December 31, 2010

On December 31, 2010, the Federal Trade Commission’s broad new rules governing identity theft take effect. The rules, which address the detection, prevention, and mitigation of identity theft, may be interpreted to require community associations to adopt and oversee identity theft prevention programs. Indeed, the FTC already has warned that it intends a broad application of its new rules.

The rules are primarily intended to apply to creditors that provide an extension of credit, i.e. those that provide goods and services involving deferred payments. It is possible to argue that community associations are not creditors providing credit.

Nonetheless, given the FTC’s intentions to broadly interpret the applicability of its rules, some associations should comply with the newly promulgated rules. Associations that should comply with the rules include those that accept installment payments for assessments (i.e. allow annual and special assessments to be paid on a monthly basis) or other payments, and/or believes there is a reasonable risk of identity theft of member data.

With the prevalence of identity theft, and widespread fear invoked by the public on this topic, associations may be able to turn the compliance costs into a marketing opportunity—by sharing with members the association’s concern for its members’ data, and the steps the association is taking to protect the same.

ID Theft Rules

The identity theft rules, found at 16 C.F.R. § 681.1, require a covered entity to create a written identity theft prevention program. The program must be appropriate to the size and complexity of the covered entity, and should be designed to detect, prevent and mitigate identity theft with respect to a customer’s (member’s) account.

The program must include procedures to:

• Identify “Red Flags” (pattern, practice, or specific activity that indicates the possible existence of identity theft) for a customer’s (member’s) account and incorporate them into the program.
• Establish a written procedure for detecting “Red Flags.”
• Respond to any identified “Red Flags” so as to prevent and mitigate identity theft.
• Periodically update the program to reflect changes in risk to customers (members) and to the safety of and soundness of the association from identity theft.

The program must be approved by the Board or an appropriate committee of the Board. Once approved, the Board, an appropriate Board committee or senior manager, must be involved in the oversight, development, implementation and administration of the program. Staff must be trained to effectively implement the program’s provisions.

Going Forward

Organizations found to be in noncompliance with the FTC’s new rules may face enforcement actions, significant monetary penalties and civil liability. Given the risks posed by identity theft for any organization that collects personal information, and the FTC’s increased mandate concerning the collection of financial information, Hill Wallack LLP’s Community Association team recommends clients adopt a policy that complies with the FTC rules concerning identity theft.

For further information or assistance in preparing a formal policy in compliance with the FTC rules, please contact Ronald L. Perl, Esq. at 1-609-924-0808 or rperl@hillwallack.com

Hill Wallack LLP's Community Associations Group

The Community Associations Group of Hill Wallack LLP is recognized for providing insight and innovation in the representation of community associations throughout New Jersey and Eastern Pennsylvania. We represent condominium and homeowner associations, cooperatives and real estate developers, and work closely with association governing boards and committees, management companies and other professionals

Our experience extends to management and collections matters; transitions; administrative, legislative & regulatory issues; insurance coverage and litigation. We work with colleagues knowledgeable in employment and labor law, environmental law, creditor's rights/bankruptcy and other areas to provide comprehensive support. We do more than advise on the law--we create solutions.

For more information, contact one of the attorneys who work in this area: Ronald L. Perl, Esq.; Michael S. Karpoff, Esq., Terry A. Kessler, Esq.; Brian J. McIntyre, Esq. or Jeffrey G. DiAmico, Esq.

This article provides information of general interest and is not intended, and should not be used, as a substitute for consultation with legal counsel. Any questions regarding the specific issues raised in this article should be directed to the authors or to your contacts at Hill Wallack LLP.