The URL can be used to link to this page

Home My WebLink About2009 03_OPWA_Red Flag Rules_2009.05.19OWASSO CITY COUNCIL OWASSO PUBLIC WORKS AUTHORITY OWASSO PUBLIC GOLF AUTHORITY RESOLUTION NO. 2009-03 WHEREAS, The City of Owasso and the Owasso Public Works and Public Golf Authorities, Tulsa County, Oklahoma organized under Title 60, Oklahoma Statutes 2001, Sections 176 - 180.4, as amended, for the purpose of furthering the public functions of the City of Owasso, Oklahoma; and, WHEREAS, The Fair and Accurate Credit Transactions Act of 2003, Pub. L. 108 -159, "Red Flag Rule" requires certain financial institutions and creditors with "covered accounts" to prepare, adopt, and implement an identity theft program to identify, detect, respond to and mitigate patterns, practices or specific activities which could indicate theft; and, WHEREAS, the City of Owasso, Owasso Public Works and Owasso Public Golf Authorities maintain certain continuing accounts with customers and for other purposes which involve multiple payments or transactions, and such accounts are "covered accounts" within the meaning of the Red Flag Rule; and, WHEREAS, to comply with the Red Flags Rule, City Staff has prepared an identity theft prevention program in the form attached hereto as Exhibit "A" and incorporated herein by this reference (the "ITTP" or the "Program ") and have recommended that the Program now be approved by the City of Owasso and the Owasso Public Works and Public Golf Authorities Trustees for implementation. NOW, THEREFORE, BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF OWASSO AND TRUSTEES OF THE OWASSO PUBLIC WORKS AUTHORITY AND OWASSO PUBLIC GOLF AUTHORITY; THAT, Section 1. (a) The Program is hereby approved and adopted effective the date set forth below. (b) City of Owasso, Owasso Public Works Authority, and Owasso Public Golf Authority Staff are hereby authorized and directed to implement the program in accordance with its terms. ADOPTED AND APPROVED THIS DAY QheMAY, 2009. ATTEST: 11111111 ►IIII ` A . .�G Q SEAL o_ r?J. •gib. 0111111///1/ Q�blic Goof ottrc�� •9 �': _ o Seat • o - TO: THE HONORABLE MAYOR AND COUNCIL CITY OF OWASO THE HONORABLE CHAIR AND TRUSTEES OWASSO PUBLIC WORKS AUTHORITY THE HONORABLE CHAIR AND TRUSTEES OWASSO PUBLIC GOLF AUTHORITY FROM: ANGELA HESS FINANCE DIRECTOR SUBJECT: RESOLUTION NO. 2009-03 RED FLAG RULES IDENTITY THEFT PREVENTION DATE: May 15, 2009 BACKGROUND: Pursuant to federal law, the Federal Trade Commission adopted Identity Theft Rules requiring the creation of certain policies relating to the use of consumer reports, address discrepancy and the detection, prevention and mitigation of identity theft. The Federal Trade Commission regulations adopted as 16 CFR § 681.2 require creditors, as defined by 15 U.S.C. § 681(a)(5) to adopt red flag policies to prevent and mitigate identity theft with respect to covered accounts. 15 U.S.C. § 168la(r)(5) cites 15 U.S.C. § 1691a, which defines a creditor as a person that extends, renews or continues credit, and defines "credit" in part as the right to purchase property or services and defer payment therefore. The Federal Trade Commission regulations include utility companies in the definition of creditor. The City of Owasso and the Owasso Public Works and Public Golf Authorities are creditors with respect to 16 CFR § 681.2 by virtue of providing utility services or by otherwise accepting payment for municipal services in arrears. The Federal Trade Commission regulations define "covered account' in part as an account that a creditor provides for personal, family or household purposes that is designed to allow multiple payments or transactions and specifies that a utility account is a covered account. The Federal Trade Commission regulations require each creditor to adopt an Identity Theft Prevention Program which will use red flags to detect, prevent and mitigate identity theft related to information used in covered accounts. OPWA residential customer accounts for water, sewer, and sanitation services for which payment is made after the product is consumed or the service has otherwise been provided are covered accounts by virtue of being for household purposes and allowing for multiple payments or transactions. The Federal Trade Commission regulations adopted as 16 CFR 681.2, require users of consumer credit reports to develop policies and procedures relating to address discrepancies between information provided by the consumer and information provided by a consumer credit company. The City of Owasso, OPWA and OPGA currently do not use consumer credit reports to establish various customer accounts, but may at some time in the future begin using consumer credit reports. Accordingly, the City of Owasso, OPWA, and OPGA have enacted an Identity Theft Prevention Program in compliance with federal law. ADDITIONAL INFORMATION: The Rules require that each entity: • Identify patterns, practices and specific forms of activity that indicate the possible existence of identity theft. • Perform a risk assessment of all internal operations where identity theft is possible. • Develop a written Identity Theft Prevention Program. The plan must be customized to be appropriate to the size and complexity of the nature and scope of activities performed by the municipality. • Update the program periodically to reflect changes in risks. The program is considered a living document and must be reviewed and modified to reflect changes in risk and experience with the workings of the program. Program administration requires: • Governing Body to approve the written ITPP. • Governing Body to designate a senior manager to oversee the implementation, and administration of the program. • Staff to receive formal training on the implementation of the program. Reporting Requirements: • On or around May 1, a mid -year review of the Program's operations must be completed. • Conduct an Incident Review of all Red Flag events that occurred during the last 6 months to include actions taken to limit customer exposure and any preventive measures put in place. • Write an Annual Report to the Governing Body to report findings and actions taken during the year. FTC Enforcement: • Compliance checks should be anticipated within the next 24 months by the FTC or Office of the Attorney General. • In the event of a knowing violation that constitutes a pattern or practice of violations, the FTC may commence a civil penalty of up to $3500 per violation with provisions made for increased penalties based on inflation. REQUESTED ACTION: On October 21, 2008, the City Council appointed the City Manager as the Senior Administrator of the Identity Theft Prevention Program. The city staff has since developed a written program in accordance with the federal law. This request is for Council and Trustee approval of the Resolution formally adopting the City of Owasso Identity Theft Prevention Program and directing city staff to implement the program in accordance with its terms. An item has been placed on the City Council, OPWA, and OPGA agendas requesting action on such Resolution. RECOMMENDATION: Staff recommends Trustee approval of Resolution No. 2009 -03, formally adopting the Identity Theft Prevention Program. ATTACHMENTS: 1) Resolution No. 2009 -03