10-14-08 - Laserfiche WebLink

Home Browse Search

administration, for ensuring appropriate training of Utility staff on the Program, for reviewing ID any staff reports regarding the detection of Red Flags and the steps for preventing and mitigating Identity Theft, determining which steps of prevention and mitigation should be taken in particular circumstances and considering periodic changes to the Program. B. Staff Training and Reports Utility staff responsible for implementing the Program shall be trained either by or under the direction of the Program Administrator in the detection of Red Flags, and the responsive steps to be taken when a Red Flag is detected. (The Utility may include in its Program how often training is to occur. The Program may also require staff to provide reports to the Program Administrator on incidents of Identity Theft, the Utility's compliance with the Program and the effectiveness of the Program.) C. Service Provider Arrangements In the event the Utility engages a service provider to perform an activity in connection with one or more accounts, the Utility will take the following steps to ensure the service provider performs its activity in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of Identity Theft. 1. Require,by contract, that service providers have such policies and procedures in place; and • 2. Require, by contract, that service providers review the Utility's Program and report any Red Flags to the Program Administrator. D. Non-disclosure of Specific Practices (This provision is not required by the Rule, but municipal utilities may find it useful.) For the effectiveness of this Identity Theft Prevention Program, knowledge about specific Red Flag identification, detection,mitigation and prevention practices must be limited to the Identity Theft Committee who developed this Program and to those employees with a need to know them. Any documents that may have been produced or are produced in order to develop or implement this program that list or describe such specific practices and the information those documents contain are considered "security information"as defined in Minnesota Statutes Section 13.37 and are unavailable to the public because disclosure of them would be likely to substantially jeopardized the security of information against improper use, that use being to circumvent the Utility's Identity Theft prevention efforts in order to facilitate the commission of Identity Theft. • 7