Agency Information Collection Activities; Proposed Collection; Comment Request; Extension, 67938-67942 [2024-18772]

Agencies

• FEDERAL TRADE COMMISSION

[Federal Register Volume 89, Number 163 (Thursday, August 22, 2024)]
[Notices]
[Pages 67938-67942]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-18772]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Agency Information Collection Activities; Proposed Collection; 
Comment Request; Extension

AGENCY: Federal Trade Commission.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The Federal Trade Commission (``FTC'' or ``Commission'') is 
seeking public comments on its proposal to extend for an additional 
three years the current Paperwork Reduction Act (``PRA'') clearance for 
information collection requirements contained in the Red Flags, Card 
Issuers, and Address Discrepancy Rules (``Rules''). That clearance 
expires on January 31, 2025.

DATES: Comments must be filed by October 21, 2024.

ADDRESSES: Interested parties may file a comment online or on paper, by 
following the instructions in the Request for Comment part of the 
SUPPLEMENTARY INFORMATION section below. Write ``Red Flags, Card 
Issuers, and Address Discrepancy Rules; PRA Comment: FTC File No. 
P072108'' on your comment, and file your comment online at https://www.regulations.gov by following the instructions on the web-based 
form. If you prefer to file your comment on paper, mail your comment to 
the following address: Federal Trade Commission, Office of the 
Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex J), 
Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT: Whitney Moore, Attorney, Division of 
Division of Privacy and Identity Protection, Bureau of Consumer 
Protection, Federal Trade Commission, Mail Code CC-8232, 600 
Pennsylvania Avenue NW, Washington, DC 20580, (202) 326-2645.

SUPPLEMENTARY INFORMATION: 
    Title of Collection: Red Flags Rule, 16 CFR 681.1; Card Issuers 
Rule, 16 CFR 681.2; Address Discrepancy Rule, 16 CFR part 641.
    OMB Control Number: 3084-0137.
    Type of Review: Extension of currently approved collection.
    Estimated Number of Respondents: 238,942 (165,494 for Red Flags 
Rule + 18,500 for Card Issuers Rule + 54,948 for Address Discrepancy 
Rule).

[[Page 67939]]

    Estimated Annual Burden Hours: 398,479 hours (358,124 hours for Red 
Flags Rule + 18,608 hours for Card Issuers Rule + 21,747 hours for 
Address Discrepancy Rule).
    Estimated Annual Labor Costs: $22,350,652 ($21,850,471 for Red 
Flags and Card Issuers Rule + $500,181 for Address Discrepancy Rule).
    Estimated Annual Non-Labor Costs: $0.
    As required by section 3506(c)(2)(A) of the PRA, 44 U.S.C. 
3506(c)(2)(A), the FTC is providing this opportunity for public comment 
before requesting that OMB extend the existing clearance for the 
information collection requirements contained in the Commission's 
Rules.

A. Overview of the Rules

I. FACT Act Section 114

    The FTC Red Flags and Card Issuers Rules implement requirements 
under Section 114 of the Fair and Accurate Credit Transactions Act of 
2003, which is also commonly referred to as the FACT Act.\1\
---------------------------------------------------------------------------

    \1\ Fair and Accurate Credit Transactions Act of 2003, Public 
Law 108-159, 117 Stat. 1952 (2003) (codified at 15 U.S.C. 1681-
1681x). The FACT Act added the red flags and card issuer 
requirements to the Fair Credit Reporting Act, 15 U.S.C. 
1681m(e)(1). On December 11, 2018, the Commission initiated periodic 
review of the Red Flags and Card Issuers Rules. 83 FR 63604 (Dec. 
11, 2018). The public comment period closed on February 11, 2019.
---------------------------------------------------------------------------

    The Red Flags Rule requires financial institutions and covered 
creditors to develop and implement a written Program to detect, 
prevent, and mitigate identity theft in connection with existing 
accounts or the opening of new accounts (the ``Program''). Under the 
Rule, financial institutions and certain creditors must conduct a 
periodic risk assessment to determine if they maintain ``covered 
accounts.'' The Red Flags Rule defines the term ``covered account'' as 
either: (1) a consumer account that is designed to permit multiple 
payments or transactions, or (2) any other account for which there is a 
reasonably foreseeable risk of identity theft.
    Under the Red Flags Rule, each financial institution and covered 
creditor that has covered accounts must create a written Program that 
contains reasonable policies and procedures to: (1) identify relevant 
indicators of the possible existence of identity theft (``red flags''); 
(2) detect red flags that have been incorporated into the Program; (3) 
respond appropriately to any red flags that are detected to prevent and 
mitigate identity theft; and (4) update the Program periodically to 
ensure it reflects change in risks to customers. Additionally, the Red 
Flags Rule requires financial institutions and covered creditors to: 
(1) obtain approval of the initial written Program by the board of 
directors; a committee thereof; or, if there is no board, an 
appropriate senior employee; (2) ensure oversight of the development, 
implementation, and administration of the Program; and (3) exercise 
appropriate and effective oversight of service provider arrangements.
    The Card Issuers Rule generally requires debit and credit card 
issuers, which include state-chartered credit unions, retailers, and 
certain universities, businesses, and telecommunications companies, to 
assess the validity of change of address notifications. Specifically, 
if the card issuer receives a notice of change of address for an 
existing account and, within a short period of time (during at least 
the first thirty days), receives a request for an additional or 
replacement card for the same account, the issuer must follow 
reasonable policies and procedures to assess the validity of the change 
of address.

II. FACT Act Section 315

    The Address Discrepancy Rule, which implements section 315 of the 
FACT Act, requires each user of consumer reports to have reasonable 
policies and procedures in place to employ when the user receives a 
notice of address discrepancy from a consumer reporting agency 
(``CRA'').\2\ Specifically, each user must develop reasonable policies 
and procedures to: (1) enable the user to form a reasonable belief that 
a consumer report relates to the consumer about whom it has requested 
the report; and (2) in certain circumstances, provide to the CRA from 
which it received the notice an address for the consumer that the user 
has reasonably confirmed is accurate.
---------------------------------------------------------------------------

    \2\ The FACT Act added the address discrepancy requirement to 
the Fair Credit Reporting Act, 15 U.S.C. 1681c(h). On September 17, 
2021, the Commission announced revisions to the Address Discrepancy 
Rule, but the revisions did not affect the burden to covered 
entities. See 86 FR 51817 (Sept. 17, 2021).
---------------------------------------------------------------------------

B. Burden Statement

I. Estimated Annual Burden Hours: 398,479 Hours

    1. Red Flags Rule: 358,124 Hours.
    Affected Public: Utilities; motor vehicle dealerships; 
telecommunications firms; colleges and universities; hospitals; nursing 
homes; public warehouse and storage firms; fuel dealers; financial 
transaction processing firms; certain creditors; \3\ and other 
categories of persons that qualify as financial institutions.\4\
---------------------------------------------------------------------------

    \3\ 15 U.S.C. 1681m(e)(4).
    \4\ This analysis focuses on the categories described in this 
notice, but the Commission welcomes comments on whether there are 
other categories of creditors or financial institutions that should 
be included in the burden analysis.
---------------------------------------------------------------------------

    The Red Flags Rule requires financial institutions and certain 
creditors with covered accounts to develop and implement a written 
Program and report to the board of directors, a committee thereof, or 
senior management at least annually on compliance with the Rule. Under 
the Rule, a ``financial institution'' is ``a State or National bank, a 
State or Federal saving and loan association, a mutual savings bank, a 
State or Federal credit union, or any other person that, directly or 
indirectly, holds a transaction account (as defined in section 19(b) of 
the Federal Reserve Act, 12 U.S.C. ch. 3) belonging to a consumer.'' 
\5\
---------------------------------------------------------------------------

    \5\ The Red Flags Rule refers to the definition of ``financial 
institution'' in the Fair Credit Reporting Act, 15 U.S.C. 1681a(t).
---------------------------------------------------------------------------

    The Red Flags Rule applies to certain ``creditors'' as defined in 
section 702 of the Equal Credit Opportunity Act (``ECOA'') \6\ that use 
consumer reports, furnish information to consumer reporting agencies, 
or advance funds.\7\ As a result, many small businesses, service 
providers, and other persons that would ordinarily satisfy the ECOA 
definition of ``creditor'' are excluded from the Red Flags Rule's 
definition of ``creditor.''
---------------------------------------------------------------------------

    \6\ 15 U.S.C. 1681a(r)(5).
    \7\ 15 U.S.C. 1681m(e)(4).
---------------------------------------------------------------------------

    Nonetheless, the scope of entities covered by the Red Flags Rule 
within the FTC's jurisdiction is broad, making it difficult to 
determine precisely the number of financial institutions and creditors 
that are subject to the FTC's jurisdiction. There are numerous 
businesses under the FTC's jurisdiction, and there is no formal way to 
track them. Moreover, as a whole, the entities under the FTC's 
jurisdiction are so varied that there are no general sources that 
provide a record of their existence. Nonetheless, FTC staff estimates 
that the Red Flag Rule's requirement to have a written Program affects 
over 6,027 financial institutions \8\ and 157,564 creditors.\9\
---------------------------------------------------------------------------

    \8\ The total number of financial institutions is derived from 
an analysis of state credit unions and insurers within the FTC's 
jurisdiction using 2021 Census data (``County Business Patterns,'' 
U.S.) and other online industry data.
    \9\ This figure comprises 157,564 creditors (91,743 high-risk 
creditors + 65,821 low-risk creditors). The total number of 
creditors draws from FTC staff analysis of 2021 Census data and 
industry data for businesses or organizations that market goods and 
services to consumers or other businesses or organizations subject 
to the FTC's jurisdiction, excluding entities not likely to (1) 
obtain credit reports, report credit transactions, or advance loans, 
and (2) have covered accounts under the Rule. Currently, no further 
updated Census data is available online to inform revised estimates.

---------------------------------------------------------------------------

[[Page 67940]]

    To estimate burden hours for the Red Flags Rule under section 114, 
FTC staff has divided affected entities into two categories, based on 
the nature of their businesses: (1) entities that are subject to a high 
risk of identity theft; \10\ and (2) entities that are subject to a low 
risk of identity theft.\11\
---------------------------------------------------------------------------

    \10\ In general, high-risk entities include, for example, 
financial institutions within the FTC's jurisdiction and utilities, 
motor vehicle dealerships, telecommunications firms, colleges and 
universities, and hospitals.
    \11\ Low-risk entities have a minimal risk of identity theft, 
but have covered accounts. These include, for example, public 
warehouse and storage firms, nursing and residential care 
facilities, automotive equipment rental and leasing firms, office 
supplies and stationery stores, fuel dealers, and financial 
transaction processing firms.
---------------------------------------------------------------------------

a. High-Risk Entities
    FTC staff estimates that, on an annual basis, there are 
approximately 1,447 new high-risk entities,\12\ and there are currently 
approximately 97,770 existing high-risk entities.\13\ Thus, in order to 
account for the fact that the number of high-risk entities will most 
likely increase over the 3-year clearance period, the remainder of this 
burden analysis relies on the average number of high-risk entities that 
will be subject to the FTC's jurisdiction over the next three years 
(99,217).
---------------------------------------------------------------------------

    \12\ For the purpose of the 2022 renewal request for this 
information collection clearance, FTC staff estimated that there 
were approximately 98,393 existing high-risk entities and 
approximately 1,447 new high-risk entities. See 86 FR 57425 (Oct. 
15, 2021); 87 FR 4239 (Jan. 27, 2022). FTC staff estimates that 
there are currently 97,770 high-risk entities, which represents a 
0.63 percent decrease from the previous estimate. As this decrease 
is not significant, FTC staff believes that, for the purpose of an 
approximation, it is appropriate to continue to assume that, each 
year, there will be approximately 1,447 new high-risk entities.
    \13\ This number was derived from the average annual number of 
existing high-risk entities, taking into account that the new 
entities from year one will become existing entities in year two and 
the new entities from year two will become existing entities in year 
three.
---------------------------------------------------------------------------

    FTC staff estimates that new high-risk entities will each require 
25 hours to create and implement a written Program. FTC staff estimates 
that existing high-risk entities have likely already created and 
implemented a written Program, but will require an annual recurring 
burden of one hour. Further, FTC staff estimates that existing high-
risk entities have already prepared an annual report and will have an 
annual recurring burden of one hour to update the report for each year, 
but that preparation of an annual report will require four hours 
initially for each new high-risk entity. Finally, FTC staff believes 
that many of the high-risk entities, as part of their usual and 
customary business practices, already take steps to minimize losses due 
to fraud, including employee training. Thus, only relevant staff need 
to be trained to implement the Program. For example, staff already 
trained as part of a covered entity's anti-fraud prevention efforts do 
not need to be re-trained except as incrementally needed. FTC staff 
estimates that recurring annual training in connection with the 
implementation of a Program of an existing high-risk entity will 
require one hour each year, and for new entities will require four 
hours initially.
    Accordingly, FTC staff anticipates that high-risk entities will 
incur the following burden:
     1,447 new high-risk entities subject to the FTC's 
jurisdiction at an average annual burden of 33 hours per entity 
(including 25 hours to create and implement the Program, plus 4 hours 
for staff training, plus 4 hours for preparing annual report), for an 
annual total of 47,751 hours.
     97,770 existing high-risk entities subject to the FTC's 
jurisdiction at an average annual burden of 3 hours per entity 
(including 1 hour to update the Program, plus 1 hour for staff 
training, plus 1 hour for preparing the annual report), for an annual 
total of 293,310 hours.
     In total, 99,217 high-risk entities subject to the FTC's 
jurisdiction, for an annual total of 341,061 hours.
b. Low-Risk Entities
    FTC staff estimates that, on an annual basis, there are 
approximately 456 new low-risk entities, and there are currently 
approximately 65,821 existing low-risk entities. Thus, in order to 
account for the fact that the number of low-risk entities will steadily 
increase over the 3-year clearance period, the remainder of this burden 
analysis relies on the average number of low-risk entities that will be 
subject to the FTC's jurisdiction over the next three years (66,277).
    FTC staff believes that the burden on low-risk entities to comply 
with the Rules is minimal. Entities that have a low risk of identity 
theft, but that have covered accounts, will likely only need a 
streamlined Program. FTC staff estimates that any such new entities 
will require one hour to create such a Program. Existing low-risk 
entities will only have an annual recurring burden of 5 minutes. 
Training staff of low-risk entities to be attentive to future risks of 
identity theft and preparing an annual report should require no more 
than 10 minutes each in an initial year for new low-risk entities. 
Existing low-risk entities will only have an annual recurring burden of 
5 minutes each.
    Accordingly, FTC staff anticipates that low-risk entities will 
incur the following burden:
     456 new low-risk entities \14\ that have covered accounts 
subject to the FTC's jurisdiction at an average annual burden of 
approximately 80 minutes per entity (including 60 minutes to create and 
implement a streamlined Program, plus ten minutes for staff training 
and ten minutes for preparing the annual report), for an annual total 
of 608 hours.
---------------------------------------------------------------------------

    \14\ Estimates of new and existing low-risk entities are derived 
from an analysis of a database of U.S. businesses based on NAICS 
codes for businesses that market goods or services to consumers or 
other businesses within the FTC's jurisdiction, reduced further to: 
(1) those that satisfy the Red Flag Rule's definition of 
``creditor;'' and (2) those that are likely to have covered 
accounts.
---------------------------------------------------------------------------

     65,821 existing low-risk entities \15\ that have covered 
accounts subject to the FTC's jurisdiction at an average annual burden 
of approximately 15 minutes per entity (including 5 minutes for 
updating of streamlined Program, plus 5 minutes for staff training, and 
5 minutes for preparing annual report), for an annual total of 16,455 
hours.
---------------------------------------------------------------------------

    \15\ This number was derived from the average annual number of 
existing low-risk entities, taking into account that the new 
entities from year one will become existing entities in year two and 
the new entities from year two will become existing entities in year 
three.
---------------------------------------------------------------------------

     In total, 66,277 low-risk entities subject to the FTC's 
jurisdiction, for an annual total of 17,063 hours.
c. Combined Annual Burden Hours
    Based on the foregoing, FTC staff estimates that the 165,494 
entities (99,217 high-risk entities + 66,277 low-risk entities) subject 
to the Red Flags Rule will incur a total annual burden of 358,124 hours 
(341,061 hours for high-risk entities + 17,063 hours for low-risk 
entities).
    2. Card Issuers Rule: 18,608 Hours.
    Affected Public: State-chartered credit unions; general merchandise 
stores; colleges and universities; telecommunications firms; and 
certain ``creditors.'' \16\
---------------------------------------------------------------------------

    \16\ 15 U.S.C. 1681m(e)(4).
---------------------------------------------------------------------------

    The Card Issuers Rule requires credit and debit card issuers to 
establish policies and procedures to assess the validity of a change of 
address request, including notifying the cardholder or using another 
means of assessing the validity of the change of address. FTC staff 
estimates that there are currently 18,464 credit and debit card issuers 
under the FTC's jurisdiction, and there are approximately 36 new 
entrants each year. Thus, in order to account for this

[[Page 67941]]

annual increase in the number of credit and debit card issuers, FTC 
staff will assume that, in each year of the 3-year clearance period, 
there will be a total of 18,500 credit and debit card issuers, which 
represents the average number of credit and debit card issuers during 
the 3-year clearance period.
    FTC staff believes that each of the 36 new entrants will spend 
approximately 4 hours developing and implementing policies and 
procedures to assess the validity of a change of address request. 
Additionally, FTC staff believes that existing card issuers will likely 
already have automated the process of notifying the cardholder or are 
using other means to assess the validity of the change of address, such 
that implementation will pose no further burden. However, in order to 
provide a conservative estimate, FTC staff will assume that each 
existing card issuer will spend approximately one hour each year 
reviewing and maintaining policies and procedures in order to assess 
the validity of a change of address request.
    Accordingly, FTC staff anticipates that card issuers will incur the 
following burden:
     36 new credit and debit card issuers under the FTC's 
jurisdiction, at an annual average burden of approximately 4 hours per 
entity, for an annual total of 144 hours.
     18,464 existing credit and debit card issuers subject to 
the FTC's jurisdiction, at an average annual burden of approximately 1 
hour per entity, for an annual total of 18,464 hours.
     In total, 18,500 credit and debit card issuers subject to 
the FTC's jurisdiction, for an annual total of 18,608 hours.
    3. Address Discrepancy Rule: 21,747 Hours.
    Affected Public: Users of consumer reports that are motor vehicle 
dealers described in section 1029(a) of the Dodd-Frank Wall Street 
Reform and Consumer Protection Act (the Dodd-Frank Act), 12 U.S.C. 
5519, and that are predominantly engaged in the sale and servicing of 
motor vehicles, the leasing and servicing of them, or both (below, 
referenced as ``users'').
    As discussed above, the Address Discrepancy Rule provides guidance 
on reasonable policies and procedures that a user of consumer reports 
must employ when a user receives a notice of address discrepancy from a 
consumer reporting agency. The FTC Address Discrepancy Rule covers only 
users of consumer reports that are motor vehicle dealers described in 
section 1029(a) of the Dodd-Frank Act and that are predominantly 
engaged in the sale and servicing of motor vehicles, the leasing and 
servicing of them, or both.
    Assuming that every covered motor vehicle dealer is a user of 
consumer reports, FTC staff estimates that the Address Discrepancy Rule 
currently affects approximately 52,211 entities. FTC staff further 
estimates that there are approximately 2,737 new entrants each year, 
representing motor vehicle dealers that have not previously implemented 
procedures to comply with this Rule. Thus, in order to account for the 
fact that the number of entities that are subject to the FTC's Address 
Discrepancy Rule will increase during the 3-year clearance period, this 
burden analysis relies on the average count of entities that will be 
subject to the Rule during the 3-year clearance period (54,948).
    For the 2,737 new entrants, FTC staff estimates that it would take 
an infrequent user of consumer reports no more than 16 minutes to 
develop and follow the policies and procedures that it will employ when 
it receives a notice of address discrepancy, whereas a frequent user 
may take 1 hour. Taking into account these extremes, FTC staff 
estimates that, during the first year of the clearance, for the 2,737 
new entrants, it will take users of consumer reports an average of 38 
minutes (the average of 16 minutes and 60 minutes) to develop and 
comply with the policies and procedures that they will employ when they 
receive a notice of address discrepancy.
    FTC staff assumes that the 52,211 existing motor vehicle dealers 
will already have developed the necessary compliance policies and 
procedures, and will only incur a burden in complying with those 
policies and procedures. Specifically, FTC staff estimates that it may 
take an infrequent user of consumer reports no more than 1 minute to 
comply with the policies and procedures that it will employ when it 
receives a notice of address discrepancy, whereas a frequent user of 
consumer reports may take 45 minutes. FTC staff estimates that the 
average annual burden for the 52,211 existing motor vehicle dealers 
will be 23 minutes (the average of one minute and 45 minutes).
    Thus, for the 2,737 new entrants, the average annual burden for 
each of them to perform these collective tasks will be 38 minutes; 
cumulatively, 1,733 hours. For the 52,211 existing motor vehicle 
dealers, the average annual burden for each of them to perform these 
collective tasks will be 23 minutes; cumulatively, 20,014 hours. 
Collectively, the total burden for the 54,948 motor vehicle dealers 
will be 21,747 hours.\17\
---------------------------------------------------------------------------

    \17\ The above-noted customer verification requirements and the 
estimate of 21,747 hours concern 16 CFR 641.1(c). In addition, 16 
CFR 641.1(d) requires users that (1) furnish a consumer's address to 
a consumer reporting agency, and (2) have established a continuing 
relationship with the consumer, to develop and implement reasonable 
policies and procedures for furnishing an address for the consumer 
that the user has reasonably confirmed is accurate. The FTC 
previously estimated that the cumulative burden hours associated 
with 16 CFR 641.1(d) would be de minimis. Thus, the estimate above 
concerns solely 16 CFR 641.1(c).
---------------------------------------------------------------------------

    4. Combined Annual Burden Hours
    Based on the foregoing, FTC staff estimates that the 238,942 
entities subject to the Red Flags, Card Issuers, and Address 
Discrepancy Rules (165,494 for Red Flags Rule + 18,500 for Card Issuers 
Rule + 54,948 for Address Discrepancy Rule) will incur a total annual 
burden of 398,479 hours (358,124 hours for Red Flags Rule + 18,608 
hours for Card Issuers Rule + 21,747 hours for Address Discrepancy 
Rule).

II. Estimated Annual Labor Cost: $22,350,652

    1. Section 114--Red Flags and Card Issuers Rules: $21,850,471.
    FTC staff derived labor costs by applying appropriate estimated 
hourly cost figures to the burden hours described above. It is 
difficult to calculate the labor costs associated with the Rules with 
precision, as they entail varying compensation levels of management 
and/or technical staff among companies of different sizes. In 
calculating the cost figures, FTC staff assumes that entities' 
professional technical personnel and/or managerial personnel will 
create and implement the Program, prepare the annual report, train 
employees, and assess the validity of a change of address request at an 
hourly rate of $58.\18\
---------------------------------------------------------------------------

    \18\ This estimate is based on mean hourly wages rates found at 
https://www.bls.gov/news.release/pdf/ocwage.pdf (``Bureau of Labor 
Statistics, Occupational Employment and Wages--May 2023,'' April 3, 
2024, Table 1, ``National employment and wage data from the 
Occupational Employment and Wage Statistics survey by occupation, 
May 2023'') for the various managerial and technical staff support 
exemplified above (administrative service managers, computer and 
information systems managers, training and development managers, 
computer systems analysts, network and computer systems analysts, 
computer support specialists) (hereinafter ``BLS Table 1'').
---------------------------------------------------------------------------

    Based on the above estimates and assumptions, the total annual 
labor costs for all categories of covered entities under the Red Flags 
and Card Issuers Rules for section 114 is $21,850,471 (376,732 hours x 
$58).
    2. Section 315--Address Discrepancy Rule: $500,181.

[[Page 67942]]

    FTC staff assumes that the policies and procedures for compliance 
with the Address Discrepancy Rule will be set up by administrative 
support personnel at an hourly rate of $23.\19\ Based on the above 
estimates and assumptions, the total annual labor cost for the two 
categories of burden under section 315 is $500,181 (21,747 hours x 
$23).
---------------------------------------------------------------------------

    \19\ This estimate is based on mean hourly wage rate for office 
and administrative support occupations found within BLS Table 1 (see 
supra note 19), rounded to the nearest whole dollar amount.
---------------------------------------------------------------------------

    3. Combined Annual Labor Costs
    Based on the foregoing, FTC staff estimates that the Red Flags, 
Card Issuers, and Address Discrepancy Rules will result in total annual 
labor costs of approximately $22,350,652 ($21,850,471 + $500,181).

III. Estimated Annual Capital/Non-Labor Costs: De Minimis

    FTC staff believes that the Rules impose negligible capital or 
other non-labor costs, as the affected entities are likely to have the 
necessary supplies and/or equipment already (e.g., offices and 
computers) for the information collections described herein.

C. Request for Comment

    Pursuant to Section 3506(c)(2)(A) of the PRA, the FTC invites 
comments on: (1) whether the disclosure and recordkeeping requirements 
are necessary, including whether the information will be practically 
useful; (2) the accuracy of our burden estimates, including whether the 
methodology and assumptions used are valid; (3) ways to enhance the 
quality, utility, and clarity of the information to be collected; and 
(4) ways to minimize the burden of the collection of information.
    For the FTC to consider a comment, we must receive it on or before 
October 21, 2024. Your comment, including your name and your state, 
will be placed on the public record of this proceeding, including the 
https://www.regulations.gov website.
    You can file a comment online or on paper. Due to heightened 
security screening, postal mail addressed to the Commission will be 
subject to delay. We encourage you to submit your comments online 
through the https://www.regulations.gov website.
    If you file your comment on paper, write ``Red Flags, Card Issuers, 
and Address Discrepancy Rules; PRA Comment: FTC File No. P072108'' on 
your comment and on the envelope, and mail it to the following address: 
Federal Trade Commission, Office of the Secretary, 600 Pennsylvania 
Avenue NW, Suite CC-5610 (Annex J), Washington, DC 20580.
    Because your comment will become publicly available at https://www.regulations.gov, you are solely responsible for making sure that 
your comment does not include any sensitive or confidential 
information. In particular, your comment should not include any 
sensitive personal information, such as your or anyone else's Social 
Security number; date of birth; driver's license number or other state 
identification number, or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. You are also 
solely responsible for making sure that your comment does not include 
any sensitive health information, such as medical records or other 
individually identifiable health information. In addition, your comment 
should not include any ``trade secret or any commercial or financial 
information which . . . is privileged or confidential''--as provided by 
Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 
16 CFR 4.10(a)(2)--including, in particular, competitively sensitive 
information, such as costs, sales statistics, inventories, formulas, 
patterns, devices, manufacturing processes, or customer names.
    Comments containing material for which confidential treatment is 
requested must (1) be filed in paper form, (2) be clearly labeled 
``Confidential,'' and (3) comply with FTC Rule 4.9(c). In particular, 
the written request for confidential treatment that accompanies the 
comment must include the factual and legal basis for the request and 
must identify the specific portions of the comment to be withheld from 
the public record. See FTC Rule 4.9(c). Your comment will be kept 
confidential only if the General Counsel grants your request in 
accordance with the law and the public interest. Once your comment has 
been posted publicly at www.regulations.gov, we cannot redact or remove 
your comment unless you submit a confidentiality request that meets the 
requirements for such treatment under FTC Rule 4.9(c), and the General 
Counsel grants that request.
    The FTC Act and other laws that the Commission administers permit 
the collection of public comments to consider and use in this 
proceeding as appropriate. The Commission will consider all timely and 
responsive public comments that it receives on or before October 21, 
2024. For information on the Commission's privacy policy, including 
routine uses permitted by the Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

Josephine Liu,
Assistant General Counsel for Legal Counsel.
[FR Doc. 2024-18772 Filed 8-21-24; 8:45 am]
BILLING CODE 6750-01-P