(a) Management. The Village Finance Director is responsible for implementation and administration of the program. The Finance Director will report to Council at least annually on compliance by the village with the program. The report shall address material matters related to the program and evaluate the effectiveness of the policies and procedures in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts. The Village Council will approve any material changes to the program as necessary to address changing identity theft risks.
(b) Staff training. Staff training shall be conducted for all employees, officials, and contractors for whom it is reasonably foreseeable that they may come into contact with accounts or personally identifiable information that may constitute a risk to the city or its customers. The Finance Director is responsible for ensuring identity theft training for all requisite employees. Employees must receive annual training in all elements of this policy. To ensure maximum effectiveness, employees may continue to receive additional training as changes to the program are made.
(c) Oversight. It is the responsibility of the village to ensure that the activities of all service providers are conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft.
(1) A service provider that maintains its own identity theft prevention program, consistent with the guidance of the red flag rules and validated by appropriate due diligence, may be considered to be meeting these requirements.
(2) Any specific requirements should be specifically addressed in the appropriate contract arrangements.
(Res. 2009-R-12, passed 10-20-2009)