(A) Oversight. The Program Administrator shall be responsible for the program administration, for staff training on the program as appropriate, for reviewing any reports regarding the detection of red flags, for determining and instituting the necessary steps to prevent and mitigate identity theft when red flags are detected, and for periodically reviewing and revising the program. The Program Administrator shall maintain, for a reasonable amount of time and as appropriate and necessary, reports and documentation regarding incidents of detected red flags.
(B) Staff training and reports. The town employees that are responsible for implementing the program shall be trained wither by or under the direction of the Program Administrator in the detection of red flags, and the steps to be taken in responding to red flags. Such staff shall be trained on how to report detected red flags.
(C) Service provider arrangements. In the event the town engages a service provider to perform an activity in connection with one or more covered accounts, the town shall take the following steps to require that the service provider performs its activity in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft:
(1) Require, by contract, that service provider acknowledges receipt and review of the program and agrees to perform its activities with respect to the town’s covered accounts in compliance with the terms and conditions of the program and with all instructions and directives issued by the Program Administrator relative to the program; or
(2) Require, by contract, that service provider acknowledges receipt and review of the program and agrees to perform its activities with respect to the town’s covered accounts in compliance with the terms and conditions of the service provider’s identity theft prevention program and will take appropriate action to prevent and mitigate identity theft; and that the service provider agrees to report promptly to the town in writing if the service provider in connection with a town covered account detects an incident of actual or attempted identity theft or is unable to resolve one or more red flags that the service provider detects in connection with a covered account.
(D) Customer identifying information and public disclosure. The identifying information of the Department’s customers with covered accounts shall be kept confidential and shall be exempt from public disclosure to the maximum extent authorized by law, including I.C. 5-14-3-4. The Town Council also finds and determines that public disclosure of the town’s specific practices to identity, detect, prevent and mitigate identity theft may compromise the effectiveness of such practices and hereby directs that, under the program, knowledge of such specific practices shall be limited to the Program Administrator and those town employees and service providers who need to be aware of such practices for the purpose of preventing identity theft.
(Res. 2011-04, passed 3-14-2011)