Which of the following is not correct regarding the Federal Trade Commission (FTC) and consumer privacy?

A. The FTC enforces its "Red Flags Rule," under which all "financial institutions" and "creditors" must establish a written program to prevent identity theft in their organizations.

B. The FTC is solely responsible for enforcing Consumer Privacy Protection Act.

C. The FTC may require companies who do not protect consumer privacy to mitigate whatever losses may come from identity theft.

D. Courts have confirmed the FTC's authority to sue firms whose lax security policies result in compromised consumer privacy.