written Program, with an annual
recurring burden of one hour. FTC staff anticipates that these entities
will incorporate into their Program policies and procedures that they
likely already have in place. Further, FTC staff estimates that
preparation for an annual report will require each high-risk entity
four hours initially, with an annual recurring burden of one hour.
Finally, FTC staff believes that many of the high-risk entities, as
part of their usual and customary business practice, already take steps
to minimize losses due to fraud, including conducting employee
training. Accordingly, only relevant staff need be trained to implement
the Program: for example, staff already trained as part of a covered
entity's anti-fraud prevention efforts do not need to be re-trained.
FTC staff estimates that training connected with the implementation of
a Program of a high-risk entity will require four hours, and annual
training thereafter will require one hour.
---------------------------------------------------------------------------

\4\ High-risk entities include, for example, financial
institutions within the FTC's jurisdiction and utilities, motor
vehicle dealerships, telecommunications firms, colleges and
universities, and hospitals.
---------------------------------------------------------------------------

Thus, estimated hours for high-risk entities are as follows:
94,052 high-risk entities subject to the FTC's
jurisdiction at an average annual burden of 13 hours per entity
[average annual burden over 3-year clearance period for creation and
implementation of a Program ((25 + 1 + 1) hours/3), plus average annual
burden over 3-year clearance period for staff training ((4 + 1 + 1)
hours/3), plus average annual burden over 3-year clearance period for
preparing an annual report ((4 + 1 + 1) hours/3)], for a total of
1,222,676 hours.
b. Low-Risk Entities
Entities that have a minimal risk of identity theft,\5\ but that
have covered accounts, must develop a Program; however, they likely
will only need a streamlined Program. FTC staff estimates that such
entities will require one hour to create such a Program, with an annual
recurring burden of five minutes. Training staff of low-risk entities
to be attentive to future risks of identity theft should require no
more than 10 minutes in an initial year, with an annual recurring
burden of five minutes. FTC staff further estimates that these entities
will require, initially, 10 minutes to prepare an annual report, with
an annual recurring burden of five minutes.
---------------------------------------------------------------------------

\5\ Low-risk entities include, for example, public warehouse and
storage firms, nursing and residential care facilities, automotive
equipment rental and leasing firms, office supplies and stationery
stores, fuel dealers, and financial transaction processing firms.
---------------------------------------------------------------------------

Thus, the estimated hours burden for low-risk entities is as
follows:
63,533 low risk entities that have covered account subject
to the FTC's jurisdiction at an average annual burden of approximately
37 minutes per entity [average annual burden over 3-year clearance
period for creation and implementation of streamlined Program ((60 + 5
+ 5) minutes/3), plus average annual burden over 3-year clearance
period for staff training ((10 + 5 + 5) minutes/3), plus average annual
burden over 3-year clearance period for preparing annual report ((10 +
5 + 5) minutes/3], for a total of 39,179 hours.
2. Estimated Hours Burden--Card Issuers Rule
As noted above, section 114 also requires financial institutions
and covered creditors that issue credit or debit cards to establish
policies and procedures to assess the validity of a change of address
request, including notifying the cardholder or using another means of
assessing the validity of the change of address.
FTC staff estimates that the Rule affects as many as
16,742 \6\ card issuers within the FTC's jurisdiction. FTC staff
believes that most of these card issuers already have automated the
process of notifying the cardholder or are using another means to
assess the validity of the change of address, such that implementation
will pose no further burden. Nevertheless, taking a conservative
approach, FTC staff estimates that it will take each card issuer 4
hours to develop and implement policy and procedures to assess the
validity of a change of address request for a total burden of 66,968
hours.
---------------------------------------------------------------------------

\6\ Card issuers within the FTC's jurisdiction include, for
example, state credit unions, general retail merchandise stores,
colleges and universities, and telecoms.
---------------------------------------------------------------------------

Thus, the total average annual estimated burden for Section 114 is
1,328,823 hours.
3. Estimated Cost Burden--Red Flags and Card Issuers Rules
The FTC staff estimates labor costs by applying appropriate
estimated hourly cost figures to the burden hours described above. It
is difficult to calculate with precision the labor costs associated
with compliance with the Rule, as they entail varying compensation
levels of management (e.g., administrative services, computer and
information systems, training and development) and/or technical staff
(e.g., computer support specialists, systems analysts, network and
computer systems administrators) among companies of different sizes.
FTC staff assumes that for all entities, professional technical
personnel and/or management personnel will create and implement the
Program, prepare the annual report, and train employees, at an hourly
rate of $49.\7\
---------------------------------------------------------------------------

\7\ This estimate is based on mean hourly wages found at http://www.bls.gov/news.release/ocwage.t01.htm, ``Occupational Employment
and Wages Summary--May 2017,'' U.S. Department of Labor, Table 1,
released March 30, 2018 (``National employment and wage data from
the Occupational Employment Statistics survey by occupation, May
2017'') for the various managerial and technical staff support
exemplified above (administrative service managers, computer &
information systems managers, training & development managers,
computer systems analysts, network & computer systems
administrators, and computer support specialists).
---------------------------------------------------------------------------

Based on the above estimates and assumptions, the total annual
labor costs for all categories of covered entities under the Red Flags
and Card Issuers Rules for Section 114 is $65,112,327 (1,328,823 hours
x $49).

B. FACT Act Section 315--The Address Discrepancy Rule

As discussed above, the Rule's implementation of Section 315
provides guidance on reasonable policies and procedures that a user of
consumer reports must employ when a user receives a notice of address
discrepancy from a CRA. Given the broad scope of users of consumer
reports, it is difficult to determine with precision the number of
users of consumer reports that are subject to the FTC's jurisdiction.
As noted above, there are numerous small businesses under the FTC's
jurisdiction, and there is no formal way to track them; moreover, as a
whole, the entities under the FTC's jurisdiction are so

[[Page 39099]]

varied that there are no general sources that provide a record of their
existence. Nonetheless, FTC staff estimates that the Rule's
implementation of section 315 affects approximately 1,967,161 users of
consumer reports subject to the FTC's jurisdiction.\8\ Commission staff
estimates that approximately 10,000 of these users will receive notice
of a discrepancy, in the course of their usual and customary business
practices, and thereby have to furnish to CRAs an address
confirmation.\9\
---------------------------------------------------------------------------

\8\ This estimate is derived from an analysis of Census
databases of U.S. businesses based on NAICS codes for businesses in
industries that typically use consumer reports from CRAs described
in the Rule, which total 1,967,161 users of consumer reports subject
to the FTC's jurisdiction.
\9\ Report to Congress Under Sections 318 and 319 of the Fair
and Accurate Credit Transactions of 2003, Federal Trade Commission,
80 (Dec. 2004) available at http://www.ftc.gov/reports/facta/041209factarpt.pdf.
---------------------------------------------------------------------------

For section 315, as detailed below, FTC staff estimates that the
average annual burden during the three-year period for which OMB
clearance is sought will be 919,678 hours with an associated labor cost
of $17,473,882.
1. Estimated Hours Burden
Prior to enactment of the Address Discrepancy Rule, users of
consumer reports could compare the address on a consumer report to the
address provided by the consumer and discern for themselves any
discrepancy. As a result, FTC staff believes that many users of
consumer reports have developed methods of reconciling address
discrepancies, and the following estimates represent the incremental
amount of time users of consumer reports may require to develop and
comply with the policies and procedures for when they receive a notice
of address discrepancy.
a. Customer Verification
Given the varied nature of the entities under the FTC's
jurisdiction, it is difficult to determine precisely the appropriate
burden estimates. Nonetheless, FTC staff estimates that it would
require an infrequent user of consumer reports no more than 16 minutes
to develop and comply with the policies and procedures that it will
employ when it receives a notice of address discrepancy, while a
frequent user might require one hour. Similarly, FTC staff estimates
that, during the remaining two years of clearance, it may take an
infrequent user no more than one minute to comply with the policies and
procedures it will employ when it receives a notice of address
discrepancy, while a frequent user might require 45 minutes. Taking
into account these extremes, FTC staff estimates that, during the first
year, it will take users of consumer reports under the FTC's
jurisdiction an average of 38 minutes [the midrange between 16 minutes
and 60 minutes] to develop and comply with the policies and procedures
that they will employ when they receive a notice of address
discrepancy. FTC staff also estimates that the average recurring burden
for users of consumer reports to comply with the Rule will be 23
minutes [the midrange between one minute and 45 minutes].
Thus, for these 1,967,167 entities, the average annual burden for
each of them to perform these collective tasks will be 28 minutes [(38
+ 23 +23) / 3]; cumulatively, 918,011 hours.
b. Address Verification
For the estimated 10,000 users of consumer reports that will
additionally have to furnish to CRAs an address confirmation upon
notice of a discrepancy, staff estimates that these entities will
require, initially, 30 minutes to develop related policies and
procedures. But, these 10,000 affected entities likely will have
automated the process of furnishing the correct address in the first
year of a three-year PRA clearance cycle. Thus, allowing for 30 minutes
in the first year, with no annual recurring burden in the second and
third years of clearance, yields an average annual burden of 10 minutes
per entity to furnish a correct address to a CRA, for a total of 1,667
hours.
2. Estimated Cost Burden
FTC staff assumes that the policies and procedures for compliance
with the address discrepancy part of the Rule will be set up by
administrative support personnel at an hourly rate of $19.\10\ Based on
the above estimates and assumptions, the total annual labor cost for
the two categories of burden under section 315 is $17,473,882.
---------------------------------------------------------------------------

\10\ This estimate--rounded to the nearest dollar--is based on
mean hourly wages for all management occupations found within the
``Bureau of Labor Statistics, Economic News Release,'' March 30,
2018, Table 1, ``National employment and wage data from the
Occupational Employment Statistics survey by occupation, May 2017.''
http://www.bls.gov/news.release/ocwage.t01.htm.
---------------------------------------------------------------------------

C. Burden Totals for FACT Act Sections 114 and 315

Cumulatively, then, estimated burden is 2,246,834 hours (1,328,823
hours for section 114 and 918,011 hours for section 315) and
$82,586,209 ($65,112,327 and $17,473,882) in associated labor costs.

IV. Request for Comment

Pursuant to Section 3506(c)(2)(A) of the PRA, the FTC invites
comments on: (1) Whether the disclosure requirements are necessary,
including whether the information will be practically useful; (2) the
accuracy of our burden estimates, including whether the methodology and
assumptions used are useful; (3) ways to enhance the quality, utility,
and clarity of the information to be collected; and (4) ways to
minimize the burden of providing the required information to consumers.
You can file a comment online or on paper. For the FTC to consider
your comment, we must receive it on or before October 9, 2018. Write:
``Red Flags Rule, PRA Comment, Project No. P095406'' on your comment.
Your comment--including your name and your state--will be placed on the
public record of this proceeding, including, to the extent practicable,
on the public Commission website, at http://www.ftc.gov/os/publiccomments.shtm. As a matter of discretion, the Commission tries to
remove individuals' home contact information from comments before
placing them on the Commission website.
Postal mail addressed to the Commission is subject to delay due to
heightened security screening. As a result, we encourage you to submit
your comments online, or to send them to the Commission by courier or
overnight service. To make sure that the Commission considers your
online comment, you must file it at https://ftcpublic.commentworks.com/ftc/RedFlagsPRA by following the instructions on the web-based form.
When this Notice appears at http://www.regulations.gov/#!home, you also
may file a comment through that website.
If you file your comment on paper, write ``Red Flags Rule PRA,
Project No. P095406'' on your comment and on the envelope, and mail it
to the following address: Federal Trade Commission, Office of the
Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex J),
Washington, DC 20580, or deliver your comment to the following address:
Federal Trade Commission, Office of the Secretary, Constitution Center,
400 7th Street SW, 5th Floor, Suite 5610 (Annex J), Washington, DC
20024. If possible, submit your paper comment to the Commission by
courier or overnight service.
Because your comment will be placed on the publicly accessible FTC
website at https://www.ftc.gov/, you are solely responsible for making
sure that your

[[Page 39100]]

comment does not include any sensitive or confidential information. In
particular, your comment should not include any sensitive personal
information, such as your or anyone else's Social Security number; date
of birth; driver's license number or other state identification number,
or foreign country equivalent; passport number; financial account
number; or credit or debit card number. You are also solely responsible
for making sure that your comment does not include any sensitive health
information, such as medical records or other individually identifiable
health information. In addition, your comment should not include any
``trade secret or any commercial or financial information which . . .
is privileged or confidential''--as provided by Section 6(f) of the FTC
Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2)--
including in particular competitively sensitive information such as
costs, sales statistics, inventories, formulas, patterns, devices,
manufacturing processes, or customer names.
Comments containing material for which confidential treatment is
requested must be filed in paper form, must be clearly labeled
``Confidential,'' and must comply with FTC Rule 4.9(c). In particular,
the written request for confidential treatment that accompanies the
comment must include the factual and legal basis for the request, and
must identify the specific portions of the comment to be withheld from
the public record. See FTC Rule 4.9(c). Your comment will be kept
confidential only if the General Counsel grants your request in
accordance with the law and the public interest. Once your comment has
been posted on the public FTC website--as legally required by FTC Rule
4.9(b)--we cannot redact or remove your comment from the FTC website,
unless you submit a confidentiality request that meets the requirements
for such treatment under FTC Rule 4.9(c), and the General Counsel
grants that request.
The FTC Act and other laws that the Commission administers permit
the collection of public comments to consider and use in this
proceeding as appropriate. The Commission will consider all timely and
responsive public comments that it receives on or before October 9,
2018. For information on the Commission's privacy policy, including
routine uses permitted by the Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

Heather Hippsley,
Acting Principal Deputy General Counsel.
[FR Doc. 2018-16936 Filed 8-7-18; 8:45 am]
BILLING CODE 6750-01-P

39096 Federal Register / Vol. 83, No. 153 / Wednesday, August 8, 2018 / Notices

germane to the current public notice believes that the modified and HISTORY
and comment process. We have referred bifurcated routine use on data breaches 73 FR 33591–33634 (June 12, 2008).
M/M. Kerz’s comment to the FTC’s is compatible with the collection of By direction of the Commission.
Consumer Response Center for entry information pertaining to individuals
Donald S. Clark,
into the Consumer Sentinel Network of affected by a breach, and that the
Secretary.
complaints and related inquiries. disclosure of such records will help
The second commenter, Thomas prevent, minimize or remedy a data [FR Doc. 2018–16935 Filed 8–7–18; 8:45 am]
Dickinson, also filed a comment that is breach or compromise that may affect BILLING CODE 6750–01–P
non-germane to the current public such individuals. By contrast, the FTC
notice and comment process. Mr. believes that failure to take reasonable
Dickinson asks the FTC to apply a steps to help prevent, minimize or FEDERAL TRADE COMMISSION
‘‘monitor’’ to individuals’ home phones remedy the harm that may result from
Agency Information Collection
that identifies violations of the Do-Not- such a breach or compromise would
Call Rule and allows the FTC to take Activities; Proposed Collection;
jeopardize, rather than promote, the
appropriate punitive actions. We have Comment Request
privacy of such individuals.
also referred Mr. Dickinson’s complaint The FTC provided a public comment AGENCY: Federal Trade Commission
to the FTC’s Consumer Response Center period and notice to OMB and Congress (‘‘FTC’’ or ‘‘Commission’’).
for entry into the Consumer Sentinel as required by the Privacy Act and ACTION: Notice.
Network. implementing OMB guidelines.1
The third commenter, Dave Root, Accordingly, the FTC hereby amends SUMMARY: The FTC intends to ask the
commented that ‘‘due process and . . . Appendix I of its Privacy Act system Office of Management and Budget
[his] . . . privacy . . . [would] . . . be notices, as published at 73 FR 33591, by (‘‘OMB’’) to extend for an additional
harmed by open access to sharing . . . revising item number (22), adding new three years the current Paperwork
[his] . . . personal info between all item number (23), and re-designating Reduction Act (‘‘PRA’’) clearance for the
government agencies as outlined in this the former item number (23) as (24) information collection requirements in
notice.’’ Mr. Root asked if there are ‘‘any (without any other change) at the end of the FTC Red Flags, Card Issuers, and
safeguards against ‘political the existing routine uses set forth in that Address Discrepancies Rules 1
weaponization’ without any Appendix: (‘‘Rules’’). That clearance expires on
accountability, by any federal, state or * * * * * November 30, 2018.
local governmental agency having (22) To appropriate agencies, entities, DATES: Comments must be submitted by
access to this information.’’ Mr. Root and persons when (a) the FTC suspects October 9, 2018.
asked for ‘‘‘teeth’ in the rule for anyone or has confirmed that there has been a ADDRESSES: Interested parties may file a
. . . that purposefully uses this breach of the system of records; (b) the comment online or on paper by
information incorrectly . . . [meaning] FTC has determined that as a result of following the instructions in the
. . . seriously enforced jail time for the suspected or confirmed breach there Request for Comment part of the
anyone who fails to act in the is a risk of harm to individuals, the FTC SUPPLEMENTARY INFORMATION section
investigation and prosecution process.’’ (including its information systems, below. Write ‘‘Red Flags Rule, PRA
The revised routine use would not programs, and operations), the Federal Comment, Project No. P095406’’ on your
provide ‘‘open access’’ to ‘‘all Government, or national security; and comment. File your comment online at
government agencies’’ but would (c) the disclosure made to such https://ftcpublic.commentworks.com/
require that the FTC receive a request agencies, entities, and persons is ftc/RedFlagsPRA by following the
from another Federal agency or Federal reasonably necessary to assist in instructions on the web-based form. If
entity that provides enough supporting connection with the FTC’s efforts to
information such that the FTC can you prefer to file your comment on
respond to the suspected or confirmed paper, mail your comment to the
determine that information from an FTC breach or to prevent, minimize, or
Privacy Act system or systems is following address: Federal Trade
remedy such harm. Commission, Office of the Secretary,
reasonably necessary to assist the (23) To another Federal agency or
recipient agency or entity in (a) 600 Pennsylvania Avenue NW, Suite
Federal entity, when the FTC CC–5610 (Annex J), Washington, DC
responding to a suspected or confirmed determines that information from this
breach or (b) preventing, minimizing, or 20580, or deliver your comment to the
system of records is reasonably following address: Federal Trade
remedying the risk of harm to necessary to assist the recipient agency
individuals, the recipient agency or Commission, Office of the Secretary,
or entity in (a) responding to a Constitution Center, 400 7th Street SW,
entity (including its information suspected or confirmed breach or (b)
systems, programs, and operations), the 5th Floor, Suite 5610 (Annex J),
preventing, minimizing, or remedying Washington, DC 20024.
Federal Government, or national the risk of harm to individuals, the
security, resulting from a suspected or FOR FURTHER INFORMATION CONTACT:
recipient agency or entity (including its
confirmed breach. Requests for additional information
information systems, programs, and
The Privacy Act specifically provides should be addressed to Mark Eichorn,
operations), the Federal Government, or
civil remedies, 5 U.S.C. 552a(g), Assistant Director, Division of Privacy
national security, resulting from a
including damages, and criminal and Identity Protection, Bureau of
suspected or confirmed breach.
penalties, 5 U.S.C. 552a(i), for violations (24) May be disclosed to FTC Consumer Protection, (202) 326–3053,
Federal Trade Commission, 600
sradovich on DSK3GMQ082PROD with NOTICES

of the Act. In addition, an individual contractors, volunteers, interns or other
may be fined up to $5,000 for knowingly authorized individuals who have a need Pennsylvania Avenue NW, Washington,
and willfully requesting or gaining for the record in order to perform their DC 20580.
access to a record about an individual officially assigned or designated duties 1 16 CFR 681.1 (Duties regarding the detection,
under false pretenses. 5 U.S.C. for or on behalf of the FTC. prevention, and mitigation of identity theft); 16 CFR
552a(i)(3). 681.2 (Duties of card issuers regarding changes of
As stated in the Federal Register 1 See U.S.C. 552a(e)(11) and 552a(r); OMB address); 16 CFR 641.1 (Duties of users of consumer
Notice dated May 3, 2018, the FTC Circular A–108 (2016). reports regarding address discrepancies).

VerDate Sep<11>2014 22:37 Aug 07, 2018 Jkt 244001 PO 00000 Frm 00056 Fmt 4703 Sfmt 4703 E:\FR\FM\08AUN1.SGM 08AUN1

39098 Federal Register / Vol. 83, No. 153 / Wednesday, August 8, 2018 / Notices

To estimate burden hours for the Red b. Low-Risk Entities issuer 4 hours to develop and
Flags Rule under section 114, FTC staff Entities that have a minimal risk of implement policy and procedures to
divided affected entities into two identity theft,5 but that have covered assess the validity of a change of
categories, based on the nature of their accounts, must develop a Program; address request for a total burden of
business: (1) Entities that are subject to however, they likely will only need a 66,968 hours.
high risk of identity theft, and (2) Thus, the total average annual
streamlined Program. FTC staff
entities that are subject to a low risk of estimated burden for Section 114 is
estimates that such entities will require
identity theft, but have covered 1,328,823 hours.
one hour to create such a Program, with
accounts that will require them to have an annual recurring burden of five 3. Estimated Cost Burden—Red Flags
a written Program. minutes. Training staff of low-risk and Card Issuers Rules
entities to be attentive to future risks of The FTC staff estimates labor costs by
a. High-Risk Entities identity theft should require no more applying appropriate estimated hourly
FTC staff estimates that high-risk than 10 minutes in an initial year, with cost figures to the burden hours
entities 4 will each require 25 hours to an annual recurring burden of five described above. It is difficult to
create and implement a written minutes. FTC staff further estimates that calculate with precision the labor costs
these entities will require, initially, 10 associated with compliance with the
Program, with an annual recurring
minutes to prepare an annual report, Rule, as they entail varying
burden of one hour. FTC staff
with an annual recurring burden of five compensation levels of management
anticipates that these entities will
minutes. (e.g., administrative services, computer
incorporate into their Program policies Thus, the estimated hours burden for
and procedures that they likely already and information systems, training and
low-risk entities is as follows: development) and/or technical staff
have in place. Further, FTC staff • 63,533 low risk entities that have (e.g., computer support specialists,
estimates that preparation for an annual covered account subject to the FTC’s systems analysts, network and computer
report will require each high-risk entity jurisdiction at an average annual burden systems administrators) among
four hours initially, with an annual of approximately 37 minutes per entity companies of different sizes. FTC staff
recurring burden of one hour. Finally, [average annual burden over 3-year assumes that for all entities,
FTC staff believes that many of the high- clearance period for creation and professional technical personnel and/or
risk entities, as part of their usual and implementation of streamlined Program management personnel will create and
customary business practice, already ((60 + 5 + 5) minutes/3), plus average implement the Program, prepare the
take steps to minimize losses due to annual burden over 3-year clearance annual report, and train employees, at
fraud, including conducting employee period for staff training ((10 + 5 + 5) an hourly rate of $49.7
training. Accordingly, only relevant staff minutes/3), plus average annual burden Based on the above estimates and
need be trained to implement the over 3-year clearance period for assumptions, the total annual labor
Program: for example, staff already preparing annual report ((10 + 5 + 5) costs for all categories of covered
trained as part of a covered entity’s anti- minutes/3], for a total of 39,179 hours. entities under the Red Flags and Card
fraud prevention efforts do not need to 2. Estimated Hours Burden—Card Issuers Rules for Section 114 is
be re-trained. FTC staff estimates that Issuers Rule $65,112,327 (1,328,823 hours × $49).
training connected with the As noted above, section 114 also B. FACT Act Section 315—The Address
implementation of a Program of a high- requires financial institutions and Discrepancy Rule
risk entity will require four hours, and covered creditors that issue credit or As discussed above, the Rule’s
annual training thereafter will require debit cards to establish policies and implementation of Section 315 provides
one hour. procedures to assess the validity of a guidance on reasonable policies and
Thus, estimated hours for high-risk change of address request, including procedures that a user of consumer
entities are as follows: notifying the cardholder or using reports must employ when a user
another means of assessing the validity receives a notice of address discrepancy
• 94,052 high-risk entities subject to
of the change of address. from a CRA. Given the broad scope of
the FTC’s jurisdiction at an average • FTC staff estimates that the Rule users of consumer reports, it is difficult
annual burden of 13 hours per entity affects as many as 16,742 6 card issuers to determine with precision the number
[average annual burden over 3-year within the FTC’s jurisdiction. FTC staff of users of consumer reports that are
clearance period for creation and believes that most of these card issuers subject to the FTC’s jurisdiction. As
implementation of a Program ((25 + 1 + already have automated the process of noted above, there are numerous small
1) hours/3), plus average annual burden notifying the cardholder or are using businesses under the FTC’s jurisdiction,
over 3-year clearance period for staff another means to assess the validity of and there is no formal way to track
training ((4 + 1 + 1) hours/3), plus the change of address, such that them; moreover, as a whole, the entities
average annual burden over 3-year implementation will pose no further under the FTC’s jurisdiction are so
clearance period for preparing an burden. Nevertheless, taking a
annual report ((4 + 1 + 1) hours/3)], for conservative approach, FTC staff 7 This estimate is based on mean hourly wages

a total of 1,222,676 hours. estimates that it will take each card found at http://www.bls.gov/news.release/
ocwage.t01.htm, ‘‘Occupational Employment and
Wages Summary—May 2017,’’ U.S. Department of
5 Low-risk entities include, for example, public
entities not likely to obtain credit reports, report Labor, Table 1, released March 30, 2018 (‘‘National
sradovich on DSK3GMQ082PROD with NOTICES

credit transactions, or advance loans; and (2) warehouse and storage firms, nursing and employment and wage data from the Occupational
entities not likely to have covered accounts under residential care facilities, automotive equipment Employment Statistics survey by occupation, May
rental and leasing firms, office supplies and 2017’’) for the various managerial and technical
the Rule.
stationery stores, fuel dealers, and financial staff support exemplified above (administrative
4 High-risk entities include, for example, financial
transaction processing firms. service managers, computer & information systems
institutions within the FTC’s jurisdiction and 6 Card issuers within the FTC’s jurisdiction managers, training & development managers,
utilities, motor vehicle dealerships, include, for example, state credit unions, general computer systems analysts, network & computer
telecommunications firms, colleges and retail merchandise stores, colleges and universities, systems administrators, and computer support
universities, and hospitals. and telecoms. specialists).

VerDate Sep<11>2014 22:37 Aug 07, 2018 Jkt 244001 PO 00000 Frm 00058 Fmt 4703 Sfmt 4703 E:\FR\FM\08AUN1.SGM 08AUN1

Federal Register / Vol. 83, No. 153 / Wednesday, August 8, 2018 / Notices 39099

varied that there are no general sources minutes. Taking into account these IV. Request for Comment
that provide a record of their existence. extremes, FTC staff estimates that, Pursuant to Section 3506(c)(2)(A) of
Nonetheless, FTC staff estimates that the during the first year, it will take users the PRA, the FTC invites comments on:
Rule’s implementation of section 315 of consumer reports under the FTC’s (1) Whether the disclosure requirements
affects approximately 1,967,161 users of jurisdiction an average of 38 minutes are necessary, including whether the
consumer reports subject to the FTC’s [the midrange between 16 minutes and information will be practically useful;
jurisdiction.8 Commission staff 60 minutes] to develop and comply with (2) the accuracy of our burden estimates,
estimates that approximately 10,000 of the policies and procedures that they including whether the methodology and
these users will receive notice of a will employ when they receive a notice assumptions used are useful; (3) ways to
discrepancy, in the course of their usual of address discrepancy. FTC staff also enhance the quality, utility, and clarity
and customary business practices, and estimates that the average recurring of the information to be collected; and
thereby have to furnish to CRAs an burden for users of consumer reports to (4) ways to minimize the burden of
address confirmation.9 comply with the Rule will be 23
For section 315, as detailed below, providing the required information to
minutes [the midrange between one consumers.
FTC staff estimates that the average minute and 45 minutes]. You can file a comment online or on
annual burden during the three-year Thus, for these 1,967,167 entities, the paper. For the FTC to consider your
period for which OMB clearance is average annual burden for each of them
sought will be 919,678 hours with an comment, we must receive it on or
to perform these collective tasks will be before October 9, 2018. Write: ‘‘Red
associated labor cost of $17,473,882. 28 minutes [(38 + 23 +23) ÷ 3]; Flags Rule, PRA Comment, Project No.
1. Estimated Hours Burden cumulatively, 918,011 hours. P095406’’ on your comment. Your
Prior to enactment of the Address b. Address Verification comment—including your name and
Discrepancy Rule, users of consumer your state—will be placed on the public
reports could compare the address on a For the estimated 10,000 users of record of this proceeding, including, to
consumer report to the address provided consumer reports that will additionally the extent practicable, on the public
by the consumer and discern for have to furnish to CRAs an address Commission website, at http://
themselves any discrepancy. As a result, confirmation upon notice of a www.ftc.gov/os/publiccomments.shtm.
FTC staff believes that many users of discrepancy, staff estimates that these As a matter of discretion, the
consumer reports have developed entities will require, initially, 30 Commission tries to remove individuals’
methods of reconciling address minutes to develop related policies and home contact information from
discrepancies, and the following procedures. But, these 10,000 affected comments before placing them on the
estimates represent the incremental entities likely will have automated the Commission website.
amount of time users of consumer process of furnishing the correct address Postal mail addressed to the
reports may require to develop and in the first year of a three-year PRA Commission is subject to delay due to
comply with the policies and clearance cycle. Thus, allowing for 30 heightened security screening. As a
procedures for when they receive a minutes in the first year, with no annual result, we encourage you to submit your
notice of address discrepancy. recurring burden in the second and comments online, or to send them to the
third years of clearance, yields an Commission by courier or overnight
a. Customer Verification average annual burden of 10 minutes service. To make sure that the
Given the varied nature of the entities per entity to furnish a correct address to Commission considers your online
under the FTC’s jurisdiction, it is a CRA, for a total of 1,667 hours. comment, you must file it at https://
difficult to determine precisely the ftcpublic.commentworks.com/ftc/
2. Estimated Cost Burden
appropriate burden estimates. RedFlagsPRA by following the
Nonetheless, FTC staff estimates that it FTC staff assumes that the policies instructions on the web-based form.
would require an infrequent user of and procedures for compliance with the When this Notice appears at http://
consumer reports no more than 16 address discrepancy part of the Rule www.regulations.gov/#!home, you also
minutes to develop and comply with the will be set up by administrative support may file a comment through that
policies and procedures that it will personnel at an hourly rate of $19.10 website.
employ when it receives a notice of Based on the above estimates and If you file your comment on paper,
address discrepancy, while a frequent assumptions, the total annual labor cost write ‘‘Red Flags Rule PRA, Project No.
user might require one hour. Similarly, for the two categories of burden under P095406’’ on your comment and on the
FTC staff estimates that, during the section 315 is $17,473,882. envelope, and mail it to the following
remaining two years of clearance, it may address: Federal Trade Commission,
take an infrequent user no more than C. Burden Totals for FACT Act Sections Office of the Secretary, 600
one minute to comply with the policies 114 and 315 Pennsylvania Avenue NW, Suite CC–
and procedures it will employ when it Cumulatively, then, estimated burden 5610 (Annex J), Washington, DC 20580,
receives a notice of address discrepancy, is 2,246,834 hours (1,328,823 hours for or deliver your comment to the
while a frequent user might require 45 section 114 and 918,011 hours for following address: Federal Trade
section 315) and $82,586,209 Commission, Office of the Secretary,
8 This estimate is derived from an analysis of
($65,112,327 and $17,473,882) in Constitution Center, 400 7th Street SW,
Census databases of U.S. businesses based on
associated labor costs. 5th Floor, Suite 5610 (Annex J),
NAICS codes for businesses in industries that
sradovich on DSK3GMQ082PROD with NOTICES

Washington, DC 20024. If possible,
typically use consumer reports from CRAs
described in the Rule, which total 1,967,161 users 10 This estimate—rounded to the nearest dollar— submit your paper comment to the
of consumer reports subject to the FTC’s is based on mean hourly wages for all management Commission by courier or overnight
jurisdiction. occupations found within the ‘‘Bureau of Labor service.
9 Report to Congress Under Sections 318 and 319 Statistics, Economic News Release,’’ March 30, Because your comment will be placed
of the Fair and Accurate Credit Transactions of 2018, Table 1, ‘‘National employment and wage
2003, Federal Trade Commission, 80 (Dec. 2004) data from the Occupational Employment Statistics
on the publicly accessible FTC website
available at http://www.ftc.gov/reports/facta/ survey by occupation, May 2017.’’ http:// at https://www.ftc.gov/, you are solely
041209factarpt.pdf. www.bls.gov/news.release/ocwage.t01.htm. responsible for making sure that your

VerDate Sep<11>2014 22:37 Aug 07, 2018 Jkt 244001 PO 00000 Frm 00059 Fmt 4703 Sfmt 4703 E:\FR\FM\08AUN1.SGM 08AUN1

Document Created: 2018-08-08 02:04:35
Document Modified: 2018-08-08 02:04:35

Category		Regulatory Information
Collection		Federal Register
sudoc Class		AE 2.7: GS 4.107: AE 2.106:
Publisher		Office of the Federal Register, National Archives and Records Administration
Section		Notices
Action		Notice.
Dates		Comments must be submitted by October 9, 2018.
Contact		Requests for additional information
FR Citation		83 FR 39096