6-5 Identity Theft Prevention Program
Return to Identity Theft Prevention Program Table of Contents
Approved: Board of Supervisors
Authority: Board of Supervisors and Board of Directors, Community Development Commission
Revised Date: July 21, 2009
What’s on this Page
Read next: Section III. Definitions
II. Background
The Federal Trade Commission regulations governing the Identity Theft Prevention Program, adopted as 16 CFR § 681.2 (referred to as the “FTC Regulations”), require creditors to develop and provide a written program to detect, prevent and mitigate identity theft in connection with the opening of a covered account or any existing covered account. Recently, the FACT Act has been amended to require that all creditors (including local government agencies that defer payments for goods or services) establish policies and procedures to help prevent identity theft. Under the FTC Regulations, “creditor” is a person that extends, renews or continues credit, and defines “credit,” in part, as the right to purchase property or services and defer payment.
Under the FTC Regulations “covered account” includes accounts that a creditor provides for personal, family or household purposes designed to allow multiple payments or transactions; or any other account that the creditor maintains for which there is a foreseeable risk to customers or to the safety and soundness of the creditor from identity theft.
The County and the Sonoma County Community Development Commission (“SCCDC”) have determined that they are each a “creditor” under the FTC Regulations based on the activities of certain departments and consequently are required to have an Identity Theft Prevention Program in place. The County departments, which are considered to be Stakeholder Departments, are:
- The Health Department provides health care services for which payment is made after the service is consumed or the service has otherwise been provided.
- The Human Services Department provides general and other financial assistance, including overpayment collections; and provides expense money for job training programs.
- Sonoma County Regional Parks bills for utilities, berthing fees, and dock use at Spud Point Marina and Porto Bodega/Sport fishing Center; accepts credit card payments for camping reservations and other park functions; and may begin conducting credit checks for potential tenants at Spud Point Marina.
- The Auditor-Controller-Treasurer-Tax Collector (ACTTC) collects money that is owed to the County, in the following manner: as installment payment plans on taxes; as contractual assessment payments for energy improvements under the Sonoma County Energy Independence Program; by processing charges for sanitation and water services; and by providing general collection services on debts owed to or collected by the County. Thus, their files contain personal identifying information that is covered by the FACT Act.
The SCCDC administers a number of loan programs for County employees and member of the public. SCCDC both originates and services such loans.
The FTC Regulations specify guidelines that should be considered in the development of the Program, taking into account the past incidents of identity theft with respect to the County’s and the SCCDC’s covered accounts and the County’s and the SCCDC’s assessment of the risk of future incidents. Accordingly, this Program provides a basic framework governing the County’s and the SCCDC’s policies and procedures for the identification, prevention and mitigation of incidents of identity theft with respect to the County’s and the SCCDC’s covered accounts. In developing the Program, the County and the SCCDC have considered relevant “red flags” (see Definitions section, page 5) outlined in the FTC Regulations which are patterns, practices, or specific activities that indicate the possible existence of identity theft with respect to a covered account.
Consistent with the FTC Regulations, the initial Program is to be in place and effective as of August 1, 2009, and requires the approval of the Board of Supervisors for the County and the Board of Commissioners for the SCCDC. The implementation and administration of the Program is to be overseen by the County Administrator’s Office.
The Federal Trade Commission also has issued regulations, adopted as 16 CFR § 681.1, to require users of consumer credit reports to develop policies and procedures relating to notices regarding address discrepancies from a consumer reporting agency. The County and the SCCDC use consumer credit reports for a variety of purposes such as: obtaining credit information regarding loan applicants; establishing deferred payment plans, and locating delinquent debtors. The County departments that use the consumer credit reports for these purposes are listed above as Stakeholder Departments in the paragraph where the County determined that it acts as a “creditor.” In addition, the County uses consumer credit information for conducting background checks in the County’s hiring process. It was determined that the FACT Act does not apply in this situation because only part of the consumer information is used, the data is not retained at the County and notices of address discrepancy are not sent to the County.