13.40.060 Program administration.
A. Oversight. The finance director or other designated city employee at the level of senior management shall be responsible for developing, implementing, and updating the program.
The finance director shall also be responsible for the program administration, for appropriate training of city staff on the program, for reviewing the annual staff report required under the program, as well as any other staff reports regarding the detection of red flags and the steps for preventing and mitigating identity theft, determining which steps of prevention and mitigation should be taken in particular circumstances, and considering periodic changes to the program.
B. Staff Training and Reports. City staff responsible for implementing the program shall be trained either by or under the direction of the finance director in the detection of red flags, and the responsive steps to be taken when a red flag is detected. Additionally, a compliance report shall be provided annually to the finance director. The annual compliance report shall at a minimum address the following:
1. The effectiveness of the city’s policies and procedures in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts;
2. Service provider arrangements;
3. Significant incidents involving identity theft and the city’s response; and
4. Recommendations for material changes to the program.
C. Service Provider Arrangements. In the event the city engages a service provider to perform an activity in connection with one or more covered accounts, the city shall take the following steps to require that the service provider performs its activity in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft.
1. Require, by contract, that service providers acknowledge receipt and review of the program and agree to perform their activities with respect to city covered accounts in compliance with the terms and conditions of the program and with all instructions and directives issued by the finance director relative to the program; or
2. Require, by contract, that service providers acknowledge receipt and review of the program and agree to perform their activities with respect to city covered accounts in compliance with the terms and conditions of the service provider’s identity theft prevention program and will take appropriate action to prevent and mitigate identity theft; and that the service providers agree to report promptly to the city in writing if the service provider in connection with a city covered account detects an incident of actual or attempted identity theft or is unable to resolve one or more red flags that the service provider detects in connection with a covered account.
D. Customer Identifying Information and Public Disclosure. The identifying information of city customers with covered accounts shall be kept confidential and shall be exempt from public disclosure to the maximum extent authorized by law, including RCW 42.56.230(4). The city council also finds and determines that public disclosure of the city’s specific practices to identity, detect, prevent, and mitigate identify theft may compromise the effectiveness of such practices and hereby direct that, under the program, knowledge of such specific practices shall be limited to the finance director and those city employees and service providers who need to be aware of such practices for the purpose of preventing identity theft.