Agency Information Collection Activities; Proposed Collection; Comment Request; Extension, 57425-57429 [2021-22478]

Download as PDF Federal Register / Vol. 86, No. 197 / Friday, October 15, 2021 / Notices received by scheduled appointment only. If you submit an electronic comment, EPA recommends that you include your name, mailing address, and an email address or other contact information in the body of your comment. This ensures that you can be identified as the submitter of the comment and allows EPA to contact you in case EPA cannot read your comment due to technical difficulties or needs further information on the substance of your comment. Any identifying or contact information provided in the body of a comment will be included as part of the comment that is placed in the official public docket and made available in EPA’s electronic public docket. If EPA cannot read your comment due to technical difficulties and cannot contact you for clarification, EPA may not be able to consider your comment. Use of the https:// www.regulations.gov website to submit comments to EPA electronically is EPA’s preferred method for receiving comments. The electronic public docket system is an ‘‘anonymous access’’ system, which means EPA will not know your identity, email address, or other contact information unless you provide it in the body of your comment. Please ensure that your comments are submitted within the specified comment period. Comments received after the close of the comment period will be marked ‘‘late.’’ EPA is not required to consider these late comments. Gautam Srinivasan, Associate General Counsel. [FR Doc. 2021–22519 Filed 10–14–21; 8:45 am] BILLING CODE 6560–50–P ENVIRONMENTAL PROTECTION AGENCY [ER–FRL–9058–8] Environmental Impact Statements; Notice of Availability Responsible Agency: Office of Federal Activities, General Information 202– 564–5632 or https://www.epa.gov/nepa. Weekly receipt of Environmental Impact Statements (EIS) Filed October 4, 2021 10 a.m. EST Through October 8, 2021 10 a.m. EST Pursuant to 40 CFR 1506.9. Notice Section 309(a) of the Clean Air Act requires that EPA make public its comments on EISs issued by other Federal agencies. EPA’s comment letters on EISs are available at: https:// VerDate Sep<11>2014 16:50 Oct 14, 2021 Jkt 256001 cdxnodengn.epa.gov/cdx-enepa-public/ action/eis/search. EIS No. 20210151, Final, FERC, PA, Marcus Hook Electric Compression Project, Review Period Ends: 11/15/ 2021, Contact: Office of External Affairs 866–208–3372. EIS No. 20210152, Draft Supplement, FHWA, IL, U.S. Route 34—Henderson County, Illinois, Comment Period Ends: 11/29/2021, Contact: Darien Siddall 217–492–4615. EIS No. 20210153, Draft, USAF, TX, T– 7A Recapitalization at Joint Base San Antonio, Texas, Comment Period Ends: 11/29/2021, Contact: Nolan Swick 210–925–3392. EIS No. 20210154, Final, FERC, LA, Evangeline Pass Expansion Project, Review Period Ends: 11/15/2021, Contact: Office of External Affairs 866–208–3372. Dated: October 8, 2021. Cindy S. Barger, Director, NEPA Compliance Division, Office of Federal Activities. 57425 to the Commission’s deliberations and voting. (In addition to publishing notices on EEOC Commission meetings in the Federal Register, the Commission also provides information about Commission meetings on its website, www.eeoc.gov, and provides a recorded announcement a week in advance on future Commission sessions.) Please telephone (202) 921–2750 (voice) or email commissionmeetingcomments@eeoc.gov at any time for information on this meeting. CONTACT PERSON FOR MORE INFORMATION: Shelley E. Kahn, Acting Executive Officer, (202) 921–3061. Date: October 13, 2021. Shelley E. Kahn, Acting Executive Officer, Executive Secretariat. [FR Doc. 2021–22679 Filed 10–13–21; 4:15 pm] BILLING CODE 6570–01–P FEDERAL ELECTION COMMISSION [FR Doc. 2021–22501 Filed 10–14–21; 8:45 am] Sunshine Act Meetings BILLING CODE 6560–50–P Thursday, October 14, 2021 at 10:00 a.m. PLACE: Virtual meeting. Note: Because of the COVID–19 pandemic, we will conduct the open meeting virtually. If you would like to access the meeting, see the instructions below. STATUS: The October 14, 2021 Open Meeting has been canceled. CONTACT PERSON FOR MORE INFORMATION: Judith Ingram, Press Officer, Telephone: (202) 694–1220. Authority: Government in the Sunshine Act, 5 U.S.C. 552b. TIME AND DATE: EQUAL EMPLOYMENT OPPORTUNITY COMMISSION Sunshine Act Meetings Thursday, October 21, 2021, 1:00 p.m. Eastern Time PLACE: The meeting will be closed to the public. Note: Because of the COVID–19 pandemic, the meeting will be held as a video conference. The public may not observe/listen to the conference. STATUS: The meeting will be closed to the public. MATTERS TO BE CONSIDERED: The following item will be considered at the meeting: Pending Litigation Recommendations and a proposed Subpoena Determination. Note: The Legal Counsel has certified that, in her opinion, the Commission meeting scheduled for October 21, 2021 (and any portions of any subsequent meetings within the following 30 days to which those same matters may be carried over) concerning pending litigation recommendations and a proposed subpoena determination may properly be closed under the 3rd, 7th, and 10th exemptions to the Government in the Sunshine Act, 5 U.S.C. 552b(c)(3), (7), and (10), and Commission regulations at 29 CFR 1612.4(c), (g), and (j). In accordance with the Sunshine Act, because this meeting is closed, the public will not be able to observe/listen TIME AND DATE: PO 00000 Frm 00019 Fmt 4703 Sfmt 4703 Laura E. Sinram, Acting Secretary and Clerk of the Commission. [FR Doc. 2021–22618 Filed 10–13–21; 11:15 am] BILLING CODE 6715–01–P FEDERAL TRADE COMMISSION Agency Information Collection Activities; Proposed Collection; Comment Request; Extension Federal Trade Commission. Notice. AGENCY: ACTION: In accordance with the Paperwork Reduction Act of 1995 (PRA), the Federal Trade Commission (FTC or Commission) is seeking public comment on its proposal to extend for an additional three years the Office of Management and Budget (OMB) clearance for information collection SUMMARY: E:\FR\FM\15OCN1.SGM 15OCN1 57426 Federal Register / Vol. 86, No. 197 / Friday, October 15, 2021 / Notices requirements contained in the Red Flags, Card Issuers, and Address Discrepancy Rules (Rules). That clearance expires on December 31, 2021. DATES: Comments must be received on or before December 14, 2021. ADDRESSES: Interested parties may file a comment online or on paper by following the instructions in the Request for Comments part of the SUPPLEMENTARY INFORMATION section below. Write ‘‘Red Flags, Card Issuers, and Address Discrepancy Rules; PRA Comment: FTC File No. P072108’’ on your comment, and file your comment online at https://www.regulations.gov by following the instructions on the webbased form. If you prefer to file your comment on paper, mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC–5610 (Annex J), Washington, DC 20580, or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Constitution Center, 400 7th Street SW, 5th Floor, Suite 5610 (Annex J), Washington, DC 20024. FOR FURTHER INFORMATION CONTACT: Whitney Moore, Attorney, Division of Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission, Mail Code CC–8232, 600 Pennsylvania Ave. NW, Washington, DC 20580, (202) 326–2645. SUPPLEMENTARY INFORMATION: Title: Red Flags Rule, 16 CFR 681.1; Card Issuers Rule, 16 CFR 681.2; Address Discrepancy Rule, 16 CFR part 641. OMB Control Number: 3084–0137. Type of Review: Extension of currently approved collection. Estimated Annual Burden: (397,298 hours; $20,103,752 in labor costs). A. Section 114—Red Flags and Card Issuers Rules: (1) Red Flags: (a) Estimated Number of Respondents: 164,591 (i) High-Risk Entities: 99,830 1 (ii) Low-Risk Entities: 64,761 2 (b) Estimated Hours Burden: (i) High-Risk Entities: 342,900 hours 1 High-risk entities include, for example, financial institutions within the FTC’s jurisdiction and utilities, motor vehicle dealerships, telecommunications firms, colleges and universities, and hospitals. 2 Low-risk entities include, for example, public warehouse and storage firms, nursing and residential care facilities, automotive equipment rental and leasing firms, office supplies and stationery stores, fuel dealers, and financial transaction processing firms. VerDate Sep<11>2014 16:50 Oct 14, 2021 Jkt 256001 (ii) Low-Risk Entities: 16,523 hours (2) Card Issuers Rule: (a) Estimated Number of Respondents: 18,894 3 (b) Estimated Hours Burden: 20,508 hours (3) Combined Labor Cost Burden: $19,756,412 B. Section 315—Address Discrepancy Rule: (1) Estimated Number of Respondents: 44,000 (2) Estimated Hours Burden: 17,367 hours (3) Estimated Labor Cost Burden: $347,340 C. Capital/Non-Labor Costs for Sections 114 and 315 FTC staff believes that the Rules impose negligible capital or other nonlabor costs, as the affected entities are likely to have the necessary supplies and/or equipment already (e.g., offices and computers) for the information collections described herein. As required by section 3506(c)(2)(A) of the PRA, 44 U.S.C. 3506(c)(2)(A), the FTC is providing this opportunity for public comment before requesting that OMB extend the existing clearance for the information collection requirements contained in the Commission’s Rules. Overview of the Rules A. FACT Act Section 114 The FTC Red Flags and Card Issuers Rules implement requirements under Section 114 of the FACT Act (officially the Fair and Accurate Credit Transactions Act of 2003).4 The Red Flags Rule requires financial institutions and covered creditors to develop and implement a written Program to detect, prevent, and mitigate identity theft in connection with existing accounts or the opening of new accounts. Under the Rule, financial institutions and certain creditors must conduct a periodic risk assessment to determine if they maintain ‘‘covered accounts.’’ The Rule defines the term ‘‘covered account’’ as either: (1) A consumer account that is designed to permit multiple payments or transactions, or (2) any other account for which there is a reasonably foreseeable risk of identity theft. Each 3 FTC staff estimates that the Rule affects as many as 18,356 card issuers within the FTC’s jurisdiction. This includes, for example, state credit unions, general retail merchandise stores, colleges and universities, and telecoms. 4 The FACT Act added the red flags and card issuer requirements to the Fair Credit Reporting Act, 15 U.S.C. 1681m(e)(1). On December 11, 2018, the Commission initiated periodic review of the Red Flags and Card Issuers Rules. 83 FR 63604. The public comment period closed on February 11, 2019, and the staff is reviewing the comments. PO 00000 Frm 00020 Fmt 4703 Sfmt 4703 financial institution and covered creditor that has covered accounts must create a written Program that contains reasonable policies and procedures to identify relevant indicators of the possible existence of identity theft (‘‘red flags’’); detect red flags that have been incorporated into the Program; respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and update the Program periodically to ensure it reflects change in risks to customers. The Red Flags Rule also requires financial institutions and covered creditors to: (1) Obtain approval of the initial written Program by the board of directors; a committee thereof; or, if there is no board, an appropriate senior employee; (2) ensure oversight of the development, implementation, and administration of the Program; and (3) exercise appropriate and effective oversight of service provider arrangements. In addition, the Card Issuers Rule requires that card issuers generally must assess the validity of change of address notifications. Specifically, if the card issuer receives a notice of change of address for an existing account and, within a short period of time (during at least the first 30 days), receives a request for an additional or replacement card for the same account, the issuer must follow reasonable policies and procedures to assess the validity of the change of address. B. FACT Act Section 315 The Address Discrepancy Rule, which implements section 315 of the FACT Act, requires each user of consumer reports to have reasonable policies and procedures in place to employ when the user receives a notice of address discrepancy from a consumer reporting agency (CRA).5 Specifically, each user must develop reasonable policies and procedures to: (1) Enable the user to form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report; and (2) in certain circumstances, provide to the CRA from which it received the notice an address for the consumer that the user has reasonably confirmed is accurate. 5 The FACT Act added the address discrepancy requirement to the Fair Credit Reporting Act, 15 U.S.C. 1681c(h). On September 8, 2021, the Commission announced revisions to the Address Discrepancy Rule, but the revisions do not affect the burden to covered entities. E:\FR\FM\15OCN1.SGM 15OCN1 Federal Register / Vol. 86, No. 197 / Friday, October 15, 2021 / Notices Burden Statement A. Estimated Annual Hours of Burden Section 114—(1) Red Flags Rule and (2) Card Issuers Rule Red Flags Rule Affected Public: Utilities; motor vehicle dealerships; telecommunications firms; colleges and universities; hospitals; nursing homes; public warehouse and storage firms; fuel dealers; financial transaction processing firms; other persons satisfying the definition of ‘‘creditor,’’ as modified by the Red Flags Program Clarification Act of 2010 (the ‘‘Clarification Act’’); 6 and other categories of persons that qualify as financial institutions.7 Estimated Hours Burden (Red Flags): 359,423 hours. The Red Flags Rule requires financial institutions and certain creditors with covered accounts to develop and implement a written Program and report to the board of directors, a committee thereof, or senior management at least annually on compliance with the Rule. Under the Rule, a ‘‘financial institution’’ is ‘‘a State or National bank, a State or Federal saving and loan association, a mutual savings bank, a State or Federal credit union, or any other person that, directly or indirectly, holds a transaction account (as defined in section 19(b) of the Federal Reserve Act, 12 U.S.C. ch. 3) belonging to a consumer.’’ 8 Under the Rule, ‘‘creditor’’ has the same meaning as in section 702 of the Equal Credit Opportunity Act (ECOA).9 The Clarification Act, however, narrows the definition to those creditors that use consumer reports, furnish information to consumer reporting agencies, or advance funds. As a result, many small businesses, service providers, and other persons that would ordinarily satisfy the ECOA definition of ‘‘creditor’’ will nonetheless be excluded from the definition of ‘‘creditor’’ for purposes of the Red Flags Rule. 6 The Clarification Act narrowed the Fair Credit Report Act’s definition to those creditors that use consumer reports, furnish information to consumer reporting agencies, or advance funds. 15 U.S.C. 1681(e)(4). As a result, many small businesses, service providers, and other persons that would ordinarily satisfy the ECOA definition of ‘‘creditor’’ are excluded from the definition of ‘‘creditor’’ for purposes of the Red Flags Rule. 7 We have focused our analysis on the categories described in this notice, but welcome comments on whether there are other categories of creditors or financial institutions that we should be including in the burden analysis. 8 The Rule refers to the definition of ‘‘financial institution’’ that is found in the Fair Credit Reporting Act, 15 U.S.C. 1681a(t). 9 15 U.S.C. 1681a(r)(5). VerDate Sep<11>2014 16:50 Oct 14, 2021 Jkt 256001 Nonetheless, the scope of entities covered by the Red Flags Rule within the FTC’s jurisdiction is broad, making it difficult to determine precisely the number of financial institutions and creditors that are subject to the FTC’s jurisdiction. There are numerous businesses under the FTC’s jurisdiction and there is no formal way to track them; moreover, as a whole, the entities under the FTC’s jurisdiction are so varied that there are no general sources that provide a record of their existence. Nonetheless, FTC staff estimates that the Red Flag Rule’s requirement to have a written Program affects over 5,666 financial institutions 10 and 157,180 creditors.11 To estimate burden hours for the Red Flags Rule under section 114, FTC staff has divided affected entities into two categories, based on the nature of their businesses: (1) Entities that are subject to a high risk of identity theft; 12 and (2) entities that are subject to a low risk of identity theft.13 1. High-Risk Entities FTC staff estimates that on an annual basis, there are around 1,447 new highrisk entities and approximately 98,393 existing high-risk entities.14 FTC staff estimates that new high-risk entities will each require 25 hours to create and 10 The total number of financial institutions is derived from an analysis of state credit unions and insurers within the FTC’s jurisdiction using 2018 Census data (‘‘County Business Patterns,’’ U.S.) and other online industry data. 11 This figure comprises 5,666 financial institutions and 157,180 creditors (92,727 high-risk entities, excluding financial institutions + 64,453 low-risk creditors). The total number of financial institutions draws from FTC staff analysis of state credit unions and insurers within the FTC’s jurisdiction using 2018 Census Bureau data (‘‘Statistics of U.S. Businesses’’) and other online industry data. The total number of creditors draws from FTC staff analysis of 2018 Census data and industry data for businesses or organizations that market goods and services to consumers or other businesses or organizations subject to the FTC’s jurisdiction, reduced by entities not likely to: (1) Obtain credit reports, report credit transactions, or advance loans; and (2) entities not likely to have covered accounts under the Rule. Currently, no further updated Census data is available online to inform revised estimates. 12 In general, high-risk entities include, for example, financial institutions within the FTC’s jurisdiction and utilities, motor vehicle dealerships, telecommunications firms, colleges and universities, and hospitals. 13 Low-risk entities have a minimal risk of identity theft, but have covered accounts. These include, for example, public warehouse and storage firms, nursing and residential care facilities, automotive equipment rental and leasing firms, office supplies and stationery stores, fuel dealers, and financial transaction processing firms. 14 This number was derived from the average annual number of existing high-risk entities, taking into account that the new entities from year one will become existing entities in year two and the new entities from year two will become existing entities in year three. PO 00000 Frm 00021 Fmt 4703 Sfmt 4703 57427 implement a written Program. FTC staff estimates that existing high-risk entities have likely already created and implemented a written Program, but will require an annual recurring burden of one hour. Further, FTC staff estimates that existing entities have already prepared an annual report and will have an annual recurring burden of one hour to update the report for each year, but that preparation of an annual report will require four hours initially for each new high-risk entity. Finally, FTC staff believes that many of the high-risk entities, as part of their usual and customary business practices, already take steps to minimize losses due to fraud, including employee training. Accordingly, only relevant staff need to be trained to implement the Program: For example, staff already trained as part of a covered entity’s anti-fraud prevention efforts do not need to be retrained except as incrementally needed. FTC staff estimates that recurring annual training in connection with the implementation of a Program of an existing high-risk entity will require one hour each year, and for new entities will require four hours initially. Thus, the estimated hours of burden for high-risk entities is as follows: • 1,447 new high-risk entities subject to the FTC’s jurisdiction at an average annual burden of 33 hours per entity [including 25 hours to create and implement the Program, plus four hours for staff training, plus four hours for preparing annual report], for a total of 47,751 hours. • 98,383 existing high-risk entities subject to the FTC’s jurisdiction at an average annual burden of 3 hours per entity [including one hour to update the Program, plus one hour for staff training, plus one hour for preparing the annual report], for a total of 295,149 annual hours. • In total, 99,830 high-risk entities subject to the FTC’s jurisdiction for a total of 342,900 hours. 2. Low-Risk Entities FTC staff believes that the burden on low-risk entities to comply with the rules is minimal. Entities that have a low risk of identity theft, but that have covered accounts, likely will only need a streamlined Program. FTC staff estimates that any new such entities will require one hour to create such a Program. Existing entities will only have an annual recurring burden of 5 minutes. Training staff of low-risk entities to be attentive to future risks of identity theft and preparing an annual report should require no more than 10 minutes each in an initial year for new entities. Existing entities will only have E:\FR\FM\15OCN1.SGM 15OCN1 57428 Federal Register / Vol. 86, No. 197 / Friday, October 15, 2021 / Notices an annual recurring burden of 5 minutes each. Thus, the estimated hours of burden for low-risk entities is as follows: • 307 new low-risk entities 15 that have covered accounts subject to the FTC’s jurisdiction at an average annual burden of approximately 80 minutes per entity [including 60 minutes to create and implement a streamlined Program, plus ten minutes for staff training and ten minutes for preparing the annual report], for a total of 409 hours. • 64,454 existing low-risk entities 16 that have covered accounts subject to the FTC’s jurisdiction at an average annual burden of approximately 15 minutes per entity [including five minutes for updating of streamlined Program, plus five minutes for staff training, and five minutes for preparing annual report], for a total of 16,114 hours. • In total, 64,761 low-risk entities subject to the FTC’s jurisdiction for a total of 16,523 hours. Card Issuers Rule Affected Public: State-chartered credit unions; general merchandise stores; colleges and universities; telecommunications firms; and other persons satisfying the definition of ‘‘creditor,’’ as modified by the Clarification Act. Estimated Hours Burden (Card Issuers): 20,508 hours. The Card Issuers Rule requires credit and debit card issuers to establish policies and procedures to assess the validity of a change of address request, including notifying the cardholder or using another means of assessing the validity of the change of address. FTC staff believes that there may be as many as 18,894 credit or debit card issuers under the FTC’s jurisdiction, including state-chartered credit unions, retailers, and certain universities, businesses, and telecommunications companies. FTC staff estimates that on an annual basis, approximately 538 of these card issuers may be new entrants that will need to develop and implement policies and procedures to assess the validity of a change of address request. FTC staff 15 Estimates of new and existing low-risk entities are derived from an analysis of a database of U.S. businesses based on NAICS codes for businesses that market goods or services to consumers or other businesses within the FTC’s jurisdiction, reduced further to: (1) Those that satisfy the Clarification Act’s definition of ‘‘creditor’’ and (2) those that are likely to have covered accounts. 16 This number was derived from the average annual number of existing low-risk entities, taking into account that the new entities from year one will become existing entities in year two and the new entities from year two will become existing entities in year three. VerDate Sep<11>2014 16:50 Oct 14, 2021 Jkt 256001 estimates that process will take approximately four hours for a total burden of 2,152 hours. FTC staff estimates that the remaining 18,356 card issuers likely already have automated the process of notifying the cardholder or are using other means to assess the validity of the change of address, such that implementation will pose no further burden. Nevertheless, in order to be conservative, FTC staff estimates that it will take the 18,356 card issuers one hour to review and maintain policies and procedures to assess the validity of a change of address request for a total burden of 18,356 hours. Collectively, the total burden for the 18,894 card issuers is 20,508 hours. Section 315—Address Discrepancy Rule Affected Public: Users of consumer reports that are motor vehicle dealers described in section 1029(a) of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the DoddFrank Act), 12 U.S.C. 5519, and that are predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of them, or both (below, referenced as ‘‘users’’). Estimated Hours Burden: As discussed above, the Address Discrepancy Rule provides guidance on reasonable policies and procedures that a user of consumer reports must employ when a user receives a notice of address discrepancy from a consumer reporting agency. The FTC Address Discrepancy Rule covers only users of consumer reports that are motor vehicle dealers described in section 1029(a) of the Dodd-Frank Act and that are predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of them, or both. Assuming that every covered motor vehicle dealer is a user of consumer reports, FTC staff estimates that the Rule affects approximately 44,000 entities. FTC staff also estimates that approximately 2,000 of those motor vehicle dealers may be new entrants who have not previously implemented procedures to comply with this rule. For the 2,000 new entrants, FTC staff estimates that it would take an infrequent user of consumer reports no more than 16 minutes to develop and follow the policies and procedures that it will employ when it receives a notice of address discrepancy, whereas a frequent user may take one hour. Taking into account these extremes, FTC staff estimates that, during the first year of the clearance, for the 2,000 new entrants, it will take users of consumer reports an average of 38 minutes [the midpoint between 16 minutes and 60 minutes] to develop and comply with PO 00000 Frm 00022 Fmt 4703 Sfmt 4703 the policies and procedures that they will employ when they receive a notice of address discrepancy. For the 42,000 existing motor vehicle dealers, FTC staff expects that the policies and procedures that they will employ when they receive a notice of address discrepancy will have already been developed. Accordingly, during the three years of the clearance, it may take an infrequent user of consumer reports no more than one minute to comply with the policies and procedures that it will employ when it receives a notice of address discrepancy, whereas a frequent user of consumer reports may take 45 minutes. FTC staff estimates that the average annual burden for the 42,000 existing motor vehicle dealers will be 23 minutes [the midpoint between one minute and 45 minutes]. Thus, for the 2,000 new entrants, the average annual burden for each of them to perform these collective tasks will be 38 minutes; cumulatively, 1,267 hours. For the 42,000 existing motor vehicle dealers, the average annual burden for each of them to perform these collective tasks will be 23 minutes; cumulatively, 16,100 hours. Collectively, the total burden for the 44,000 motor vehicle dealers will be 17,367 hours.17 B. Estimated Labor Cost: $20,103,752 ($19,756,412 for Section 114 and $347,340 for Section 315) Section 114—Red Flags and Card Issuers Rules FTC staff derived labor costs by applying appropriate estimated hourly cost figures to the burden hours described above. It is difficult to calculate with precision the labor costs associated with the Rules, as they entail varying compensation levels of management and/or technical staff among companies of different sizes. In calculating the cost figures, staff assumes that entities’ professional technical personnel and/or managerial personnel will create and implement the Program, prepare the annual report, train employees, and assess the validity 17 The above-noted customer verification requirements and the estimate of 38,207 hours concern 16 CFR 641.1(c). In addition, 16 CFR 641.1(d) requires users that (a) furnish a consumer’s address to a consumer reporting agency, and (b) have established a continuing relationship with the consumer, to develop and implement reasonable policies and procedures for furnishing an address for the consumer that the user has reasonably confirmed is accurate. The FTC previously estimated that the cumulative burden hours associated with 16 CFR 641.1(d) would be de minimis. Thus, the estimate above concerns solely 16 CFR 641.1(c). E:\FR\FM\15OCN1.SGM 15OCN1 Federal Register / Vol. 86, No. 197 / Friday, October 15, 2021 / Notices of a change of address request at an hourly rate of $52.18 Based on the above estimates and assumptions, the total annual labor costs for all categories of covered entities under the Red Flags and Card Issuers Rules for section 114 is $19,756,412 (379,931 hours × $52). Section 315—Address Discrepancy Rule FTC staff assumes that the policies and procedures for compliance with the Address Discrepancy Rule will be set up by administrative support personnel at an hourly rate of $20.19 Based on the above estimates and assumptions, the total annual labor cost for the two categories of burden under section 315 is $347,340 [(17,367 hours × $20)]. Request for Comments Pursuant to Section 3506(c)(2)(A) of the PRA, the FTC invites comments on: (1) Whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility; (2) the accuracy of the agency’s estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of maintaining records and providing disclosures to consumers. All comments must be received on or before December 14, 2021. You can file a comment online or on paper. For the FTC to consider your comment, we must receive it on or before December 14, 2021. Write ‘‘Red Flags, Card Issuers, and Address Discrepancy Rules; PRA Comment: FTC File No. P072108’’ on your comment. Your comment—including your name and your state—will be placed on the public record of this proceeding, including the https:// www.regulations.gov website. Due to the public health emergency in response to the COVID–19 outbreak and 18 This estimate is based on mean wages (hourly) found at https://www.bls.gov/news.release/pdf/ ocwage.pdf (‘‘Bureau of Labor Statistics, Occupational Employment and Wages—May 2020,’’ March 31, 2021, Table 1, ‘‘National employment and wage data from the Occupational Employment and Wage Statistics survey by occupation, May 2020’’) for the various managerial and technical staff support exemplified above (administrative service managers, computer & information systems managers, training & development managers, computer systems analysts, network & computer systems analysts, computer support specialists) (hereinafter ‘‘BLS Table 1’’). 19 This estimate—is based on mean wages (hourly) for office and administrative support occupations found within BLS Table 1 (see supra note 17). VerDate Sep<11>2014 16:50 Oct 14, 2021 Jkt 256001 the agency’s heightened security screening, postal mail addressed to the Commission will be subject to delay. We encourage you to submit your comments online through the https:// www.regulations.gov website. If you prefer to file your comment on paper, write ‘‘Red Flags, Card Issuers, and Address Discrepancy Rules; PRA Comment: FTC File No. P072108’’ on your comment and on the envelope, and mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC– 5610 (Annex J), Washington, DC 20580; or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Constitution Center, 400 7th Street SW, 5th Floor, Suite 5610 (Annex J), Washington, DC 20024. If possible, submit your paper comment to the Commission by courier or overnight service. Because your comment will become publicly available at https:// www.regulations.gov, you are solely responsible for making sure that your comment does not include any sensitive or confidential information. In particular, your comment should not include any sensitive personal information, such as your or anyone else’s Social Security number; date of birth; driver’s license number or other state identification number, or foreign country equivalent; passport number; financial account number; or credit or debit card number. You are also solely responsible for making sure that your comment does not include any sensitive health information, such as medical records or other individually identifiable health information. In addition, your comment should not include any ‘‘trade secret or any commercial or financial information which . . . . is privileged or confidential’’—as provided by Section 6(f) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2)— including in particular competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names. Comments containing material for which confidential treatment is requested must be filed in paper form, must be clearly labeled ‘‘Confidential,’’ and must comply with FTC Rule 4.9(c). In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public PO 00000 Frm 00023 Fmt 4703 Sfmt 4703 57429 record. See FTC Rule 4.9(c). Your comment will be kept confidential only if the General Counsel grants your request in accordance with the law and the public interest. Once your comment has been posted publicly at www.regulations.gov, we cannot redact or remove your comment unless you submit a confidentiality request that meets the requirements for such treatment under FTC Rule 4.9(c), and the General Counsel grants that request. The FTC Act and other laws that the Commission administers permit the collection of public comments to consider and use in this proceeding, as appropriate. The Commission will consider all timely and responsive public comments that it receives on or before December 14, 2021. For information on the Commission’s privacy policy, including routine uses permitted by the Privacy Act, see https://www.ftc.gov/site-information/ privacy-policy. Josephine Liu, Assistant General Counsel for Legal Counsel. [FR Doc. 2021–22478 Filed 10–14–21; 8:45 am] BILLING CODE 6750–01–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Centers for Medicare & Medicaid Services [CMS–3416–PN] Medicare and Medicaid Programs; Application From the American Association for Accreditation of Ambulatory Surgery Facilities for Continued Approval of Its Rural Health Clinic (RHC) Accreditation Program Centers for Medicare & Medicaid Services (CMS), HHS. ACTION: Proposed notice. AGENCY: This proposed notice acknowledges the receipt of an application from the American Association for Accreditation of Ambulatory Surgery Facilities (AAAASF) for continued recognition as a national accrediting organization for rural health clinics (RHCs) that wish to participate in the Medicare or Medicaid programs. The statute requires that within 60 days of receipt of an organization’s complete application, the Centers for Medicare and Medicaid Services (CMS) publish a notice that identifies the national accrediting body making the request, describes the nature of the request, and provides at least a 30-day public comment period. SUMMARY: E:\FR\FM\15OCN1.SGM 15OCN1

Agencies

[Federal Register Volume 86, Number 197 (Friday, October 15, 2021)]
[Notices]
[Pages 57425-57429]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-22478]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Agency Information Collection Activities; Proposed Collection; 
Comment Request; Extension

AGENCY: Federal Trade Commission.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Paperwork Reduction Act of 1995 (PRA), 
the Federal Trade Commission (FTC or Commission) is seeking public 
comment on its proposal to extend for an additional three years the 
Office of Management and Budget (OMB) clearance for information 
collection

[[Page 57426]]

requirements contained in the Red Flags, Card Issuers, and Address 
Discrepancy Rules (Rules). That clearance expires on December 31, 2021.

DATES: Comments must be received on or before December 14, 2021.

ADDRESSES: Interested parties may file a comment online or on paper by 
following the instructions in the Request for Comments part of the 
SUPPLEMENTARY INFORMATION section below. Write ``Red Flags, Card 
Issuers, and Address Discrepancy Rules; PRA Comment: FTC File No. 
P072108'' on your comment, and file your comment online at https://www.regulations.gov by following the instructions on the web-based 
form. If you prefer to file your comment on paper, mail your comment to 
the following address: Federal Trade Commission, Office of the 
Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex J), 
Washington, DC 20580, or deliver your comment to the following address: 
Federal Trade Commission, Office of the Secretary, Constitution Center, 
400 7th Street SW, 5th Floor, Suite 5610 (Annex J), Washington, DC 
20024.

FOR FURTHER INFORMATION CONTACT: Whitney Moore, Attorney, Division of 
Division of Privacy and Identity Protection, Bureau of Consumer 
Protection, Federal Trade Commission, Mail Code CC-8232, 600 
Pennsylvania Ave. NW, Washington, DC 20580, (202) 326-2645.

SUPPLEMENTARY INFORMATION:
    Title: Red Flags Rule, 16 CFR 681.1; Card Issuers Rule, 16 CFR 
681.2; Address Discrepancy Rule, 16 CFR part 641.
    OMB Control Number: 3084-0137.
    Type of Review: Extension of currently approved collection.
    Estimated Annual Burden: (397,298 hours; $20,103,752 in labor 
costs).

A. Section 114--Red Flags and Card Issuers Rules:
    (1) Red Flags:
    (a) Estimated Number of Respondents: 164,591
    (i) High-Risk Entities: 99,830 \1\
---------------------------------------------------------------------------

    \1\ High-risk entities include, for example, financial 
institutions within the FTC's jurisdiction and utilities, motor 
vehicle dealerships, telecommunications firms, colleges and 
universities, and hospitals.
---------------------------------------------------------------------------

    (ii) Low-Risk Entities: 64,761 \2\
---------------------------------------------------------------------------

    \2\ Low-risk entities include, for example, public warehouse and 
storage firms, nursing and residential care facilities, automotive 
equipment rental and leasing firms, office supplies and stationery 
stores, fuel dealers, and financial transaction processing firms.
---------------------------------------------------------------------------

    (b) Estimated Hours Burden:
    (i) High-Risk Entities: 342,900 hours
    (ii) Low-Risk Entities: 16,523 hours
    (2) Card Issuers Rule:
    (a) Estimated Number of Respondents: 18,894 \3\
---------------------------------------------------------------------------

    \3\ FTC staff estimates that the Rule affects as many as 18,356 
card issuers within the FTC's jurisdiction. This includes, for 
example, state credit unions, general retail merchandise stores, 
colleges and universities, and telecoms.
---------------------------------------------------------------------------

    (b) Estimated Hours Burden: 20,508 hours
    (3) Combined Labor Cost Burden: $19,756,412
B. Section 315--Address Discrepancy Rule:
    (1) Estimated Number of Respondents: 44,000
    (2) Estimated Hours Burden: 17,367 hours
    (3) Estimated Labor Cost Burden: $347,340
C. Capital/Non-Labor Costs for Sections 114 and 315

    FTC staff believes that the Rules impose negligible capital or 
other non-labor costs, as the affected entities are likely to have the 
necessary supplies and/or equipment already (e.g., offices and 
computers) for the information collections described herein.
    As required by section 3506(c)(2)(A) of the PRA, 44 U.S.C. 
3506(c)(2)(A), the FTC is providing this opportunity for public comment 
before requesting that OMB extend the existing clearance for the 
information collection requirements contained in the Commission's 
Rules.

Overview of the Rules

A. FACT Act Section 114

    The FTC Red Flags and Card Issuers Rules implement requirements 
under Section 114 of the FACT Act (officially the Fair and Accurate 
Credit Transactions Act of 2003).\4\ The Red Flags Rule requires 
financial institutions and covered creditors to develop and implement a 
written Program to detect, prevent, and mitigate identity theft in 
connection with existing accounts or the opening of new accounts. Under 
the Rule, financial institutions and certain creditors must conduct a 
periodic risk assessment to determine if they maintain ``covered 
accounts.'' The Rule defines the term ``covered account'' as either: 
(1) A consumer account that is designed to permit multiple payments or 
transactions, or (2) any other account for which there is a reasonably 
foreseeable risk of identity theft. Each financial institution and 
covered creditor that has covered accounts must create a written 
Program that contains reasonable policies and procedures to identify 
relevant indicators of the possible existence of identity theft (``red 
flags''); detect red flags that have been incorporated into the 
Program; respond appropriately to any red flags that are detected to 
prevent and mitigate identity theft; and update the Program 
periodically to ensure it reflects change in risks to customers.
---------------------------------------------------------------------------

    \4\ The FACT Act added the red flags and card issuer 
requirements to the Fair Credit Reporting Act, 15 U.S.C. 
1681m(e)(1). On December 11, 2018, the Commission initiated periodic 
review of the Red Flags and Card Issuers Rules. 83 FR 63604. The 
public comment period closed on February 11, 2019, and the staff is 
reviewing the comments.
---------------------------------------------------------------------------

    The Red Flags Rule also requires financial institutions and covered 
creditors to: (1) Obtain approval of the initial written Program by the 
board of directors; a committee thereof; or, if there is no board, an 
appropriate senior employee; (2) ensure oversight of the development, 
implementation, and administration of the Program; and (3) exercise 
appropriate and effective oversight of service provider arrangements.
    In addition, the Card Issuers Rule requires that card issuers 
generally must assess the validity of change of address notifications. 
Specifically, if the card issuer receives a notice of change of address 
for an existing account and, within a short period of time (during at 
least the first 30 days), receives a request for an additional or 
replacement card for the same account, the issuer must follow 
reasonable policies and procedures to assess the validity of the change 
of address.

B. FACT Act Section 315

    The Address Discrepancy Rule, which implements section 315 of the 
FACT Act, requires each user of consumer reports to have reasonable 
policies and procedures in place to employ when the user receives a 
notice of address discrepancy from a consumer reporting agency 
(CRA).\5\ Specifically, each user must develop reasonable policies and 
procedures to: (1) Enable the user to form a reasonable belief that a 
consumer report relates to the consumer about whom it has requested the 
report; and (2) in certain circumstances, provide to the CRA from which 
it received the notice an address for the consumer that the user has 
reasonably confirmed is accurate.
---------------------------------------------------------------------------

    \5\ The FACT Act added the address discrepancy requirement to 
the Fair Credit Reporting Act, 15 U.S.C. 1681c(h). On September 8, 
2021, the Commission announced revisions to the Address Discrepancy 
Rule, but the revisions do not affect the burden to covered 
entities.

---------------------------------------------------------------------------

[[Page 57427]]

Burden Statement

A. Estimated Annual Hours of Burden

Section 114--(1) Red Flags Rule and (2) Card Issuers Rule
Red Flags Rule
    Affected Public: Utilities; motor vehicle dealerships; 
telecommunications firms; colleges and universities; hospitals; nursing 
homes; public warehouse and storage firms; fuel dealers; financial 
transaction processing firms; other persons satisfying the definition 
of ``creditor,'' as modified by the Red Flags Program Clarification Act 
of 2010 (the ``Clarification Act''); \6\ and other categories of 
persons that qualify as financial institutions.\7\
---------------------------------------------------------------------------

    \6\ The Clarification Act narrowed the Fair Credit Report Act's 
definition to those creditors that use consumer reports, furnish 
information to consumer reporting agencies, or advance funds. 15 
U.S.C. 1681(e)(4). As a result, many small businesses, service 
providers, and other persons that would ordinarily satisfy the ECOA 
definition of ``creditor'' are excluded from the definition of 
``creditor'' for purposes of the Red Flags Rule.
    \7\ We have focused our analysis on the categories described in 
this notice, but welcome comments on whether there are other 
categories of creditors or financial institutions that we should be 
including in the burden analysis.
---------------------------------------------------------------------------

    Estimated Hours Burden (Red Flags): 359,423 hours.
    The Red Flags Rule requires financial institutions and certain 
creditors with covered accounts to develop and implement a written 
Program and report to the board of directors, a committee thereof, or 
senior management at least annually on compliance with the Rule. Under 
the Rule, a ``financial institution'' is ``a State or National bank, a 
State or Federal saving and loan association, a mutual savings bank, a 
State or Federal credit union, or any other person that, directly or 
indirectly, holds a transaction account (as defined in section 19(b) of 
the Federal Reserve Act, 12 U.S.C. ch. 3) belonging to a consumer.'' 
\8\
---------------------------------------------------------------------------

    \8\ The Rule refers to the definition of ``financial 
institution'' that is found in the Fair Credit Reporting Act, 15 
U.S.C. 1681a(t).
---------------------------------------------------------------------------

    Under the Rule, ``creditor'' has the same meaning as in section 702 
of the Equal Credit Opportunity Act (ECOA).\9\ The Clarification Act, 
however, narrows the definition to those creditors that use consumer 
reports, furnish information to consumer reporting agencies, or advance 
funds. As a result, many small businesses, service providers, and other 
persons that would ordinarily satisfy the ECOA definition of 
``creditor'' will nonetheless be excluded from the definition of 
``creditor'' for purposes of the Red Flags Rule.
---------------------------------------------------------------------------

    \9\ 15 U.S.C. 1681a(r)(5).
---------------------------------------------------------------------------

    Nonetheless, the scope of entities covered by the Red Flags Rule 
within the FTC's jurisdiction is broad, making it difficult to 
determine precisely the number of financial institutions and creditors 
that are subject to the FTC's jurisdiction. There are numerous 
businesses under the FTC's jurisdiction and there is no formal way to 
track them; moreover, as a whole, the entities under the FTC's 
jurisdiction are so varied that there are no general sources that 
provide a record of their existence. Nonetheless, FTC staff estimates 
that the Red Flag Rule's requirement to have a written Program affects 
over 5,666 financial institutions \10\ and 157,180 creditors.\11\
---------------------------------------------------------------------------

    \10\ The total number of financial institutions is derived from 
an analysis of state credit unions and insurers within the FTC's 
jurisdiction using 2018 Census data (``County Business Patterns,'' 
U.S.) and other online industry data.
    \11\ This figure comprises 5,666 financial institutions and 
157,180 creditors (92,727 high-risk entities, excluding financial 
institutions + 64,453 low-risk creditors). The total number of 
financial institutions draws from FTC staff analysis of state credit 
unions and insurers within the FTC's jurisdiction using 2018 Census 
Bureau data (``Statistics of U.S. Businesses'') and other online 
industry data. The total number of creditors draws from FTC staff 
analysis of 2018 Census data and industry data for businesses or 
organizations that market goods and services to consumers or other 
businesses or organizations subject to the FTC's jurisdiction, 
reduced by entities not likely to: (1) Obtain credit reports, report 
credit transactions, or advance loans; and (2) entities not likely 
to have covered accounts under the Rule. Currently, no further 
updated Census data is available online to inform revised estimates.
---------------------------------------------------------------------------

    To estimate burden hours for the Red Flags Rule under section 114, 
FTC staff has divided affected entities into two categories, based on 
the nature of their businesses: (1) Entities that are subject to a high 
risk of identity theft; \12\ and (2) entities that are subject to a low 
risk of identity theft.\13\
---------------------------------------------------------------------------

    \12\ In general, high-risk entities include, for example, 
financial institutions within the FTC's jurisdiction and utilities, 
motor vehicle dealerships, telecommunications firms, colleges and 
universities, and hospitals.
    \13\ Low-risk entities have a minimal risk of identity theft, 
but have covered accounts. These include, for example, public 
warehouse and storage firms, nursing and residential care 
facilities, automotive equipment rental and leasing firms, office 
supplies and stationery stores, fuel dealers, and financial 
transaction processing firms.
---------------------------------------------------------------------------

1. High-Risk Entities
    FTC staff estimates that on an annual basis, there are around 1,447 
new high-risk entities and approximately 98,393 existing high-risk 
entities.\14\ FTC staff estimates that new high-risk entities will each 
require 25 hours to create and implement a written Program. FTC staff 
estimates that existing high-risk entities have likely already created 
and implemented a written Program, but will require an annual recurring 
burden of one hour. Further, FTC staff estimates that existing entities 
have already prepared an annual report and will have an annual 
recurring burden of one hour to update the report for each year, but 
that preparation of an annual report will require four hours initially 
for each new high-risk entity. Finally, FTC staff believes that many of 
the high-risk entities, as part of their usual and customary business 
practices, already take steps to minimize losses due to fraud, 
including employee training. Accordingly, only relevant staff need to 
be trained to implement the Program: For example, staff already trained 
as part of a covered entity's anti-fraud prevention efforts do not need 
to be re-trained except as incrementally needed. FTC staff estimates 
that recurring annual training in connection with the implementation of 
a Program of an existing high-risk entity will require one hour each 
year, and for new entities will require four hours initially. Thus, the 
estimated hours of burden for high-risk entities is as follows:
---------------------------------------------------------------------------

    \14\ This number was derived from the average annual number of 
existing high-risk entities, taking into account that the new 
entities from year one will become existing entities in year two and 
the new entities from year two will become existing entities in year 
three.
---------------------------------------------------------------------------

     1,447 new high-risk entities subject to the FTC's 
jurisdiction at an average annual burden of 33 hours per entity 
[including 25 hours to create and implement the Program, plus four 
hours for staff training, plus four hours for preparing annual report], 
for a total of 47,751 hours.
     98,383 existing high-risk entities subject to the FTC's 
jurisdiction at an average annual burden of 3 hours per entity 
[including one hour to update the Program, plus one hour for staff 
training, plus one hour for preparing the annual report], for a total 
of 295,149 annual hours.
     In total, 99,830 high-risk entities subject to the FTC's 
jurisdiction for a total of 342,900 hours.
2. Low-Risk Entities
    FTC staff believes that the burden on low-risk entities to comply 
with the rules is minimal. Entities that have a low risk of identity 
theft, but that have covered accounts, likely will only need a 
streamlined Program. FTC staff estimates that any new such entities 
will require one hour to create such a Program. Existing entities will 
only have an annual recurring burden of 5 minutes. Training staff of 
low-risk entities to be attentive to future risks of identity theft and 
preparing an annual report should require no more than 10 minutes each 
in an initial year for new entities. Existing entities will only have

[[Page 57428]]

an annual recurring burden of 5 minutes each. Thus, the estimated hours 
of burden for low-risk entities is as follows:
     307 new low-risk entities \15\ that have covered accounts 
subject to the FTC's jurisdiction at an average annual burden of 
approximately 80 minutes per entity [including 60 minutes to create and 
implement a streamlined Program, plus ten minutes for staff training 
and ten minutes for preparing the annual report], for a total of 409 
hours.
---------------------------------------------------------------------------

    \15\ Estimates of new and existing low-risk entities are derived 
from an analysis of a database of U.S. businesses based on NAICS 
codes for businesses that market goods or services to consumers or 
other businesses within the FTC's jurisdiction, reduced further to: 
(1) Those that satisfy the Clarification Act's definition of 
``creditor'' and (2) those that are likely to have covered accounts.
---------------------------------------------------------------------------

     64,454 existing low-risk entities \16\ that have covered 
accounts subject to the FTC's jurisdiction at an average annual burden 
of approximately 15 minutes per entity [including five minutes for 
updating of streamlined Program, plus five minutes for staff training, 
and five minutes for preparing annual report], for a total of 16,114 
hours.
---------------------------------------------------------------------------

    \16\ This number was derived from the average annual number of 
existing low-risk entities, taking into account that the new 
entities from year one will become existing entities in year two and 
the new entities from year two will become existing entities in year 
three.
---------------------------------------------------------------------------

     In total, 64,761 low-risk entities subject to the FTC's 
jurisdiction for a total of 16,523 hours.
Card Issuers Rule
    Affected Public: State-chartered credit unions; general merchandise 
stores; colleges and universities; telecommunications firms; and other 
persons satisfying the definition of ``creditor,'' as modified by the 
Clarification Act.
    Estimated Hours Burden (Card Issuers): 20,508 hours.
    The Card Issuers Rule requires credit and debit card issuers to 
establish policies and procedures to assess the validity of a change of 
address request, including notifying the cardholder or using another 
means of assessing the validity of the change of address. FTC staff 
believes that there may be as many as 18,894 credit or debit card 
issuers under the FTC's jurisdiction, including state-chartered credit 
unions, retailers, and certain universities, businesses, and 
telecommunications companies. FTC staff estimates that on an annual 
basis, approximately 538 of these card issuers may be new entrants that 
will need to develop and implement policies and procedures to assess 
the validity of a change of address request. FTC staff estimates that 
process will take approximately four hours for a total burden of 2,152 
hours. FTC staff estimates that the remaining 18,356 card issuers 
likely already have automated the process of notifying the cardholder 
or are using other means to assess the validity of the change of 
address, such that implementation will pose no further burden. 
Nevertheless, in order to be conservative, FTC staff estimates that it 
will take the 18,356 card issuers one hour to review and maintain 
policies and procedures to assess the validity of a change of address 
request for a total burden of 18,356 hours. Collectively, the total 
burden for the 18,894 card issuers is 20,508 hours.
Section 315--Address Discrepancy Rule
    Affected Public: Users of consumer reports that are motor vehicle 
dealers described in section 1029(a) of the Dodd-Frank Wall Street 
Reform and Consumer Protection Act (the Dodd-Frank Act), 12 U.S.C. 
5519, and that are predominantly engaged in the sale and servicing of 
motor vehicles, the leasing and servicing of them, or both (below, 
referenced as ``users'').
    Estimated Hours Burden:
    As discussed above, the Address Discrepancy Rule provides guidance 
on reasonable policies and procedures that a user of consumer reports 
must employ when a user receives a notice of address discrepancy from a 
consumer reporting agency. The FTC Address Discrepancy Rule covers only 
users of consumer reports that are motor vehicle dealers described in 
section 1029(a) of the Dodd-Frank Act and that are predominantly 
engaged in the sale and servicing of motor vehicles, the leasing and 
servicing of them, or both. Assuming that every covered motor vehicle 
dealer is a user of consumer reports, FTC staff estimates that the Rule 
affects approximately 44,000 entities. FTC staff also estimates that 
approximately 2,000 of those motor vehicle dealers may be new entrants 
who have not previously implemented procedures to comply with this 
rule.
    For the 2,000 new entrants, FTC staff estimates that it would take 
an infrequent user of consumer reports no more than 16 minutes to 
develop and follow the policies and procedures that it will employ when 
it receives a notice of address discrepancy, whereas a frequent user 
may take one hour. Taking into account these extremes, FTC staff 
estimates that, during the first year of the clearance, for the 2,000 
new entrants, it will take users of consumer reports an average of 38 
minutes [the midpoint between 16 minutes and 60 minutes] to develop and 
comply with the policies and procedures that they will employ when they 
receive a notice of address discrepancy.
    For the 42,000 existing motor vehicle dealers, FTC staff expects 
that the policies and procedures that they will employ when they 
receive a notice of address discrepancy will have already been 
developed. Accordingly, during the three years of the clearance, it may 
take an infrequent user of consumer reports no more than one minute to 
comply with the policies and procedures that it will employ when it 
receives a notice of address discrepancy, whereas a frequent user of 
consumer reports may take 45 minutes. FTC staff estimates that the 
average annual burden for the 42,000 existing motor vehicle dealers 
will be 23 minutes [the midpoint between one minute and 45 minutes].
    Thus, for the 2,000 new entrants, the average annual burden for 
each of them to perform these collective tasks will be 38 minutes; 
cumulatively, 1,267 hours. For the 42,000 existing motor vehicle 
dealers, the average annual burden for each of them to perform these 
collective tasks will be 23 minutes; cumulatively, 16,100 hours. 
Collectively, the total burden for the 44,000 motor vehicle dealers 
will be 17,367 hours.\17\
---------------------------------------------------------------------------

    \17\ The above-noted customer verification requirements and the 
estimate of 38,207 hours concern 16 CFR 641.1(c). In addition, 16 
CFR 641.1(d) requires users that (a) furnish a consumer's address to 
a consumer reporting agency, and (b) have established a continuing 
relationship with the consumer, to develop and implement reasonable 
policies and procedures for furnishing an address for the consumer 
that the user has reasonably confirmed is accurate. The FTC 
previously estimated that the cumulative burden hours associated 
with 16 CFR 641.1(d) would be de minimis. Thus, the estimate above 
concerns solely 16 CFR 641.1(c).
---------------------------------------------------------------------------

B. Estimated Labor Cost: $20,103,752 ($19,756,412 for Section 114 and 
$347,340 for Section 315)

Section 114--Red Flags and Card Issuers Rules
    FTC staff derived labor costs by applying appropriate estimated 
hourly cost figures to the burden hours described above. It is 
difficult to calculate with precision the labor costs associated with 
the Rules, as they entail varying compensation levels of management 
and/or technical staff among companies of different sizes. In 
calculating the cost figures, staff assumes that entities' professional 
technical personnel and/or managerial personnel will create and 
implement the Program, prepare the annual report, train employees, and 
assess the validity

[[Page 57429]]

of a change of address request at an hourly rate of $52.\18\
---------------------------------------------------------------------------

    \18\ This estimate is based on mean wages (hourly) found at 
https://www.bls.gov/news.release/pdf/ocwage.pdf (``Bureau of Labor 
Statistics, Occupational Employment and Wages--May 2020,'' March 31, 
2021, Table 1, ``National employment and wage data from the 
Occupational Employment and Wage Statistics survey by occupation, 
May 2020'') for the various managerial and technical staff support 
exemplified above (administrative service managers, computer & 
information systems managers, training & development managers, 
computer systems analysts, network & computer systems analysts, 
computer support specialists) (hereinafter ``BLS Table 1'').
---------------------------------------------------------------------------

    Based on the above estimates and assumptions, the total annual 
labor costs for all categories of covered entities under the Red Flags 
and Card Issuers Rules for section 114 is $19,756,412 (379,931 hours x 
$52).
Section 315--Address Discrepancy Rule
    FTC staff assumes that the policies and procedures for compliance 
with the Address Discrepancy Rule will be set up by administrative 
support personnel at an hourly rate of $20.\19\ Based on the above 
estimates and assumptions, the total annual labor cost for the two 
categories of burden under section 315 is $347,340 [(17,367 hours x 
$20)].
---------------------------------------------------------------------------

    \19\ This estimate--is based on mean wages (hourly) for office 
and administrative support occupations found within BLS Table 1 (see 
supra note 17).
---------------------------------------------------------------------------

Request for Comments

    Pursuant to Section 3506(c)(2)(A) of the PRA, the FTC invites 
comments on: (1) Whether the proposed collection of information is 
necessary for the proper performance of the functions of the agency, 
including whether the information will have practical utility; (2) the 
accuracy of the agency's estimate of the burden of the proposed 
collection of information, including the validity of the methodology 
and assumptions used; (3) ways to enhance the quality, utility, and 
clarity of the information to be collected; and (4) ways to minimize 
the burden of maintaining records and providing disclosures to 
consumers. All comments must be received on or before December 14, 
2021.
    You can file a comment online or on paper. For the FTC to consider 
your comment, we must receive it on or before December 14, 2021. Write 
``Red Flags, Card Issuers, and Address Discrepancy Rules; PRA Comment: 
FTC File No. P072108'' on your comment. Your comment--including your 
name and your state--will be placed on the public record of this 
proceeding, including the https://www.regulations.gov website.
    Due to the public health emergency in response to the COVID-19 
outbreak and the agency's heightened security screening, postal mail 
addressed to the Commission will be subject to delay. We encourage you 
to submit your comments online through the https://www.regulations.gov 
website.
    If you prefer to file your comment on paper, write ``Red Flags, 
Card Issuers, and Address Discrepancy Rules; PRA Comment: FTC File No. 
P072108'' on your comment and on the envelope, and mail your comment to 
the following address: Federal Trade Commission, Office of the 
Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex J), 
Washington, DC 20580; or deliver your comment to the following address: 
Federal Trade Commission, Office of the Secretary, Constitution Center, 
400 7th Street SW, 5th Floor, Suite 5610 (Annex J), Washington, DC 
20024. If possible, submit your paper comment to the Commission by 
courier or overnight service.
    Because your comment will become publicly available at https://www.regulations.gov, you are solely responsible for making sure that 
your comment does not include any sensitive or confidential 
information. In particular, your comment should not include any 
sensitive personal information, such as your or anyone else's Social 
Security number; date of birth; driver's license number or other state 
identification number, or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. You are also 
solely responsible for making sure that your comment does not include 
any sensitive health information, such as medical records or other 
individually identifiable health information. In addition, your comment 
should not include any ``trade secret or any commercial or financial 
information which . . . . is privileged or confidential''--as provided 
by Section 6(f) of the Federal Trade Commission Act (FTC Act), 15 
U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2)--including in 
particular competitively sensitive information such as costs, sales 
statistics, inventories, formulas, patterns, devices, manufacturing 
processes, or customer names.
    Comments containing material for which confidential treatment is 
requested must be filed in paper form, must be clearly labeled 
``Confidential,'' and must comply with FTC Rule 4.9(c). In particular, 
the written request for confidential treatment that accompanies the 
comment must include the factual and legal basis for the request, and 
must identify the specific portions of the comment to be withheld from 
the public record. See FTC Rule 4.9(c). Your comment will be kept 
confidential only if the General Counsel grants your request in 
accordance with the law and the public interest. Once your comment has 
been posted publicly at www.regulations.gov, we cannot redact or remove 
your comment unless you submit a confidentiality request that meets the 
requirements for such treatment under FTC Rule 4.9(c), and the General 
Counsel grants that request.
    The FTC Act and other laws that the Commission administers permit 
the collection of public comments to consider and use in this 
proceeding, as appropriate. The Commission will consider all timely and 
responsive public comments that it receives on or before December 14, 
2021. For information on the Commission's privacy policy, including 
routine uses permitted by the Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

Josephine Liu,
Assistant General Counsel for Legal Counsel.
[FR Doc. 2021-22478 Filed 10-14-21; 8:45 am]
BILLING CODE 6750-01-P