Examkin

Question

Difficulty: HardGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

Meridian Casualty & Property Group collects Nonpublic Personal Information (NPI) from applicants, policyholders, and claimants. The agency is auditing its data sharing practices to ensure strict compliance with the Gramm-Leach-Bliley Act (GLBA). Under GLBA regulations, which of the following disclosures of NPI may the agency legally make without providing the individual with an opt-out opportunity? (Select all that apply.)

  1. Disclosing NPI to an independent claims adjusting firm to investigate an active policyholder's reported property lossAnswer
  2. B
    Sharing a policyholder's contact information and coverage limits with an unaffiliated car dealership for promotional marketing purposes
  3. Providing a prospect's NPI to a state insurance department examiner who is conducting a statutory market conduct auditAnswer
  4. D
    Transferring the NPI of a one-time applicant to an external financial advisory firm, assuming that because the applicant is merely a 'consumer' and not a 'customer,' no opt-out opportunity is required

Answer

The agency may disclose NPI without an opt-out opportunity when investigating a claim (via an independent adjuster) and when complying with a regulatory audit.
Under the Gramm-Leach-Bliley Act (GLBA), consumers and customers must generally be given an opportunity to opt out before their Nonpublic Personal Information (NPI) is shared with nonaffiliated third parties. However, there are strict statutory exceptions. Sharing NPI is permitted without an opt-out if it is necessary to effect, administer, or enforce a transaction requested by the individual (such as investigating an active claim) or to comply with federal, state, or local regulatory authorities (such as a Department of Insurance audit).

Step-by-Step Solution

1
Identify the general GLBA privacy rule regarding third-party sharing.
Agencies must generally provide an initial privacy notice and an opt-out opportunity before sharing NPI with nonaffiliated third parties.
This is the baseline consumer protection mandate of the Financial Privacy Rule.
2
Analyze the statutory exceptions to the opt-out requirement.
Exceptions include sharing data to effect, administer, or enforce a requested transaction, protecting against fraud, and complying with legal or regulatory requirements.
Routine operational and legal functions cannot be hindered by consumer opt-outs.
3
Evaluate the scenarios against the permitted exceptions.
Investigating a property loss (claims adjustment) and undergoing a state insurance department audit clearly qualify as exempt activities.
One is administering the insurance contract, and the other is complying with state regulatory law.
4
Differentiate between a consumer and a customer regarding opt-out rights.
While 'consumers' (one-time prospects) do not require an annual privacy notice like ongoing 'customers', both statuses possess the right to an initial notice and an opt-out opportunity before their NPI is sold or shared with nonaffiliated third parties for non-exempt purposes.
Resolves the misconception that consumer status negates all privacy protections.

Key Concept

GLBA Privacy Exceptions and Consumer Opt-Out Rights
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic