216.03 THE PROGRAM.

   The Utility Billing Department establishes an Identity Theft Prevention Program to detect, prevent and mitigate identity theft. The program shall include reasonable policies and procedures to:

   (a)   Identify relevant red flags for covered accounts.

   (b)   Detect red flags and report them to the Finance Director.

   (c)   Respond appropriately to any red flags that are detected to prevent and mitigate identity theft.

   (d)   Ensure the program is updated periodically to reflect changes in risks to customers and to the safety and soundness of the creditor from identity theft

(Ord. 109-09. Passed 7-13-09.)

216.04 ADMINISTRATION OF PROGRAM.

   (a)   The Finance Director shall be designated the “Privacy Official” responsible for the development, implementation, oversight and continued administration of the program.

   (b)   The program shall require training of pertinent staff to effectively implement the program; and

   (c)   The program shall exercise appropriate and effective oversight of service provider arrangements.

(Ord. 109-09. Passed 7-13-09.)

216.05 IDENTIFICATION OF RELEVANT RED FLAGS.

   The program shall include relevant red flags from the following categories as appropriate:

   (a)   Alerts, notifications, or other warnings received from consumer reporting agencies or service providers, such as fraud detection services;

   (b)   The presentation of suspicious documents;

   (c)   The presentation of suspicious personal identifying information;

   (d)   The unusual use of, or other suspicious activity related to, a covered account; and

   (e)   Notice from customers, victims of identity theft, law enforcement authorities, or other persons regarding possible identity theft in connection with covered accounts.

(Ord. 109-09. Passed 7-13-09.)

216.06 DETECTION OF RED FLAGS.

   The program shall address the detection of red flags in connection with the opening of covered accounts and existing covered accounts, such as by:

   (a)   Obtaining identifying information about, and verifying the identity of, a person opening a covered account; and

   (b)   Authenticating customers, monitoring transactions, and verifying the validity of change of address requests in the case of existing covered accounts.

(Ord. 109-09. Passed 7-13-09.)

216.07 RESPONSE.

   The program shall provide for appropriate responses to detected red flags to prevent and mitigate identity theft. The response shall be commensurate with the degree of risk posed. Appropriate responses may include:

   (a)   Monitor a covered account for evidence of identity theft;

   (b)   Contact the customer;

   (c)   Change any passwords, security codes or other security devices that permit access to a covered account;

   (d)   Reopen a covered account with a new account number;

   (e)   Not open a new covered account;

   (f)   Close an existing covered account;

   (g)   Notify law enforcement; or

   (h)   Determine no response is warranted under the particular circumstances.

(Ord. 109-09. Passed 7-13-09.)

216.08 UPDATING THE PROGRAM.

   The program shall be updated periodically to reflect changes in risks to customers or to the safety and soundness of the organization from identity theft based on factors such as:

   (a)   The experiences of the organization with identity theft;

   (b)   Changes in methods of identity theft;

   (c)   Changes in methods to detect, prevent and mitigate identity theft;

   (d)   Changes in the types of accounts that the organization offers or maintains;

   (e)   Changes in the business arrangements of the organization, including mergers, acquisitions, alliances, joint ventures and service provider arrangements.

(Ord. 109-09. Passed 7-13-09.)