Assessing Associations' Identity Theft Red Flags and Risks

I love getting articles from the attorneys at Venable.  Many times the content is something I've never thought about, like this one...association identity theft red flags and risks.  So many nonprofits have online options for paying dues or making donations, which leaves donors or members vunerable to identity theft.  Or perhaps they have paper or electronic records of sensitive donor information such as credit card and bank account numbers, security codes, etc.  Have you done a risk assessment of your nonprofit?  Not just the possibility of your nonprofit accounts and identity being stolen but how safe is the identity and information of your donors?  Bunnie

Update: On May 28, 2010, at the request of several Members of Congress, the Federal Trade Commission announced it is further delaying enforcement of the “Red Flags” Rule through December 31, 2010, while Congress considers legislation that would affect the scope of entities covered by the Rule. If Congress passes legislation limiting the scope of the Red Flags Rule with an effective date earlier than December 31, 2010, the FTC indicated that it will begin enforcement as of that effective date.

--------------------------------------------------------------------------------

The Identity Theft Red Flags Rule (the “Rule”), 16 C.F.R. Part 681.2, was developed by the Federal Trade Commission pursuant to the Fair and Accurate Credit Transactions Act of 2003. Under the Rule, financial institutions and creditors with covered accounts must have identity theft prevention programs to identify, detect and respond to patterns, practices or specific activities that could indicate identity theft.

While many associations meet the Rule’s definition of a “creditor” because they accept payments over time for good/services provided, such as membership dues, publications, events, etc., many of these associations will not meet the Rule's second prong for coverage, which is having a “covered account.”

An account is “covered” under the Rule if it is for personal/household use. If not, the account can still be “covered” if there is a reasonably foreseeable risk of identity theft to either the account holder or the association, based on past experience in the opening, accessing or transactional use associated with the account.

Therefore, it is crucial to first conduct a risk assessment to see whether or not the association’s risk of identity theft regarding customer accounts (including those of both members and non-members, whether corporate or individual) is reasonably foreseeable; if not, then the association does not have “covered accounts” and is not within the scope of the Rule. In that case, the association should keep a copy of this written risk assessment on file, and update the risk assessment at least annually, as evidence of Rule non-coverage.

If, on the other hand, the risk assessment indicates a reasonably foreseeable risk of ID theft and hence Rule coverage, then the association's Identity Theft Prevention/Red Flag Program must also include a written Policy and Procedures. The following risk assessment tools are one possible way to weigh some of the various facts that might go into such an assessment. But each association must consider its own facts and experiences in dealing with customer account information, to arrive at its own particular assessment of the ID theft risks.

Finally, it is important to remember that there are numerous other laws and regulations, at both the federal and state levels, that may cover associations' privacy and information security practices, depending on the type of information obtained, used, sold/transferred, and retained and/or disposed. Associations, therefore, must consult legal counsel to determine their specific coverage and compliance issues with regard to privacy and information security practices.

* * * * * *

RISK ASSESSMENT

Number of Customers, during the period from 1/1/XX to date: ______________
Number of Customer Transactions, from 1/1/XX to date: __________________

[Appropriate time frame for risk assessment: past 3-5 years preferable, past 2 years minimum. Customers includes both members and non-members, whether corporate or individual]

Risk Assessment Key

O=Open

A=Access (view balance; change personal information; change payment method)

T=Can conduct transactions (make a payment; transfer funds; obtain products)

“Experience” indicates whether association has had previous experiences with identity theft with respect to each specific type of account.

Risk ratings* are “High” (H), “Moderate” (M), and “Low” (L).

*Explanation for risk ratings: Risk ratings are based on the association’s size in terms of customers and annual transactions, the number of individuals authorized to access each customer's account, and the association's existing policies and procedures (such as Internet security, account oversight, account agreements, etc.). The risk also depends on the types of products/services normally sold to each customer, the accessibility of the customer account, the association’s experience with identity theft, and how susceptible the offered products and services are to fraudulent activity.

Our next posting will be the second half of this article ASSESSMENT OF ASSOCIATION’S ACCOUNTS/SERVICES, METHODS FOR OPENING ACCOUNTS, METHODS FOR ACCESSING ACCOUNTS

Trade Association Settles FTC Charges of Misleading Advertising

Associations are as responsible for the advertising claims they make about services and products as for profit industry.  While many association "products" are training, peer professional networking, legislative advocacy, etc., some nonprofits also have services or products they sell to the general public.  Once they cross that line, they need to make sure they can support any statements about those products or risk the Federal Trade Commission stepping in.  See below.  Bunnie

Trade Association Settles FTC Charges of Misleading Advertising


by Jonathan L. Pompan, Esq., Venable LLP, Washington, D.C.

On January 26, 2010, the Federal Trade Commission (“FTC”) announced it had entered into a voluntary settlement, subject to final approval, with the Indoor Tanning Association (the “ITA”) over allegations that the ITA made misleading representations in its advertising and marketing for indoor tanning. Under the consent order, the ITA is restricted in the claims it may make in its future advertising, must send a notice to its members and recipients of its advertising materials, and must adopt a record keeping program.

The proposed order is significant in several respects. First, it makes clear an association’s obligation to adhere to advertising and marketing law. Second, the order illustrates how an association’s own advertising claims can result in obligations to disclose material risks. The FTC accused the ITA of failing to disclose facts related to health and safety risks that would be material to consumers in their purchase or use of the advertised product in light of the representations made. Third, the order focuses on point-of-sale and other consumer-facing advertising by the association that falls squarely in the commercial realm. The order does not cover representations made in non-commercial settings or contexts, such as communications to legislative or executive bodies.

Many associations advertise and market to develop and defend markets important to their membership. To help minimize legal risk, trade association staff should be well-educated in advertising and marketing law to ensure that their advertising claims are truthful and not misleading. In addition, claims must be substantiated, particularly when they concern health, safety or performance.

Association staff and legal counsel should consider the following pointers:

• Sellers are responsible for claims they make about their products and services. Third parties – such as advertising agencies or website designers – also may be liable for making or disseminating deceptive representations if they participate in the preparation or distribution of the advertising, or know about the deceptive claims.

• Stick to claims that can be supported. The type of evidence needed will depend on the product, the claims, and what experts believe necessary.

• Avoid disclaimers and disclosures that are difficult to notice, read or hear. However, a disclaimer cannot remedy a false or deceptive claim.

• Product and service demonstrations should show how the product will perform under normal use.

• FTC guidance suggests that association endorsements “must be reached by a process sufficient to ensure that the endorsement fairly reflects the collective judgment of the organization.”

• Certain regulated products and services trigger specific laws (e.g., Textile and Wool Acts, various consumer financial products and services) and regulations. Moreover, certain forms of advertising are subject to specific guidance (e.g., FTC Guide on Environmental Advertising, FTC Guides Concerning the Use of Endorsements and Testimonials in Advertising).

• Competitors may challenge advertising claims under self-regulatory programs, such as the Council of Better Business Bureau’s National Advertising Division, as well as under Section 43(a) of the Lanham Act, 15 U.S.C. § 1125(a).

• Obtain appropriate insurance for advertising and marketing activity.

* * * * * *
Jonathan L. Pompan, an attorney in the Washington, DC office of Venable LLP, represents nonprofit organizations and others in regulated industries in a wide variety of areas, including advertising and marketing law compliance, as well as in connection with Federal Trade Commission and state investigations and law enforcement actions. Prior to joining Venable, Mr. Pompan was an in-house counsel at a trade association where he reviewed advertising and marketing in advance of publication. For more information, please contact Mr. Pompan at 202.344.4383 or jlpompan@venable.com.

For more information about this and related industry topics, see www.venable.com/associations/publications.




This article is not intended to provide legal advice or opinion and should not be relied on as such. Legal advice can only be provided in response to a specific fact situation.