Idt '07 Ss.fin

Supporting Statement for
Definitions of Identity Theft and Identity Theft Report
16 CFR Part 603
(1) & (2)

Necessity for and Use of the Information Collected

The Fair and Accurate Credit Transactions Act (the “Act”), Pub.L. 108-159 (December 4,
2003), in part, amends the Fair Credit Reporting Act (“FCRA”) to enhance the ability of
consumers to resolve problems caused by identity theft. Section 111 of the Act added a number
of new definitions to the FCRA, including “identity theft report.” The Act required the
Commission to determine the meaning of the term “identity theft report,” although the Act does
provide a minimum definition.1 As mandated by the Act, therefore, the Commission issued a
final rule on November 3, 2004 (the “Rule”), that defined the term “identity theft report.”2 The
overall effect of defining the term “identity theft report” was to impose information collection
requirements on identity theft victims who choose to obtain identity theft reports to mitigate
specific harms resulting from identity theft. The extent to which these requirements are subject
to the Paperwork Reduction Act, 44 U.S.C. Chapter 35 (“PRA”), is described below.
An identity theft report is a powerful tool that can confer significant benefits on identity
theft victims. For example, under section 605A of the FCRA, victims can obtain an extended
fraud alert if they provide an “identity theft report” to consumer reporting agencies. Under
section 605B of the FCRA, victims can provide an “identity theft report” to consumer reporting
agencies to have information resulting from identity theft that may adversely affect their credit
histories blocked from their consumer reports. Finally, under subsection 623(a)(6)(B) of the
FCRA, victims can provide an “identity theft report” directly to information furnishers to prevent
these information furnishers from continuing to provide information resulting from identity theft
to the consumer reporting agencies.
(3)

Consideration of the Use of Information Technology to Reduce Burden

The Rule contemplates that consumers may use any available information technologies to
obtain an identity theft report. Such technologies may help reduce the burden of information
collection imposed by the Act. For example, nothing in the Act or the Rule precludes identity
theft victims from being offered appropriate automated, electronic, mechanical, or other
technological techniques or other forms of information technology to obtain their copies of law
enforcement reports, thereby reducing the time and burden that may otherwise be associated with
obtaining such reports. Likewise, nothing in the Act or Rule prohibits identity theft victims from
1

The Act provides that the term means “at a minimum, a report – (A) that alleges identity theft; (B)
that is a copy of an official, valid report filed by the consumer with an appropriate Federal, State, or local law
enforcement agency, including the United States Postal Inspection Service, or such other government agency
deemed appropriate by the Commission; and (C) the filing of which subjects the person filing the report to
criminal penalties relating to the filing of false information, if, in fact, the information in the report is false.”
15 U.S.C. § 1681a(q)(4).
2

69 Fed. Reg. 63,922 (Nov. 3, 2004).

being permitted to submit their identity theft reports to credit reporting agencies or information
furnishers using the least burdensome information technology. Moreover, in its first of two
Federal Register notices regarding the instant clearance request, the Commission specifically
sought comments on ways to reduce the burden of the Rule’s collection of information through
the use of information technology. See 72 Fed. Reg. 14,810 (March 29, 2007). No comments
were received.
Consistent with the Government Paperwork Elimination Act., Pub L. No. 105-227, Title
XVII, 112 Stat. 2681-749, nothing in the Rule prescribes that an identity theft report be obtained
on paper or in any particular format that would preclude the use of electronic methods to comply
with the Rule’s requirements.
(4)

Efforts to Identify Duplication

The Rule allows identity theft victims to obtain identity theft reports from State and
Federal law enforcement agencies, as well as local law enforcement agencies. Consumers need
not, however, obtain more than one identity theft report, thereby avoiding any potential
duplication.
(5)

Efforts to Minimize Burden on Small Organizations

Not applicable; individuals who are victims of identity theft, not business entities (of any
size), prepare and file identity theft reports.
(6)

Consequences of Conducting the Collection Less Frequently

Not applicable. The Rule does not mandate any information collection from consumers.
Rather, victims of identity theft may choose to obtain an identity theft report in order to obtain
certain protective actions from consumer reporting agencies or information furnishers. Thus, the
frequency of collection will be within consumers’ discretion.
(7)

Circumstances Requiring Collection Inconsistent With Guidelines

The collection of information in the Rule is consistent with all applicable guidelines
contained in 5 C.F.R. § 1320.5(d)(2).
(8)

Public Comments/Consultation Outside the Agency

As required by 5 C.F.R. § 1320.8(d), the FTC sought public comments on its proposal to
extend its current OMB clearance for the Rule’s information collection requirements. See 72
Fed. Reg. 14,810 (March 29, 2007). No comments were received. Pursuant to the OMB’s
implementing regulations, the FTC is providing a second opportunity for public comment while
seeking OMB approval to extend the existing PRA clearance for the Rule.
2

(9)

Payments and Gifts to Respondents
Not applicable.

(10) & (11)

Assurances of Confidentiality/Matters of a Sensitive Nature

Although the Rule does not explicitly require or contemplate that identity theft victims
submit information directly to the FTC, any information submitted to the FTC for law
enforcement purposes is subject to the confidentiality protections of Sections 6(f) and 21 of the
Federal Trade Commission Act, 15 U.S.C. §§ 46(f), 57b-2, as applicable. Moreover, it is the
FTC’s general policy not to publish or divulge the name of an applicant or complaining party
except as required by law or by the FTC’s rules. The FTC may disclose the identity of a
consumer who files an identity theft complaint in the course of referring the complaint to other
legal authorities. See FTC Rule of Practice 2.2(d), 16 C.F.R. § 2.2(d).
Additionally, identity theft information may be disclosed to financial institutions,
including credit reporting agencies, that have signed a confidentiality agreement, where
necessary, with the FTC. The FTC shares this information to fulfill its statutory obligation under
the Identity Theft and Assumption Deterrence Act of 1998, 18 U.S.C. § 1028 note.3 Finally, the
Commission may publish trend reports based on aggregate data from consumer fraud and identity
theft complaints. However, the Commission does not publicly disclose personal identifying
information in these reports.
(12)

Estimated Annual Hours and Labor Cost Burden

Staff anticipates that, as both individuals and police departments become increasingly
aware of the benefits of obtaining an “identity theft report” under the Act, the number of
individuals who ultimately obtain an identity theft report will likely increase because the Rule
facilitates a victim’s ability to file a law enforcement report. To estimate that increase and
associated effect on paperwork burden, staff has drawn from publicly available survey results
that quantify: (a) how many individuals are victimized annually by identity theft; and (b) the
frequency in which consumers file related identity theft reports with law enforcement agencies
and other third-parties.
In a survey prepared for the Commission by Synovate and issued in September 2003,
Federal Trade Commission – Identity Theft Survey Report (Synovate Survey Report),4 Synovate

3

In part, the Act requires that the FTC establish procedures to refer complaints to appropriate entities,
which may include “(A) the three major national consumer reporting agencies; and (B) appropriate law
enforcement agencies for potential law enforcement action.”
4

See Synovate Survey Report at http://www.ftc.gov/os/2003/09/synovatereport.pdf.

3

stated that there are 9.91 million individuals victimized by identity theft each year.5 More recent
public data, however, states that in 2006, the number of domestic consumer victims of identity
theft totaled 8.9 million,6 and staff will apply this latter amount to its projections of increased
consumer use of identity theft reports.
The Synovate Survey Report also provided data on the frequency in which consumers file
identity theft reports with law enforcement agencies and other third-parties. Staff is unaware of
newer publicly available data of this nature. Accordingly, staff will incorporate this previously
provided data into its revised estimates of the number of consumers who will obtain identity theft
reports.
Based on past years’ experience drawn from the Synovate Survey Report, 26% of all
identity theft victims contact a law enforcement agency.7 Of those contacting law enforcement
officials, 76% file a police report alleging identity theft.8 Conversely, 24% of victims who
contact a law enforcement agency have not filed a police report. Applying this information to the
updated population of identity theft victims, that would amount to 2.314 million individuals
contacting a law enforcement agency (8.9 million victims x 26%) of which roughly 555,000
(rounded to the nearest thousand) have not filed a police report. Staff anticipates that the Rule
will enable those victims who previously were unable to file reports with local law enforcement
to now file reports with a state or federal law enforcement agency.
The Synovate Survey Report stated that 43% of identity theft victims annually contact an
information furnisher.9 This would amount to 3.827 million victims in a given year (8.9 million
victims x 43%). Based on its knowledge of identity theft trends, staff anticipates that the Rule
will result in an increase of 10% of these persons, or roughly 383,000, who will now obtain an
identity theft report to file with an information furnisher as proof of being an identity theft
victim.
In a given year, 3.23 million persons are victims of their personal information being used
to open new accounts or to commit other frauds.10 Of these victims, approximately 20% – or

5

Synovate Survey Report at 7.

6

See http://www.privacyrights.org/ar/idtheftsurveys.htm (summarizing findings of the January 2006
Javelin Strategy and Research 2006 Identity Fraud Survey Report).
7

Synovate Survey Report at 59.

8

Id.

9

Id. at 50.

10

Id. at 7. Absent newer data on this point, staff refers to and applies this Synovate-provided data.

4

646,000 – do not take any action on this misuse.11 Based on its knowledge of identity theft
trends, staff estimates that the Rule will likely result in 75%, or 485,000, of these victims
obtaining identity theft reports.
In sum, then, staff estimates that the Rule will increase by 1.423 million the number of
individuals obtaining identity theft reports (555,000 + 383,000 + 485,000).
Estimated total annual hours burden: 545,000 hours (rounded to the nearest thousand)
In its 2004 notice of proposed rulemaking and corresponding submission to OMB, FTC
staff estimated, based on the experience of the Commission’s Consumer Response Center, that
an individual would spend an average of 5 minutes finding and reviewing filing instructions, 8
minutes filing the law enforcement report with the law enforcement agency, and 5 minutes
submitting the law enforcement report and any additional information or documentation to the
information furnisher or consumer reporting agency, resulting in an average of 18 minutes for
each identity theft report.12
Staff now estimates, based on the ongoing experience of the Commission’s Consumer
Response Center, that an individual will spend 5 minutes finding and reviewing filing
instructions, 13 minutes filing the law enforcement report with the law enforcement agency (due
to added entry fields), and 5 minutes submitting the law enforcement report and any additional
information or documentation to the information furnisher or consumer reporting agency,
resulting in an average of 23 minutes for each identity theft report. Thus, the annual information
collection burden for the estimated 1.423 million new identity theft reports due to the Rule will
be 545,000 hours, rounded to the nearest thousand (1.423 million x 23 minutes ÷ 60
minutes/hour).
Estimated labor costs: $10,802,000 (rounded to the nearest thousand)
Commission staff derived labor costs by applying appropriate hourly cost figures to the
burden hours described above. Based on Bureau of Labor Statistics data, further adjusted for
inflation, the average national hourly wage for individuals is $19.82.13 Applied to 545,000 total

11

Based upon staff’s analysis of data collected in the Synovate Survey Report, these types of victims
constitute 20% of such victims.
12

These estimates take into account that the time required to file the report will vary depending on the
law enforcement agency used by the individual.
13

An hourly rate of $18.62 was drawn from average annual Bureau of Labor Statistics National
Compensation Survey data, June 2005 (with 2005 as the most recent whole year information available, and
June the focal median point), http://www.bls.gov/ncs/ocs/sp/ncbl0832.pdf (Table 1.1). Further adjusted by a
multiplier of 1.06426 (a compounding for approximate wage inflation for 2005 and 2006, based on the BLS
Employment Cost Index), the revised hourly wage is $19.82.

5

burden hours yields an estimated $10,802,000 in cumulative labor costs for all those who will
newly obtain identity theft reports ($19.82 x 545,000 hours) as a projected result of the Rule.
(13)

Capital and Other Non-labor Costs
Estimated annual non-labor cost burden: 0 or minimal

The FTC staff estimates that the Rule imposes negligible capital or other non-labor costs,
as the affected consumers are likely to have the necessary supplies and/or equipment already
(e.g., telephone, computer, paper, envelopes) for obtaining identity theft reports and submitting
them to information furnishers or consumer reporting agencies.
(14)

Estimated Cost to the Federal Government

Staff estimates that a representative year’s cost of administering the Rule’s requirements
during the 3-year clearance period sought will be approximately $12,000. This represents onetenth of an attorney work year, and includes employee benefits.
(15)

Program Changes or Adjustments

Increased estimates of burden hours and labor costs from the FTC’s prior clearance
request are due to an increase in staff’s estimate of the time required for an identity theft victim
to file a law enforcement report with a law enforcement agency and, additionally, regarding labor
costs, an increase in estimated hourly wage rates.
(16)

Statistical Use of Information/Publication of results

Not applicable. There are no plans to publish for statistical use any information collected
pursuant to the Rule.
(17)

Display of the Expiration Date for OMB Approval
Not applicable.

(18)

Exceptions to the “Certification for Paperwork Reduction Act Submissions”
Not applicable.

6