Legal Updates

Red Flags Identity Theft: Are Independent Schools Covered Or Not?

After nearly two years of delays, the Federal Trade Commission (“FTC”) began enforcing the Red Flags Rule on January 1, 2011.  As the implementing regulations indicate, any public or private entity that meets the definition of a “financial institution” or “creditor” with “covered accounts” will likely be covered by the Red Flags Rule.  Although the regulations are generally directed at banks and other financial institutions that provide credit to consumers, the regulations also apply to entities that obtain consumer reports from third-party agencies – in the case of employers, for the purpose of making hiring, promotion and other employment-related decisions – and employers that defer payments for goods or services, such as a school offering a deferred tuition payment plan.

Applicable regulations require, among other things, that covered employers implement a written program that describes the employer’s policies and procedures for detecting and preventing identity theft in connection with the employer’s covered accounts.  Significantly, failure to comply with the Red Flags Rule can result in substantial liability, including actual and punitive damages, costs and attorneys’ fees.  In addition, the FTC can impose civil penalties of up to $3,500 per violation.  To the extent that a school is a covered employer, it is essential to have an up-to-date and compliant program to detect and prevent identity theft.

In addition to offering deferred tuition plans, there are a number of other practices that can cause an independent school to be covered under the Red Flags Rule.  The following examples may cause an independent school to be subject to the Red Flags Rule and related regulations:

• Performing credit history checks on any of its employees, parents, volunteers or contractors.
• Offering deferred tuition payment plans, either directly through the school or through a third-party provider.
• Offering deferred payment plans for items such as books, school supplies or food.
• Regularly providing loans (not grants) to employees, such as through a computer purchase loan program.

We recommend that each school analyze whether it is required to comply with the Red Flags and related regulations.  The Firm is available to assist with this analysis, as well as to provide the required Identity Theft Program, Board Resolution and employee training.