[Federal Register Volume 83, Number 219 (Tuesday, November 13, 2018)]
[Notices]
[Pages 56325-56327]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-24682]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Agency Information Collection Activities; Submission for OMB 
Review; Comment Request

AGENCY: Federal Trade Commission (``FTC'' or ``Commission'').

ACTION: Notice; request for comments.

-----------------------------------------------------------------------

SUMMARY: The FTC intends to ask the Office of Management and Budget 
(``OMB'') to extend for an additional three years the current Paperwork 
Reduction Act (``PRA'') clearance for the information collection 
requirements in the FTC Red Flags, Card Issuers, and Address 
Discrepancies Rules \1\ (``Rules''). That clearance expires on November 
30, 2018.
---------------------------------------------------------------------------

    \1\ 16 CFR 681.1 (Duties regarding the detection, prevention, 
and mitigation of identity theft); 16 CFR 681.2 (Duties of card 
issuers regarding changes of address); 16 CFR 641.1 (Duties of users 
of consumer reports regarding address discrepancies).

---------------------------------------------------------------------------
DATES: Comments must be submitted by December 13, 2018.

ADDRESSES: Interested parties may file a comment online or on paper by 
following the instructions in the Request for Comment part of the 
SUPPLEMENTARY INFORMATION section below. Write ``Red Flags Rule, PRA 
Comment, Project No. P095406'' on your comment. File your comment 
online at https://ftcpublic.commentworks.com/ftc/RedFlagsPRA2 by 
following the instructions on the web-based form. If you prefer to file 
your comment on paper, mail your comment to the following address: 
Federal Trade Commission, Office of the Secretary, 600 Pennsylvania 
Avenue NW, Suite CC-5610 (Annex J), Washington, DC 20580, or deliver 
your comment to the following address: Federal Trade Commission, Office 
of the Secretary, Constitution Center, 400 7th Street SW, 5th Floor, 
Suite 5610 (Annex J), Washington, DC 20024.

FOR FURTHER INFORMATION CONTACT: Requests for additional information 
should be addressed to Mark Eichorn, Assistant Director, Division of 
Privacy and Identity Protection, Bureau of Consumer Protection, (202) 
326-3053, Federal Trade Commission, 600 Pennsylvania Avenue NW, 
Washington, DC 20580.

SUPPLEMENTARY INFORMATION: 
    Title: Red Flags Rule, 16 CFR 681.1; Card Issuers Rule, 16 CFR 
681.2; Address Discrepancy Rule, 16 CFR part 641.
    OMB Control Number: 3084-0137.
    Type of Review: Extension of currently approved collection.
    Abstract: The Red Flags Rule requires financial institutions and 
certain creditors to develop and implement written Identity Theft 
Prevention Programs. The Card Issuers Rule requires credit and debit 
card issuers to assess the validity of notifications of address changes 
under certain circumstances. The Address Discrepancy Rule provides 
guidance on what covered users of consumer reports must do when they 
receive a notice of address discrepancy from a nationwide consumer 
reporting agency. Collectively, these three anti-identity theft 
provisions are intended to prevent impostors from misusing another 
person's personal information for a fraudulent purpose.
    The Rules implement sections 114 and 315 of the Fair Credit 
Reporting Act (``FCRA''), 15 U.S.C. 1681 et seq.
    The Commission received no relevant public comments on the Rules' 
information collection requirements and FTC staff's associated PRA 
burden analysis and estimates that appeared in an August 8, 2018 
Federal Register Notice.\2\ That Notice discusses in greater detail 
staff's methodology behind the estimates restated here in summary form, 
while also providing an overview of the Rules and the statutes that 
underlie them.\3\
---------------------------------------------------------------------------

    \2\ 83 FR 39096.
    \3\ This Federal Register Notice, however, corrects summary 
figures that had appeared in the prior Notice at Part II., page 
39,097 (inadvertently carried over from the FTC's 2015 published PRA 
estimates). The corrections are not numerically material, however, 
and the calculation methodologies that appeared in the prior Notice 
were as intended. Further, in Part III. C. of the prior Notice, at 
page 39,099, 1,667 hours then intended to be shown as an estimate 
for address verification were omitted from the hours subtotal for 
Section 315 and, by extension, the aggregate estimated burden hours 
for the Rules. However, given statutory changes that had not then 
been appropriately considered, those hours had been tied to an 
overstatement of the relevant population affected, as explained 
further in footnote 9 here. Accordingly, ultimately the estimated 
burden related to address verification is de minimis.
---------------------------------------------------------------------------

    Pursuant to the OMB regulations, 5 CFR part 1320, that implement 
the PRA,

[[Page 56326]]

44 U.S.C. 3501 et seq., the FTC is providing a second opportunity for 
the public to comment on:
    (1) Whether the disclosure requirements are necessary, including 
whether the information will be practically useful; (2) the accuracy of 
our burden estimates, including whether the methodology and assumptions 
used are valid; (3) ways to enhance the quality, utility, and clarity 
of the information to be collected; and (4) ways to minimize the burden 
of the collection of information.
    Estimated Annual Burden (1,385,290 hours; $66,185,200, labor costs)
    A. Section 114: Red Flags and Card Issuers Rules:

    (1) Red Flags:

(a) Estimated Number of Respondents: 157,585 \4\
---------------------------------------------------------------------------

    \4\ This figure comprises 6,278 financial institutions and 
151,307 creditors (87,774 high-risk entities, excluding financial 
institutions + 63,533 low-risk creditors). The total number of 
financial institutions draws from FTC staff analysis of state credit 
unions and insurers within the FTC's jurisdiction using 2015 Census 
Bureau data (``Statistics of U.S. Businesses'') and other online 
industry data. The total number of creditors draws from FTC staff 
analysis of 2015 Census data and industry data for businesses or 
organizations that market goods and services to consumers or other 
businesses or organizations subject to the FTC's jurisdiction, 
reduced by entities not likely to: (1) Obtain credit reports, report 
credit transactions, or advance loans; and (2) entities not likely 
to have covered accounts under the Rule. Currently, no further 
updated Census data is available online to inform revised estimates. 
Thus, for instant purposes, the FTC will continue to draw upon the 
2015 data.
---------------------------------------------------------------------------

    (i) High-Risk Entities: 94,052 \5\
---------------------------------------------------------------------------

    \5\ High-risk entities include, for example, financial 
institutions within the FTC's jurisdiction and utilities, motor 
vehicle dealerships, telecommunications firms, colleges and 
universities, and hospitals.
---------------------------------------------------------------------------

    (ii) Low-Risk Entities: 63,533 \6\
---------------------------------------------------------------------------

    \6\ Low-risk entities include, for example, public warehouse and 
storage firms, nursing and residential care facilities, automotive 
equipment rental and leasing firms, office supplies and stationery 
stores, fuel dealers, and financial transaction processing firms.
---------------------------------------------------------------------------

(b) Estimated Hours Burden: \7\
---------------------------------------------------------------------------

    \7\ See the August 8, 2018 Notice, 83 FR at 39098, for details 
underlying the Red Flags hours burden estimates.
---------------------------------------------------------------------------

    (i) High-Risk Entities: 1,222,676 hours
    (ii) Low-Risk Entities: 39,179 hours

    (2) Card Issuers Rule:

(a) Estimated Number of Respondents: 16,742 \8\
---------------------------------------------------------------------------

    \8\ FTC staff estimates that the Rule affects as many as 16,742 
card issuers within the FTC's jurisdiction. This includes, for 
example, state credit unions, general retail merchandise stores, 
colleges and universities, and telecoms.
---------------------------------------------------------------------------

(b) Estimated Hours Burden: 66,968 hours

    (3) Combined Labor Cost Burden: $65,112,327
    B. Section 315--Address Discrepancy Rule:
    (1) Estimated Number of Respondents: 121,000 \9\
---------------------------------------------------------------------------

    \9\ In the August 8, 2018 Notice, the estimated number of 
businesses that would be required to comply with the Address 
Discrepancy Rule had been greatly overstated. 83 FR at 39099. The 
FTC Address Discrepancy Rule covers only users of consumer reports 
that are motor vehicle dealers described in section 1029(a) of the 
Dodd-Frank Act and that are predominantly engaged in the sale and 
servicing of motor vehicles, the leasing and servicing of them, or 
both. See 77 FR 22200, 22201 (Apr. 13, 2012). The FTC recently 
estimated that there are approximately 121,000 motor vehicle 
dealers, determined as follows: 86,442 car dealers per NAICS data 
(49,905 new car dealers, 36,537 used car dealers) + [3,191 
Recreational Vehicle Dealers; 7,185 boat dealers; 24,157 motorcycle, 
ATV/All Other Motor Vehicle Dealers] = 120,975. 82 FR 12452 (March 
3, 2017). By extension, the estimated number of respondents expected 
to perform address verification, which had always been secondary to 
the estimates concerning customer verification and very small 
relative to the overall population subject to this Rule, becomes de 
minimis with the corrective adjustment to the latter. Thus, the 
estimates now concern customer verification only.
---------------------------------------------------------------------------

    (2) Estimated Hours Burden: 56,467 hours \10\
---------------------------------------------------------------------------

    \10\ Based on an estimated average of 28 minutes per respondent. 
See 83 FR at 39099.
---------------------------------------------------------------------------

    (3) Estimated Labor Cost Burden: $1,072,873 \11\
---------------------------------------------------------------------------

    \11\ Based on an estimated hourly wage of $19 for administrative 
support personnel (computer operators; data entry and information 
processing workers; word processors and typists).
---------------------------------------------------------------------------

    C. Capital/Non-Labor Costs for Sections 114 and 315.
    FTC staff believes that the Rules impose negligible capital or 
other non-labor costs, as the affected entities are likely to have the 
necessary supplies and/or equipment already (e.g., offices and 
computers) for the information collections described herein.

IV. Request for Comment

    You can file a comment online or on paper. For the FTC to consider 
your comment, we must receive it on or before December 13, 2018. Write 
``Red Flags Rule, PRA Comment, Project No. P095406'' on your comment. 
Your comment--including your name and your state--will be placed on the 
public record of this proceeding, including, to the extent practicable, 
on the public FTC website, at http://www.ftc.gov/os/publiccomments.shtm.
    Postal mail addressed to the Commission is subject to delay due to 
heightened security screening. As a result, we encourage you to submit 
your comments online, or to send them to the Commission by courier or 
overnight service. To make sure that the Commission considers your 
online comment, you must file it at https://ftcpublic.commentworks.com/ftc/RedFlagsPRA2 by following the instructions on the web-based form. 
When this Notice appears at http://www.regulations.gov/#!home, you also 
may file a comment through that website.
    If you file your comment on paper, write ``Red Flags Rule, PRA 
Comment, Project No. P095406'' on your comment and on the envelope, and 
mail it to the following address: Federal Trade Commission, Office of 
the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex J), 
Washington, DC 20580, or deliver your comment to the following address: 
Federal Trade Commission, Office of the Secretary, Constitution Center, 
400 7th Street SW, 5th Floor, Suite 5610 (Annex J), Washington, DC 
20024. If possible, submit your paper comment to the Commission by 
courier or overnight service.
    Because your comment will be placed on the publicly accessible FTC 
website at https://www.ftc.gov/, you are solely responsible for making 
sure that your comment does not include any sensitive or confidential 
information. In particular, your comment should not include any 
sensitive personal information, such as your or anyone else's Social 
Security number; date of birth; driver's license number or other state 
identification number, or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. You are also 
solely responsible for making sure that your comment does not include 
any sensitive health information, such as medical records or other 
individually identifiable health information. In addition, your comment 
should not include any ``trade secret or any commercial or financial 
information which . . . is privileged or confidential''--as provided by 
Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 
16 CFR 4.10(a)(2)--including in particular competitively sensitive 
information such as costs, sales statistics, inventories, formulas, 
patterns, devices, manufacturing processes, or customer names.
    Comments containing material for which confidential treatment is 
requested must be filed in paper form, must be clearly labeled 
``Confidential,'' and must comply with FTC Rule 4.9(c). In particular, 
the written request for confidential treatment that accompanies the 
comment must include the factual and legal basis for the request, and 
must identify the specific portions of the comment to be withheld from 
the public record. See FTC Rule 4.9(c). Your comment will be kept 
confidential only if the General Counsel grants your request in 
accordance with the law and the public interest. Once your comment has 
been posted on the public FTC

[[Page 56327]]

website--as legally required by FTC Rule 4.9(b)--we cannot redact or 
remove your comment from the FTC website, unless you submit a 
confidentiality request that meets the requirements for such treatment 
under FTC Rule 4.9(c), and the General Counsel grants that request.
    The FTC Act and other laws that the Commission administers permit 
the collection of public comments to consider and use in this 
proceeding as appropriate. The Commission will consider all timely and 
responsive public comments that it receives on or before December 13, 
2018. For information on the Commission's privacy policy, including 
routine uses permitted by the Privacy Act, see https://www.ftc.gov/site-information/privacy-policy. For supporting documentation and other 
information underlying the PRA discussion in this Notice, see http://www.reginfo.gov/public/jsp/PRA/praDashboard.jsp.
    Comments on the information collection requirements subject to 
review under the PRA should additionally be submitted to OMB. If sent 
by U.S. mail, they should be addressed to Office of Information and 
Regulatory Affairs, Office of Management and Budget, Attention: Desk 
Officer for the Federal Trade Commission, New Executive Office 
Building, Docket Library, Room 10102, 725 17th Street NW, Washington, 
DC 20503. Comments sent to OMB by U.S. postal mail, however, are 
subject to delays due to heightened security precautions. Thus, 
comments instead can also be sent by email to [email protected].

Heather Hippsley,
Deputy General Counsel.
[FR Doc. 2018-24682 Filed 11-9-18; 8:45 am]
 BILLING CODE 6750-01-P