Skip to Content


Agency Information Collection Activities; Submission for OMB Review; Comment Request

Document Details

Information about this document as published in the Federal Register.

Enhanced Content

Relevant information about this document from provides additional context. This information is not part of the official Federal Register document.

Published Document

This document has been published in the Federal Register. Use the PDF linked in the document sidebar for the official electronic format.




The FTC intends to ask the Office of Management and Budget (“OMB”) to extend through November 30, 2015, the current Paperwork Reduction Act (“PRA”) clearance for the information collection requirements in the FTC Red Flags/Card Issuers/Address Discrepancies Rules [1] (“Rules”). That clearance expires on November 30, 2012.


Comments must be submitted by October 25, 2012.


Interested parties may file a comment online or on paper, by following the instructions in the Request for Comment part of the SUPPLEMENTARY INFORMATION section below. Write “Red Flags Rule, PRA2 Comment, Project No. P095406” on your comment, and file your comment online at by following the instructions on the web-based form. If you prefer to file your comment on paper, mail or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex J), 600 Pennsylvania Avenue NW., Washington, DC 20580.


Requests for additional information should be addressed to Steven Toporoff, Attorney, Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW., NJ-3158, Washington, DC 20580. Telephone: (202) 326-2252.


Title: Red Flags Rule, 16 CFR 681.1; Card Issuers Rule, 16 CFR 681.2; Address Discrepancy Rule, 16 CFR Part 641.

OMB Control Number: 3084-0137.

Type of Review: Extension of currently approved collection.

Abstract: The Red Flags Rule requires financial institutions and certain creditors to develop and implement written Identity Theft Prevention Programs. The Card Issuers Rule requires credit and debit card issuers to assess the validity of notifications of address changes under certain circumstances. The Address Discrepancy Rule provides guidance on what users of consumer reports must do when they receive a notice of address discrepancy from a nationwide consumer reporting agency. Collectively, these three anti-identity theft provisions are intended to prevent impostures from misusing another person's personal information for a fraudulent purpose.

On July 10, 2012, the Commission sought comment on the information collection requirements and staff's PRA burden estimates associated with the Rules (“July 10 Notice”). 77 FR 40614. No comments were received. Nonetheless, after further review of Census Bureau data, FTC staff has refined the estimated number of respondents subject to the Address Discrepancy Rule, which in turn, affects estimated hours burden in the aggregate. These revisions are detailed below.

Estimated Annual Burdens:[2]

A. Section 114: Red Flags and Card Issuers Rules:

(1) Red Flags:

(a) Estimated Number of Respondents: 167,639.

(i) High risk: 105,774.

(ii) Low risk: 61,865.

(b) Estimated Hours Burden:

(i) High-Risk Entities: 1,375,062 hours.

(ii) Low-Risk Entities: 38,150 hours.

(2) Card Issuers Rule:

(a) Estimated Number of Respondents: 17,978.

(b) Estimated Hours Burden: 71,912 hours.

(3) Combined Labor Cost Burden: $62,375,208.

B. Section 315—Address Discrepancy Rule:

(1) Estimated Number of Respondents: 1,757,385.

(2) Estimated Hours Burden: 821,780.

(3) Estimated Labor Cost Burden: $13,970,260.

C. Capital/Non-Labor Costs for Sections 114 and 315.

FTC staff believes that the Rules impose negligible capital or other non-labor costs, as the affected entities are likely to have the necessary supplies and/or equipment already (e.g., offices and computers) for the information collections described herein.

Revised Estimated Burden for the Address Discrepancy Rule:

The July 10 Notice stated that the number of entities likely covered by the Address Discrepancy Rule totaled 2,449,605 users of consumer reports. That tabulation, however, contained certain double-counting. Also, part of the revised estimate is based on newer Census data [3] that is also more consistent with source material previously used to estimate the population subject to the Address Discrepancy Rule.

Using the revised inputs, staff estimates that Section 315 affects approximately 1,757,385 users of consumer reports subject to the FTC's jurisdiction. In addition, staff estimates that approximately 10,000 of these users will receive notice of a discrepancy, in the course of their usual and customary business practices, and thereby have to furnish to credit reporting agencies an address confirmation.

As detailed in the July 10 Notice, estimated average annual burden per entity to develop and follow policies and procedures for a notice of discrepancy is 28 minutes.[4] The cumulative hour burden for 1,757,385 entities would thus be 820,113 hours. The average annual burden for the 10,000 users of consumer reports to furnish a correct address to a consumer reporting agency is 10 minutes per entity, for a total of 1,667 hours. Thus, the cumulative estimated burden for Section 315 is revised to 821,780 hours.

As further detailed in the July 10 Notice, the FTC estimates an hourly rate of $17 for administrative staff to comply with the policies and procedures for the Address Discrepancy Rule.[5] Accordingly, the total annual labor cost under Section 315 is revised to $13,970,260 (821,780 hours × $17 per hour).

Pursuant to the OMB regulations, 5 CFR Part 1320, that implement the PRA, 44 U.S.C. 3501 et seq., the FTC is providing a second opportunity for the public to comment while seeking OMB approval to renew the pre-existing clearance for the Rule.

Request for Comment:

You can file a comment online or on paper. For the FTC to consider your comment, we must receive it on or before October 25, 2012. Write “Red Flags Rule, PRA2, Project No. P095406” on your comment. Your comment—including your name and your state—will be placed on the public record of this proceeding, including, to the extent practicable, on the public Commission Web site, at As a matter of discretion, the Commission tries to remove individuals' home contact information from comments before placing them on the Commission Web site.

Because your comment will be made public, you are solely responsible for making sure that your comment does not include any sensitive personal information, like anyone's Social Security number, date of birth, driver's license number or other state identification number or foreign country equivalent, passport number, financial account number, or credit or debit card number. You are also solely responsible for making sure that your comment does not include any sensitive health information, like medical records or other individually identifiable health information. In addition, do not include any “[t]rade secret or any commercial or financial information which is obtained from any person and which is privileged or confidential * * *, ” as provided in Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2). If you want the Commission to give your comment confidential treatment, you must file it in paper form, with a request for confidential treatment, and you have to follow the procedure explained in FTC Rule 4.9(c), 16 CFR 4.9(c).[6] Your comment will be kept confidential only if the FTC General Counsel, in his or her sole discretion, grants your request in accordance with the law and the public interest.

Postal mail addressed to the Commission is subject to delay due to heightened security screening. As a result, we encourage you to submit your comments online, or to send them to the Commission by courier or overnight service. To make sure that the Commission considers your online comment, you must file it at by following the instructions on the web-based form. If this Notice appears at!home, you also may file a comment through that Web site.

If you file your comment on paper, write “Red Flags Rule, PRA2, Project No. P095406” on your comment and on the envelope, and mail or deliver it to the following address: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex J), 600 Pennsylvania Avenue NW., Washington, DC 20580. If possible, submit your paper comment to the Commission by courier or overnight service.

Visit the Commission Web site at to read this Notice. The FTC Act and other laws that the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. The Commission will consider all timely and responsive public comments that it receives on or before October 25, 2012. You can find more information, including routine uses permitted by the Privacy Act, in the Commission's privacy policy, at

Comments on the information collection requirements subject to review under the PRA should additionally be submitted to OMB. If sent by U.S. mail, they should be addressed to Office of Information and Regulatory Affairs, Office of Management and Budget, Attention: Desk Officer for the Federal Trade Commission, New Executive Office Building, Docket Library, Room 10102, 725 17th Street NW., Washington, DC 20503. Comments sent to OMB by U.S. postal mail, however, are subject to delays due to heightened security precautions. Thus, comments instead should be sent by facsimile to (202) 395-5167.

Willard K. Tom,

General Counsel.


2.  The calculations underlying the estimates for Section 114 are detailed in the related July 10, 2012 Federal Register Notice. See 77 FR at 40614.

Back to Citation

3. (Statistics of U.S. Businesses, “U.S., All industries”: 2009 “County Business Patterns” spreadsheet).

Back to Citation

4.  77 FR at 40617.

Back to Citation

6.  In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule 4.9(c), 16 CFR 4.9(c).

Back to Citation

[FR Doc. 2012-23524 Filed 9-24-12; 8:45 am]