On October 30, 2009, the FTC decided for the second time to extend the enforcement date of the "Red Flag Rules" -- this time to June 1, 2010. This decision comes as the ranks of the critics of the rules continues to grow. On the litigation front, on October 29, 2009, the District Court of the District of Columbia granted a permanent injunction preventing the FTC from enforcing the Red Flag Rules against attorneys. On the legislative front, on October 20, the House of Representatives passed a bill that would exclude health care practices, accounting practices, and legal practices with 20 or fewer employees from the Rule, and would also exempt any business: (i) where all the clients or customers were known individually; (ii) that only perform services in or around residences of their customers; or (iii) have not experienced identity theft and are in an industry where identity theft is rare.
The continuing extension of enforcement dates, the pending legislative modifications, and the success of legal challenges mean that the Red Flag Rules, when they are eventually enforced, will likely apply to a smaller number of businesses, and will likely have additional provisions that "water-down" the requirements.