1.01.002_Identity Theft Prevention ProgramDate of Notice:
10/30/2008
:Staff Contact: Dan Schwarz, Interim City Manager
............ ----------- -
!Department: Administration
Meeting------ . - - _Date',:
L
:Agenda Title:�
.Council/CDC/RPt-A:l
7
Itern Title:
,Action:
'otY
I �---
Attachments:
Comments:
future Item:
10/28/2068 rl-Agenda3(4)
CONSENT CALENDAR
Council Resolution
Cale
-nd—ar consent
Establishing an Identity Theft Prevention Program
Adopted as Submitted
Resolution - fully executed returned
I ---- -- -- - ,Copy to: Sandy Lipitz, Director of Administrative Services
,Kristina Owens, Utility, Billing 'Supervisor
-
James Atencio, Assistant City Attorney
[File (s): SUBJECT FILE: Finance Department - Miscellaneous
POLICY BINDER: 415.34 - Identity Theft Prevention Program
'File Subtab:
'Annual'Reminder:
Council Agenda Chron
Item #-
2008-172
Agenda Packet Preparation TIMELI. ..,S for Regular City Council Meetings
held on the 2nd & 4`'' Tuesdays of each month:
Resolutions (other than standard formats for authorizations and approvals), Ordinances &
Agreements to Assistant City Attorney via email for review and approval as to form DUE
later than NOON Three (3) Mondays prior to Council meeting date
—genda Items w/attachments via email and hard copy to City Clerk DUE no later than
NOON Two (2) Fridays prior to Council meeting date
Agenda Draft review by Mayor, City Manager, Assistant City Attorney, City Clerk no later
than Tuesday morning One (1) week prior to Council meeting date
Agenda Packets distributedto City Council and Agendas posted/distributed/mailed on
Wednesday afternoon One (1) week prior to Council meeting date in compliance with
Rohnert Park Municipal Code Section 2.08.050
{This section for City Clerk Use Only)
RESOLUTION NO. 2008-172
Council: X
Miscellaneous
Communications
Agenda: 10128108 X 10/22/08 -TG
Copy to:
CITY OF ROHNERT PARK
COUNCIL AGENDA ITEM TRANSMITTAL REPORT
Meeting Date: October 28, 2008
Department: ' Administration
Submitted By: Dan Schwarz, Interim City Manager
Submittal Date: October 22, 2008
Agenda Title: IDENTITY THEFT PREVENTION PROGRAM
Requested Council Action:. Adopt a Resolution Establishing an Identity Theft Prevention Program as
Required by the Fair and Accurate Credit Transactions Act (FACTA)
Summary:
The Federal Trade Commission (FTC), the federal bank regulatory agencies, and the National Credit
Union Administration (NCUA) have issued regulations (the Red Flags Rules) requiring financial
institutions and creditors to develop and implement written identity theft prevention programs, as part of
the Fair and Accurate Credit Transactions Act (FACTA). The programs must be in place by November 1,
2008, and must provide for the identification, detection, and response to patterns, practices, or specific
activities — known as "red flags" — that could indicate identity theft.
The Red Flag Rules apply to local government entities considered to be "creditors" with "covered
accounts." The FTC considers a government entity to be a creditor where it defers payment for goods or
services by its customers. As the City provides water, sewer, and refuse services to customers, and the
customers do not pay for these services until after they have been provided, the adoption of an identity
theft program is required. Failure to design and implement a program may lead to an administrative fine
from the FTC of up to $2500, as well as exposure to liability in civil actions.
Enclosures: Draft Resolution and Identity Theft Prevention Program (Exhibit A)
CITY ATTORNEY'S REVIEW: Relevant documents for this agenda item have been reviewed and approved as
to form by the City Attorney.
CITY MANAGER'S RECOMMENDATION: onsent Item ( ) Regular Time
pproval () Public Hearing Required
( ) Not Recommended O Submitted with Comment
( ) Policy Determination by Council
( ) City Comments:
Interim City Manager's Signature:r Date: % Civ
RESOLUTION NO. 2008-172
RESOLUTION OF THE CITY COUNCIL OF THE CITY OF ROHNERT PARK
ESTABLISHING AN IDENTITY THEFT PREVENTION PROGRAM
WHEREAS, the Federal Trade Commission ("FTC") has adopted regulations requiring
"creditors" with "covered accounts" to develop and implement by November 1, 2008, an identity
theft prevention program that complies with those regulations;
WHEREAS, the FTC considers a government entity to be a "creditor" where it defers
payment for goods or services by its customers;
WHEREAS, as the City provides water, sewer, and refuse services to customers, and the
customers do not pay for these services until after they have been provided, the adoption of an
identity theft program is required; and
WHEREAS, the City Council desires to take action to comply with the applicable FTC
regulations by adopting an identity theft prevention program.
NOW, THEREFORE, BE IT RESOLVED that the City Council of the City of Rohnert
Park adopts and directs City staff to implement the City of Rohnert Park Identity Theft
Protection Program attached as Exhibit "A."
DULY AND REGULARLY ADOPTED by the City Council of the City of Rohnert
Park this 281h day of October, 2008.
CITY OF ROHNERT PARK
Mayor Pro Tempore
APPROVED AS TO FORM:
A.
City
BREEZE: AYE SMITH: AYE STAFFORD: AYE VIDAK-MARTINEZ: AYE MACKENZIE: ABSENT
AYES: (4) NOES: (0) ABSENT: (1) ABSTAIN: (0)
Exhibit "A"
City of Rohnert Park
Identity Theft Prevention
Program
Effective November I, 2008
I. PROGRAM ADOPTION
The City of Rohnert Park ("City") developed this Identity Theft Prevention Program
("Program") pursuant to the Federal Trade Commission's Red Flag identity theft Rules ("Red Flag
Rules"), which implements Section 114 of the Fair and Accurate Credit Transactions (FACT) Act
of 2003. The Program was adopted by the City Council of the City of Rohnert Park on October 28,
2008.
II. PROGRAM PURPOSE AND DEFINITIONS
A. Fulfilling requirements of the Red Flags Rule
Under the Red Flag Rules, every financial institution and creditor is required to develop and
implement a written identity theft prevention program tailored to its size, complexity and the nature
of its operation. Rohnert Park qualifies as a "creditor" under FACTA because it defers payments
for the sale of utilities given to customers on a daily basis which are paid at the end of a billing
cycle.
The purpose of the Program is to:
Identify relevant Red Flags for new and existing covered accounts and incorporate those
Red Flags into the Program;
2. Detect Red Flags that have been incorporated into the Program;
3. Respond appropriately to any Red Flags that are detected to prevent and mitigate
identity theft; and
4. Ensure the Program is updated periodically to reflect changes in risks to customers and
to continually protect the creditor from identity theft.
1139050v1A 80078/0012
Exhibit "A"
B. Definitions used in this Program
"Covered account":
1. Any account the City offers or maintains primarily for personal, family or household
purposes, that involves multiple payments or transactions. Covered accounts include,
but are not limited to, utility accounts; and
2. Any other account the City offers or maintains for which there is a reasonably
foreseeable risk to customers or to the safety and soundness of the creditor from identity
theft, including financial, operational, compliance, reputation or litigation risks.
"Director":
The City Manager3 or his /her designee.
"Identifvina information":
Any name or number that may be used, alone or in conjunction with any other information,
to identify a specific person, including: name, address, telephone number, social security number,
date of birth, government issued driver's license or identification number, alien registration number,
government passport number, employer or taxpayer identification number, unique electronic
identification number, computer's Internet Protocol address, or routing code.
"Red Flag(s)":
' A pattern, practice or specific activity that indicates the possible existence of identity theft,
as more particularly described in Section III, below.
III. IDENTIFICATION OF RED FLAGS.
In order to identify relevant Red Flags, the City considers the types of accounts that it offers
and maintains, the methods it provides to open its accounts, the methods it provides to access its
accounts, and its previous experiences with identity theft. The City identifies the following red
flags, in each of the listed categories:
A. Suspicious Personal Identifying Information
Red Flags
1. Identifying information presented that is inconsistent with other information the
customer provides (example: inconsistent birth dates);
2. Identifying information presented that is inconsistent with other sources of information;
3. Identifying information presented that is the same as information shown on other
applications that were found to be fraudulent;
4. Identifying information presented that is consistent with fraudulent activity (such as an
invalid phone number or fictitious billing address);
11390500A 80078/0012 2
5. An address or phone number presented that is the same as that of another person;
6. A person fails to provide complete personal identifying information on an application
when reminded to do so; and
7. A person's identifying information is not consistent with the information that is on file
for the customer.
B. Suspicious Account Activity or Unusual Use of Account
Red Flags
1. Change of address for an account followed by a request to change the account holder's
name;
2. Payments stop on an otherwise consistently up-to-date account;
3. Account used in a way that is not consistent with prior use (example: very high
activity);
4. Mail sent to the account holder is repeatedly returned as undeliverable;
5. Notice to the City that a customer is not receiving mail sent by the City;
6. Notice to the City that an account has unauthorized activity;
7. Breach in the City's computer system security; and
8. Unauthorized access to or use of customer account information.
C. Notifications and Warnings from Credit Reporting Agencies
1. Report of fraud accompanying a credit report;
2. Notice or report from a credit agency of a credit freeze on a customer or applicant;
3. Notice or report from a credit agency of an active duty alert for an applicant; and
4. Indications from a credit report of activity that is inconsistent with a customer's usual
pattern or activity.
D. Alerts from Others
Red Flag
Notice to the City from a customer, identity theft victim, law enforcement or other person
that the City may have opened or may .be maintaining a fraudulent account for a person engaged in
identity theft.
1139050v1A 80078/0012 3
Exhibit "A"
IV. DETECTING RED FLAGS.
Red Flags will generally be detected when a person approaches the service counter to open
an account, pay for a service or undertake another type of transaction.
A. New Accounts
In order to detect any of the Red Flags identified above associated with the opening of a new
account, City personnel will take the following steps to obtain and verify the identity of the person
opening the account:
Require certain identifying information such as name, date of birth, residential or
business address, principal place of business for an entity, driver's license or other
identification;
2. Verify the customer's identity (e.g. review driver's license or other identification card);
and
3. Review documentation showing the existence of a business entity (if applicable).
B. Existing Accounts
In order to detect any of the Red Flags for an existing account, City personnel will take the
following steps to monitor transactions with an account:
Verify the identification of customers if they request information, whether in person, via
telephone, via facsimile or via e-mail;
2. Verify the validity of requests to change billing addresses; and
3. Verify changes in banking information given for billing and payment purposes.
V. RESPONDING TO RED FLAGS AND MITIGATING IDENTITY THEFT
In the event City personnel detects any identified Red Flags, they shall take one or more of
the following steps, depending on the degree of risk posed by the Red Flag:
Responsive Action
1. Continue to monitor an account for evidence of identity theft;
2. Contact the customer;
3. Change any passwords or other security devices that permit access to accounts;
4. Not open a new account;
5. Close an existing account;
6. Reopen an account with a new number;
7. Notify the Director for determination of the appropriate step(s) to take;
8. Notify law enforcement; and/or
9. Determine that no response is warranted under the particular circumstances.
1139050v1A 80078/0012 4
Exhibit "A"
Protect customer identifyinIz information
In order to prevent of identity theft occurring with respect to covered accounts, the City will
take the following steps with respect to its internal operating procedures to protect customer
identifying information:
1. Ensure that office computers are password protected;
2. Keep offices clear of papers containing customer information;
3. Ensure computer virus protection is up to date;
4. Require and keep only the kinds of customer information that are necessary for utility
purposes; and
5. Ensure complete and secure destruction of paper documents and computer files containing
customer information.
VI. PROGRAM UPDATES
This Program will be periodically reviewed and updated to reflect changes in risks to
customers and the ability of the City to prevent identity theft. At least annually, the Director will
consider the City's experiences with identity theft, changes in identity theft methods, changes in
identity theft detection and prevention methods, changes in types of accounts the City maintains and
changes in the City's business arrangements with other entities. After considering these factors, the
Director will determine whether changes to the Program are warranted. If warranted, the Director
will update the Program and present the recommended changes to the City Council. The City
Council will make a determination of whether to accept, modify or reject those changes to the
Program.
VII. ADMINISTRATION OF PROGRAM
The Director shall be responsible for the development, implementation, oversight and
continued administration of the Program. City staff responsible for implementing the Program shall
be trained either by, or under the direction of, the Director in the detection of Red Flags, and the
responsive steps to be taken when a Red Flag is detected.
VIII. OVERSIGHT OF SERVICE PROVIDER ARRANGEMENTS
In the event City engages a service provider to perform an activity in connection with one or
more accounts, City will take the following steps to ensure the service provider performs its activity
in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the
risk of identity theft:
Require, by contract, that service providers have such policies and procedures in
place; and
2. Require, by contract, that service providers review the City's Program and report any
Red Flags to the Director.
1139050v1A 80078/0012