[Amended 12-16-2008 by Ord. No. 08-12-2002]
This law is designed to identify and address the warning signs
that indicate potential identity theft in order to prevent the misappropriation
of Identifying Information in connection with the opening and maintenance
of certain utility accounts. The Utility has developed the Program
to comply with the Federal Trade Commission's ("FTC") Red Flag
Rules, implemented under § 114 of the Fair and Accurate
Credit Transactions Act of 2003, pursuant to 16 C.F.R. 681.2. The
Commission analyzed the Utility's billing practices and concluded
the Utility maintains "Covered Accounts" (as defined in the Red Flag
Rules) and, consequently, must implement a written program to comply
with the Red Flag Rules.
This law was developed with oversight and approval of the Village
Board and shall be implemented by senior management staff. After consideration
of the size and complexity of the Utility's operations and Account
systems, and the nature and scope of the Utility's activities,
the Village Board determined that this Program appropriately satisfies
the Utility's obligation under the Red Flag Rules and therefore
approves this Program on December 16, 2008.
For purposes of this Program:
(A)
ACCOUNT or COVERED ACCOUNT —
(1)
A continuing relationship the Utility has with an
individual through an account the Utility offers or maintains primarily
for personal, family or household purposes, that involves multiple
payments or transactions; and
(2)
Any other account the Utility offers or maintains
for which there is a reasonably foreseeable risk to customers or to
the safety and soundness of the Utility from Identity Theft.
(B)
IDENTITY INFORMATION — "Any name or number that
may be used, alone or in conjunction with any other information, to
identify a specific person" and includes: Name, address, telephone
number, social security number, date of birth, governmental issued
driver's license number or other identification number, alien
registration number, government passport number, employer or tax identification
number, unique electronic identification number, computer internet
protocol address, and routing codes.
(C)
IDENTITY THEFT — "Fraud committed using the identifying
information of another person".
(D)
RED FLAG — A pattern, practice, or specific activity
that indicates the possible existence of Identity Theft.
In order to identify relevant Red Flags, the Utility considered,
and shall continue to consider, the following risk factors: (i) the
types of Covered Accounts that it offers and maintains, (ii) the method
it provides to open its Covered Accounts, (iii) the methods it provides
to access its Covered Accounts, and (iv) its previous experience with
Identity Theft. The Utility incorporated relevant Red Flags from the
following sources: (i) incidents of identity theft that the Utility
has experienced, (ii) methods of identity theft that the Utility has
identified that reflect changes in identity theft risks, and (iii)
applicable supervisory guidance. The Utility identified the following
Red Flags, in each of the listed categories:
(A)
Suspicious Documents.
(1)
Receiving documents provided for identification that
appears to be forged or altered;
(2)
A customer's photograph or physical description
on an identification is not consistent with the person presenting
the documentation;
(3)
Receiving other documentation with information that
is not consistent with existing customer information, such as a signature
or recent check; and
(4)
Receiving an application for service that appears
to have been altered or forged, or gives the appearance of being destroyed
and reassembled.
(B)
Suspicious Identifying Information.
(1)
A customer's identifying information is inconsistent
with other sources of identifying information;
(2)
A customer's identifying information is inconsistent
with other information the customer provides (such as inconsistent
SSNs or birth dates);
(3)
A customer's identifying information is the
same as shown on other applications found to be fraudulent;
(4)
A customer's identifying information is consistent
with fraudulent activity (such as an invalid phone number or fictitious
billing address);
(5)
A customer's SSN is the same as another customer's
SSN;
(6)
A customer's address or phone number is the
same as that of another person;
(7)
A customer fails to provide complete personal identifying
information on an application when reminded to do so; and
(8)
A customer's identifying information is not
consistent with the information that is on file for the customer.
(C)
Unusual Use of, or Suspicious Activity Related to,
a Covered Account.
(1)
A request to change the Account holder's name
or add other parties is received shortly after a change of address
for an Account;
(2)
A new Account is used in a manner consistent with
fraud (such as the customer failing to make the first payment, or
making the initial payment and no other payments);
(3)
An Account being used in a way that is not consistent
with prior use (such as late or no payments when the Account has been
timely in the past);
(4)
Mail sent to the Account holder is repeatedly returned
as undeliverable;
(5)
The Utility receives notice that a customer is not
receiving paper statements;
(6)
The Utility receives notice that an Account has unauthorized
activity;
(7)
The Utility's computer system is breached; and
(8)
Unauthorized access to or use of customer Account
information.
(D)
Notice Regarding Possible Identity Theft. The Utility
receives notice from a customer, a victim of identity theft, law enforcement
authority or any other person regarding possible identity theft in
connection with a Covered Account.
(A)
In order to detect any of the Red Flags identified
above with the opening of a new Account, Utility personnel will take
the following steps to obtain and verify the identity of the person
opening the Account:
(1)
Requiring certain identifying information such as
name, date of birth, residential or business address, principal place
of business for an entity, SSN, driver's license or other identification;
(2)
Verifying the customer's identity, such as by
copying and reviewing a driver's license or other identification
card;
(3)
Reviewing documentation showing the existence of
a business entity; and
(4)
Independently contacting the customer.
(B)
In order to detect any of the Red Flags identified
above for an existing Covered Account, Utility personnel will take
the following steps to monitor transaction with a Covered Account.
(A)
In the event Utility personnel detect any identified
Red Flags, such personnel shall take one or more of the following
steps, depending on the degree of risk posed by the Red Flag:
(1)
Continuing to monitor an Account for evidence of
Identity Theft by placing a "Red Flag Exists" warning on the Account;
(2)
Creating a database to track past Red Flags;
(3)
Contacting the customer;
(4)
Not opening a new Account;
(5)
Closing an existing Account;
(6)
Notifying law enforcement; or
(7)
Determining that no response is warranted under the
particular circumstances.
(B)
In order to further prevent the likelihood of identity
theft occurring with respect to Utility Accounts, the Utility will
take the following steps with respect to its internal operating procedures:
(1)
Ensuring complete and secure destruction of paper
documents and computer files containing customer information, including
documentation of such destruction;
(2)
Ensuring that office computers are password protected;
(3)
Requiring only the last four digits of SSNs on customer
applications;
(4)
Limiting access to Accounts to only employees that
require access;
(5)
Prohibiting Account information to be written on
sticky pads or note pads;
(6)
Ensuring that computer screens are only visible to
the employee accessing the Account; and
(7)
Requiring customers to authenticate addresses and
personal information, rather than Account representatives asking if
the information is correct.
This Program will be periodically reviewed and updated to reflect
changes in risks to customers and soundness of the Utility from Identity
Theft. At least once per year, the Program Administrator will consider
the Utility's experiences with Identity Theft situation, changes
in Identity Theft methods, changes in Identity Theft detection and
prevent methods, changes in types Accounts the Utility maintains and
changes in the Utility's business arrangements with other entities.
After considering these factors, the Program Administrator will determine
whether changes to the Program, including the listing of Red Flags,
are warranted. If warranted, the Program Administrator will present
the Village Board with recommended changes and the Village Board will
make a determination of whether to accept, modify or reject those
changes to the Program.
(A)
Oversight. The Program will be overseen by a Program
Administrator. The Program Administrator shall be the Clerk for the
Village. The Program Administrator will be responsible for the Program's
administration, for ensuring appropriate training of employees on
the Program, for reviewing any staff reports regarding the detection
of Red Flags and steps for preventing and mitigating Identity Theft,
determining which steps of the prevention and mitigation should be
taken in particular circumstances, reviewing and if necessary, approving
changes to the Program.
(B)
Staff Training and Reports. Employees responsible for
implementing the Program shall be trained either by or under the direction
of the Program Administrator in the detection of Red Flags and the
responsible steps to be taken when a Red Flag is detected. Each employee
responsible for implementing the Program shall sign an Identity Theft
Program Acknowledgement. Such training and acknowledgement will be
sufficient to effectively implement the Program.
(C)
Violation. The Program Administrator will be responsible
for notifying the appropriate individual of any failure of the employees
in adhering to the provisions of the Program. All employees have been
advised that violations of the policies set forth herein may be grounds
for disciplinary action.
[Amended 5-17-2011 by Ord. No. 2011-05-01]
As required by the Illinois Identity Protection Act of 2010, there is hereby adopted in the Village of Brownstown the Privacy Policy as stated in the attached document entitled "Chapter 22, Article II: Village Policy with Regard to the Collection, Use and Communication of Individuals' Social Security Numbers" with regard to the collection, use, and communication of an individual's Social Security Number by employees, officials, contractors and/or subcontractors of the Village which is hereby adopted by reference as if fully set forth herein.
The Privacy Policy adopted in this article and Chapter shall
be subject to amendment from time to time by the Village Board as
the Village Board shall deem necessary in its sole discretion in order
to maintain the Village's compliance with the Illinois Identity
Protection Act as now or hereafter amended. (See Addendum A).[1]
[1]
Editor's Note: Addendum A is included as an attachment
to this chapter.
Any person who violates any portion of this article or the attached
Policy, as now or hereafter amended, shall be subject to a fine of
not less than $100 for the first such violation and a fine of not
less than $500 for each violation thereafter.
