Question

Difficulty: EasyGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

Sarah contacts Oakwood Financial Services to request a rate quote for a personal auto policy. She provides her driving history and ZIP code to the agent but ultimately decides not to purchase a policy. Under the Gramm-Leach-Bliley Act (GLBA), how is Sarah classified, and what privacy notice requirement applies to her?

  1. She is a consumer; a privacy notice is required only if the agency intends to share her nonpublic personal information with a nonaffiliated third party.Answer
  2. B
    She is a customer; an initial privacy notice must be provided at the time the quote is generated regardless of information sharing.
  3. C
    She is a consumer; the agency must provide both an initial and an annual privacy notice because her data was collected.
  4. D
    She is a customer; the agency is entirely exempt from privacy rules because no insurance contract was legally formed.

Answer

She is a consumer; a privacy notice is required only if the agency intends to share her nonpublic personal information with a nonaffiliated third party.
The correct answer accurately classifies the individual as a consumer since she only requested a quote and did not buy a policy. Under the GLBA, a financial institution is only required to provide an initial privacy notice to a consumer if it plans to disclose that consumer's nonpublic personal information to a nonaffiliated third party.

Step-by-Step Solution

1
Determine Sarah's classification under GLBA based on her interaction with the agency.
Sarah is a 'consumer' because she only requested a quote, which is a one-time transaction, and did not establish an ongoing relationship.
GLBA distinguishes between a consumer (one-time interaction) and a customer (ongoing relationship).
2
Identify the privacy notice requirements for a consumer.
A consumer must receive an initial privacy notice only if the institution plans to disclose their nonpublic personal information (NPI) to nonaffiliated third parties.
Unlike customers, who must automatically receive initial and annual notices, consumers only trigger the notice requirement if their data is going to be shared outside the institution.

Key Concept

Under GLBA, a consumer (someone seeking a one-time service) only requires an initial privacy notice if their nonpublic personal information is shared with nonaffiliated third parties, whereas a customer (ongoing relationship) requires initial and annual notices.
Estimated Time:45s
Rate this question