Congress recently exempted lawyers from an FTC rule that would have required them to develop elaborate identity-theft-prevention procedures.

If you "red flagged" the FTC's announced intent to apply the Red Flags Rule to lawyers, you can remove the flag and breathe a sigh of relief: Congress has passed and the President has signed the Red Flag Program Clarification Act of 2010, which will exempt lawyers, doctors, dentists, accountants, and other service providers from the rule's coverage.

"[C]learly overbroad"

As reported previously in LawPulse, the Federal Trade Commission and several other executive agencies jointly issued the Identity Theft Red Flags Rule, found at 16 CFR Part 681, on November 9, 2007. The rule, issued pursuant to the Fair and Accurate Credit Transactions Act (FACTA, PL 108-159), requires covered entities to develop programs and procedures to identify and respond to the "Red Flags" of possible identity theft with respect to their customers or accountholders.

Because of the breadth of its enabling statutes, the rule's coverage was originally to extend to a diverse array of businesses. The FTC took the position that any business that used consumer credit reports or billed customers periodically for services rendered, including not only financial institutions and other industries but also lawyers engaged in the private practice of law, was subject to its regulation.

The Red Flags Rule originally had an effective date of January 1, 2008, with a "mandatory compliance date" of November 1, 2008. However, the FTC extended the latter date several times, partly to give covered entities additional time to develop procedures, partly at the request of members of Congress, and partly as the result of court action on the part of professional organizations seeking declarations that the rule did not apply to certain professions.

One such professional organization is the American Bar Association, which, in August 2009, filed a three-count suit in the federal district court for the District of Columbia seeking an injunction to block the FTC's application of the Red Flags Rule to lawyers. In support of its request, the ABA argued that Congress did not intend FACTA to apply to lawyers, who merely bill clients for services rendered and are already regulated by state ethical rules, and that extending the rule to lawyers would be unduly burdensome.

The court granted the ABA's request, and the FTC appealed the ruling to the Court of Appeals for the District of Columbia, where it remained pending at presstime. In a press release posted on its website, the ABA said it expected the appeal to be dismissed.

Before Congress passed the new bill, the FTC itself acknowledged that whether the Red Flags Rule's enabling legislation, including FACTA, was overly broad was a legitimate question. The agency said, however, that it had no authority to exempt professions from coverage without congressional action. After the passage of the clarification bill, the FTC posted a statement from its chairman, Jon Leibowitz, that "We're pleased Congress clarified its law, which was clearly overbroad."

"[L]awyers are held to a higher ethical standard"

Reacting to Congress's action, ISBA First Assistant Counsel and Assistant Director of Legislative Affairs Melinda Bentley said "the ISBA is pleased that Congress has chosen to exempt lawyers from the Red Flag Rule.

"The ISBA wrote to the Illinois Congressional Delegation, urging exemption of lawyers from this provision, and was also a signatory to the amicus brief submitted by state and local bar associations in the ABA's action against the FTC urging lawyer exemption." Bentley said. "It has been ISBA's position that lawyers should be exempted from the Red Flags Rule because it is the purview of the states to regulate the practice of law, and because the billing practices of lawyers do not create an extension of credit under the Red Flags Rule.

"Illinois lawyers are held to higher ethical standards, including billing reasonably, under the Rules of Professional Conduct," she said. "That lawyers may bill clients for services after they are rendered should not subject lawyers to this rule as creditors."

Additional information about identity theft, businesses' duties, and the Red Flags Rule is available on the FTC's website at www.ftc.gov.