Admin Order 21-09-06 - Laserfiche WebLink

Home Browse Search

(b) In the event City staff detect one or more Red Flags, staff may take one or more of the following actions, depending on the degree of risk that the Red Flag indicates identity theft: 1. Continue to monitor a covered account for evidence of identity theft; 2. Contact the customer; 3. Change any passwords, security codes, or other security devices that permit access to a covered account; 4. Reopen a covered account with a new account number; 5. Decline to open a new covered account; 6. Close an existing covered account; 7. Not attempt to collect on a covered account or not refer a covered account to a debt collector; 8. Notify law enforcement; or 9. Determine that no response is warranted under the particular circumstances. (c) The head of each department, or the department head's designee, shall be responsible for implementation of the Program for his or her department. The City Manager will periodically update the Program (including the Red Flags determined to be relevant) to reflect changes in risks to customers or the City from identity theft, based on factors such as: 1. The experiences of the City with identity theft; 2. Changes in methods of identity theft; 3. Changes in methods to detect, prevent, and mitigate identity theft; 4. Changes in the types of accounts that the City offers or maintains; and 5. Changes in the business arrangements of the City, including service provider arrangements. (d) Each department head shall report to the City Manager by December 31st of each year, beginning in 2010, on his or her department's compliance with the Program. The report should address: 1. The covered accounts overseen or maintained by the department; 2. The effectiveness of the Program in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts; 3. Service provider arrangements; 4. Significant incidents involving identity theft and the department's response; . 5. Steps taken by the department to protect personal information; and 6. Recommendations for changes to the Program. (e) If a department does not oversee any covered accounts, the annual report to the City Manager may be limited to addressing steps taken by the department to protect personal information. (6) Oversight of service provider arrangements. Whenever the City engages a service provider to perform an activity in connection with one or more covered accounts the City will take steps to ensure that the activity of the service provider is conducted in Administrative Order -- Page 6 of 7