2022-01539. Agency Information Collection Activities; Submission for OMB Review; Comment Request

AGENCY:

Federal Trade Commission.

ACTION:

Notice and request for comment.

SUMMARY:

The Federal Trade Commission (FTC) requests that the Office of Management and Budget (OMB) extend for three years the current Paperwork Reduction Act (PRA) clearance for information collection requirements contained in the FTC's Red Flags, Card Issuers, and Address Discrepancy Rules (Rules). That clearance expires on January 31, 2022.

DATES:

Comments must be received by February 28, 2022.

ADDRESSES:

Written comments and recommendations for the proposed information collection should be sent within 30 days of publication of this notice to www.reginfo.gov/​public/​do/​PRAMain. Find this particular information collection by selecting “Currently under 30-day Review—Open for Public Comments” or by using the search function. The reginfo.gov web link is a United States Government website produced by OMB and the General Services Administration (GSA). Under PRA requirements, OMB's Office of Information and Regulatory Affairs (OIRA) reviews Federal information collections.

FOR FURTHER INFORMATION CONTACT:

Whitney Moore, Attorney, Division of Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission, Mail Code CC-8232, 600 Pennsylvania Ave. NW, Washington, DC 20580, [phone].

SUPPLEMENTARY INFORMATION:

Title: Red Flags Rule, 16 CFR 681.1; Card Issuers Rule, 16 CFR 681.2; Address Discrepancy Rule, 16 CFR part 641.

OMB Control Number: 3084-0137.

Type of Review: Extension of currently approved collection.

Abstract: The Red Flags Rule requires financial institutions and certain creditors to develop and implement written Identity Theft Prevention Programs. The Card Issuers Rule requires credit and debit card issuers to assess the validity of notifications of address changes under certain circumstances. The Address Discrepancy Rule provides guidance on what covered users of consumer reports must do when they receive a notice of address discrepancy from a nationwide consumer reporting agency. Collectively, these three anti-identity theft provisions are intended to prevent impostors from misusing another person's personal information for a fraudulent purpose.

The Rules implement sections 114 and 315 of the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. 1681 et seq.

Estimated Annual Burden: (397,298 hours; $20,103,752 in labor costs).

A. Section 114: Red Flags and Card Issuers Rules:

(1) Red Flags:

(a) Estimated Number of Respondents: 164,591

(i) High-Risk Entities: 99,830 ^[1]

(ii) Low-Risk Entities: 64,761 ^[2]

(b) Estimated Hours Burden:

(i) High-Risk Entities: 342,900 hours

(ii) Low-Risk Entities: 16,523 hours

(2) Card Issuers Rule:

(a) Estimated Number of Respondents: 18,894 ^[3]

(b) Estimated Hours Burden: 20,508 hours

(3) Combined Labor Cost Burden: $19,756,412

B. Section 315—Address Discrepancy Rule:

(1) Estimated Number of Respondents: 44,000

(2) Estimated Hours Burden: 17,367 hours

(3) Estimated Labor Cost Burden: $347,340

C. Capital/Non-Labor Costs for Sections 114 and 315

FTC staff believes that the Rules impose negligible capital or other non-labor costs, as the affected entities are likely to have the necessary supplies and/or equipment already ( e.g., offices and computers) for the information collections described herein.

Request for Comment

On October 15, 2021, the FTC sought public comment on the information collection requirements associated with the Rule. 86 FR 57425. The Commission received no germane comments. Pursuant to the OMB regulations, 5 CFR part 1320, that implement the PRA, 44 U.S.C. 3501 et seq., the FTC is providing this second opportunity for public comment while seeking OMB approval to renew the pre-existing clearance for the Rules.

Your comment—including your name and your state—will be placed on the public record of this proceeding. Because your comment will be made public, you are solely responsible for making sure that your comment does not include any sensitive personal information, such as anyone's Social Security number; date of birth; driver's license number or other state identification number, or foreign country equivalent; passport number; financial account number; or credit or debit card number. You are also solely responsible for making sure that your comment does not include any sensitive health information, such as medical records or other individually identifiable health information. In addition, your comment should not include any “trade secret or any commercial or financial information which . . . is privileged or confidential” —as provided by Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2)—including in particular competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names.

Josephine Liu,

Assistant General Counsel for Legal Counsel.

Footnotes

1.  High-risk entities include, for example, financial institutions within the FTC's jurisdiction and utilities, motor vehicle dealerships, telecommunications firms, colleges and universities, and hospitals.

2.  Low-risk entities include, for example, public warehouse and storage firms, nursing and residential care facilities, automotive equipment rental and leasing firms, office supplies and stationery stores, fuel dealers, and financial transaction processing firms.

3.  FTC staff estimates that the Rule affects as many as 18,356 card issuers within the FTC's jurisdiction. This includes, for example, state credit unions, general retail merchandise stores, colleges and universities, and telecoms.