2008/10/28 City Council Resolution 2008-172RESOLUTION NO. 2008-172
RESOLUTION OF THE CITY COUNCIL OF THE CITY OF ROHNERT PARK
ESTABLISHING AN IDENTITY THEFT PREVENTION PROGRAM
WHEREAS, the Federal Trade Commission ( "FTC ") has adopted regulations requiring
"creditors" with "covered accounts" to develop and implement by November 1, 2008, an identity
theft prevention program that complies with those regulations;
WHEREAS, the FTC considers a government entity to be a "creditor" where it defers
payment for goods or services by its customers;
WHEREAS, as the City provides water, sewer, and refuse services to customers, and the
customers do not pay for these services until after they have been provided, the adoption of an
identity theft program is required; and
WHEREAS, the City Council desires to take action to comply with the applicable FTC
regulations by adopting an identity theft prevention program.
NOW, THEREFORE, BE IT RESOLVED that the City Council of the City of Rohnert
Park adopts and directs City staff to implement the City of Rohnert Park Identity Theft
Protection Program attached as Exhibit "A."
DULY AND REGULARLY ADOPTED by the City Council of the City of Rohnert
Park this 20h day of October, 2008.
CITY OF ROHNERT PARK
Mayor Pro Tempore
Al-
City orney
BREEZE: AYE 'SMITH: AYE STAFFORD: AYE VIDAK- MARTINEZ: AYE MACKENZIE: ABSENT
AYES: (4) NOES: (0) ABSENT: (1) ABSTAIN: (0)
Exhibit "A"
City of Rohnert Park
Identity Theft Prevention
Effective November I, 2008
I. PROGRAM ADOPTION
The City of Rohnert Park ( "City ") developed this Identity Theft Prevention Program
( "Program ") pursuant to the Federal Trade Commission's Red Flag identity theft Rules ( "Red Flag
Rules "), which implements Section 114 of the Fair and Accurate Credit Transactions (FACT) Act
of 2003. The Program was adopted by the City Council of the City of Rohnert Park on October 28,
2008.
II. PROGRAM PURPOSE AND DEFINITIONS
A. Fulfilling requirements of the Red Flags Rule
Under the Red Flag Rules, every financial institution and creditor is required to develop and .
implement a written identity theft prevention program tailored to its size, complexity and the nature
of its operation. Rohnert Park qualifies as a "creditor" under FACTA because it defers payments
for the sale of utilities given to customers on a daily basis which are paid at the end of a billing
cycle.
The purpose of the Program is to:
1. Identify relevant Red Flags for new and existing covered accounts and incorporate those
Red Flags into the Program;
2. Detect Red Flags that have been incorporated into the Program;
3. Respond appropriately to any Red Flags that are detected to prevent and mitigate
identity theft; and
4. Ensure the Program is updated periodically to reflect changes in risks to customers and
to continually protect the creditor from identity theft.
1139050v1A 80078/0012
Exhibit "A"
B. Definitions used in this Program
"Covered account ":
Any account the City offers or maintains primarily for personal, family or household
purposes, that involves multiple payments or transactions. Covered accounts include,
but are not limited to, utility accounts; and
2. Any other account the City offers or maintains for which there is a reasonably
foreseeable risk to customers or to the safety and soundness of the creditor from identity
theft, including financial, operational, compliance, reputation or litigation risks.
"Director ":
The City Manager; or his /her designee.
"Identifying information ":
Any name or number that may be used, alone or in conjunction with any other information,
to identify a specific person, including: name, address, telephone number, social security number,
date of birth, government issued driver's license or identification number, alien registration number,
government passport number, employer or taxpayer identification number, unique electronic
identification number, computer's Internet Protocol address, or routing code.
"Red Flag(s) ":
A pattern, practice or specific activity that indicates the possible existence of identity theft,
as more particularly described in Section III, below.
III. IDENTIFICATION OF RED FLAGS.
In order to identify relevant Red Flags, the City considers the types of accounts that it offers
and maintains, the methods it provides to open its accounts, the methods it provides to access its
accounts, and its previous experiences with identity theft. The City identifies the following red
flags, in each of the listed categories:
A. Suspicious Personal Identifying Information
Red Flags
1. Identifying information presented that is inconsistent with other information the
customer provides (example: inconsistent birth dates);
2. Identifying information presented that is inconsistent with other sources of information;
3. Identifying information presented that is the same as information shown on other
applications that were found to be fraudulent;
4. Identifying information presented that is consistent with fraudulent activity (such as an
invalid phone number or fictitious billing address);
11390500A 80078/0012 2
5. An address or phone number presented that is the same as that of another person;
6. A person fails to provide complete personal identifying information on an application
when reminded to do so; and
7. A person's identifying information is not consistent with the information that is on file
for the customer.
B. Suspicious Account Activity or Unusual Use of Account
Red Flags
1. Change of address for an account followed by a request to change the account holder's
name;
2. Payments stop on an otherwise consistently up -to -date account;
3. Account used in a way that is not consistent with prior use (example: very high
activity);
4. Mail sent to the account holder is repeatedly returned as undeliverable;
5. Notice to the City that a customer is not receiving mail sent by the City;
6. Notice to the City that an account has unauthorized activity;
7. Breach in the City's computer system security; and
8. Unauthorized access to or use of customer account information.
C. Notifications and Warnings from Credit Reporting Agencies
1. Report of fraud accompanying a credit report;
2. Notice or report from a credit agency of a credit freeze on a customer or applicant;
3. Notice or report from a credit agency of an active duty alert for an applicant; and
4. Indications from a credit report of activity that is inconsistent with a customer's usual
pattern or activity.
D. Alerts from Others
Red Fla>;
Notice to the City from a customer, identity theft victim, law enforcement or other person
that the City may have opened or may be maintaining a fraudulent account for a person engaged in
identity theft.
11390500A 80078/0012 3
Exhibit "A"
IV. DETECTING RED FLAGS.
Red Flags will generally be detected when a person approaches the service counter to open
an account, pay for a service or undertake another type of transaction.
A. New Accounts
In order to detect any of the Red Flags identified above associated with the opening of a new
account, City personnel will take the following steps to obtain and verify the identity of the person
opening the account:
Require certain identifying information such as name, date of birth, residential or
business address, principal place of business for an entity, driver's license or other
identification;
2. Verify the, customer's identity (e.g. review driver's license or other identification card);
and
3. Review documentation showing the existence of a business entity (if applicable).
B. Existing Accounts
In order to detect any of the Red Flags for an existing account, City personnel will take the
following steps to monitor transactions with an account:
1. Verify the identification of customers if they request information, whether in person, via
telephone, via facsimile or via e-mail;
2. Verify the validity of requests to change billing addresses; and
3. Verify changes in banking information given for billing and payment purposes.
V. RESPONDING TO RED FLAGS AND MITIGATING IDENTITY THEFT
In the event City personnel detects any identified Red Flags, they shall take one or more of
the following steps, depending on the degree of risk posed by the Red Flag:
Responsive Action
1. Continue to monitor an account for evidence of identity theft;
2. Contact the customer;
3. Change any passwords or other security devices that permit access to accounts;
4. Not open a new account;
5. Close an existing account;
6. Reopen an account with a new number;
7. Notify the Director for determination of the appropriate step(s) to take;
8. Notify law enforcement; and/or
9. Determine that no response is warranted under the particular circumstances.
1139050v1A 80078/0012' 4 .
Exhibit "A"
Protect customer identifying information
In order to prevent of identity theft occurring with respect to covered accounts, the City will
take the following steps with respect to its internal operating procedures to protect customer
identifying information:
1. Ensure that office computers are password protected;
2. Keep offices clear of papers containing customer information;
3. Ensure computer virus protection is up to date;
4. Require and keep only the kinds of customer information that are necessary for utility
purposes; and
5. Ensure complete and secure destruction of paper documents and computer files containing
customer information.
VI. - PROGRAM UPDATES
This Program will be periodically reviewed and updated to reflect changes in risks to
customers and the ability of the City to prevent identity theft. At least annually, the Director will
consider the City's experiences with identity theft, changes in identity theft methods, changes in
identity theft detection and prevention methods, changes in types of accounts the City maintains and
changes in the City's business arrangements with other entities. After considering these factors, the
Director will determine whether changes to the Program are warranted. If warranted, the Director
will update the Program and present the recommended changes to the City Council. The City
Council will make a determination of whether to accept, modify or reject those changes to the
Program.
VII. ADMINISTRATION OF PROGRAM
The Director shall be responsible for the development, implementation, oversight and
continued administration of the Program. City staff responsible for implementing the Program shall
be trained either by, or under the direction of, the Director in the detection of Red Flags, and the
responsive steps to be taken when a Red Flag is detected.
VIII. OVERSIGHT OF SERVICE PROVIDER ARRANGEMENTS
In the event City engages a service provider to perform an activity in connection with one or
more accounts, City will take the following steps to ensure the service provider performs its activity
in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the
risk of identity theft:
Require, by contract, that service providers have such policies and procedures in
place; and
2. Require, by contract, that service providers review the City's Program and report any
Red Flags to the Director.
1139050v1A 80078/0012 5