§ 14-6 — Identity theft prevention program

Sec. 14-6. - Identity theft prevention program.

(a) Objective. (1) To protect the identity and personal financial data of our customers and minimize the possibility of identity theft of customer information. (2) To comply with the FACT Act of 2003 and the requirements of the Federal Trade Commission and their "Red Flags" Rule as published in the Federal Register on November 9, 2007. (3) To establish a program to detect, prevent and mitigate identity theft. (b) Scope. (1) This policy applies to all employees, management and contractors of the city. (2) This policy supplements but does not replace existing policies. (c) Policy. (1) The city clerk ["administrator"] will be responsible for ongoing involvement in the development, implementation and administration of the identity theft prevention program. (2) Training for employees who handle sensitive personal information will be provided as necessary. (3) Oversight of third party service providers will assure that they also comply with the program. (4) A written annual report will be made and presented to the mayor and board of aldermen on compliance with the program and any incidents experienced for the year. The report will include: a. The effectiveness of the policies and procedures in addressing the risk of identity theft. b. Significant incidents that have occurred and management's response. c. Recommendations for changing the program. (5) As risk factors are discovered, such as identity theft, customer information breach, etc., the policy will be revised to address any future risks. (6) An investigation will be conducted when any of the following "red flags" are discovered. They may include, but are not limited to: a. Incidents of identity theft. b. Methods of identity theft that reflect identity theft risks. c. Alerts, notifications or other warnings received from a consumer reporting agency or third party service provider. d. The presentation of suspicious documents, such as altered or forged. e. The presentation of suspicious personal identification information. f. The unusual use of an account. g. Notice from customers, victims of identity theft, law enforcement authorities or other persons regarding possible identity theft. h. A fraud or active duty alter is included with a consumer credit report. i. A consumer credit reporting agency provides a notice of address discrepancy. j. Identification photo that does not match the person. k. Invalid Social Security Number. l. Mail sent to a customer is frequently returned. (7) When setting up a new customer or changing an address for an existing customer, every effort should be made to verify all information given. (8) Monitoring the security of customer identity data must be an ongoing process. When it is determined that a customer's information has been jeopardized, the following procedure will be followed: a. Contact the customer(s). b. Notify the mayor and board of aldermen. c. Take immediate steps to eliminate the cause of the breach of information. d. Notify law enforcement if the situation warrants. (9) The city clerk will provide ongoing oversight of third party software providers and service providers that utilize customer information to assure that customer identity information is secure and utilized properly. (d) Responsibility. The city clerk is responsible for the administration of this policy.

(Ord. No. 2008-10-715, §§ I—IV, 10-21-08)