A Look Ahead: Some Interesting Deadlines
Red Flag Policy
Do you need one?
Identity theft and credit account abuse are large problems. They are one reason PCI compliance is such a big issue in the e-commerce world (see following story). The FTC has passed a Red Flag Rule (enforceable June 1, 2010) that is also meant to add protection and control for securing sensitive personal information.
If your company collects or manages personal information about your customers, you may need to have a Red Flag Policy in place by June 1, 2010. What this policy does is identify ways you would be alerted to potential fraudulent use of an account or identity and what you would do about any such alerting situations. The Federal Trade Commission set up these rules primarily for financial institutions and creditors. But any company that deals with personal information, even if it is at low risk for identity theft, may be considered covered by the rules.