You are here:HomeIssuesCertificates of Insurance2014ABA Sues FTC Over Applying "Red Flag" Rules to Lawyers

ABA Sues FTC Over Applying "Red Flag" Rules to Lawyers

The American Bar Association (ABA) filed suit on Thursday August 27 in the U.S. District Court for the District of Columbia against the Federal Trade...
August 31, 2009

The American Bar Association (ABA) filed suit on Thursday August 27 in the U.S. District Court for the District of Columbia against the Federal Trade Commission (FTC), seeking an injunction to block the application of the so-called "Red Flags Rule" to practicing lawyers.

What are Red Flag rules? Red Flag Rules are meant to strengthen businesses' anti-ID theft compliance. More specifically, they require creating system responses that flag the caretaker of databases when "unusual" access attempts or activity patterns arise in their data activities.

The FTC regulations require businesses and organizations that act as "creditors" to establish a program for preventing identity theft. According to a Federal Trade Commission guide, the program must identify potential areas of vulnerability within a business and include policies for detecting and responding to red flags. The FTC has included lawyers, doctors and many other professionals in its definition of "creditors" because they bill customers only after providing services. The ABA disagrees with the FTC's interpretation that lawyers act as creditors.

In a statement, Carolyn Lamm, president of the ABA, said "Congress did not intend to cover lawyers under the Rule. The FTC's decision to apply the Rule to lawyers is contrary to an unbroken history of state regulation of lawyers and intrudes on traditional state responsibilities."

Do Red Flag rules apply to insurance? Insurance is not included - but there are some important gray areas in which it is possible that PIA member agencies could be expected to comply with the general business practice requirements of Red Flag. The PIA National Business Issues Committee has reviewed this issue at the request of PIA members and published a special update memo discussing the new requirements and under what circumstances they might apply. That memo can be found in the new "Insurance Business Practices & Technical Information" section of PIA National's website: /IssuesOfFocus/HotIssues/InsuranceBusinessPractices/

FTC officials have announced that they would not begin enforcement of the Red Flag Rule until November 1, marking the agency's third postponement of enforcing the regulations.

PIA National Update Briefing - FTC "Red Flag" Rules (PDF, login required)

FTC "Red Flag" Guide

ABA Sues FTC Over "Red Flag" (8/28/09)