Marcus visits Summit Risk Advisors to obtain a life insurance quote. During the consultation, he provides his financial history and health information. Ultimately, Marcus decides the premium is too high and leaves without purchasing a policy or establishing an ongoing account. Several months later, Summit Risk Advisors decides to share a list of past quoting individuals, including Marcus's income bracket and contact details, with an unaffiliated financial planning firm. Under the Gramm-Leach-Bliley Act (GLBA), which of the following actions is Summit Risk Advisors legally required to take regarding Marcus?
- AMail Marcus an initial privacy notice immediately, followed by an annual privacy notice for as long as his data is on file.
- BShare the information without providing notice, because Marcus did not purchase a policy and is not considered a customer.
- Provide Marcus with an initial privacy notice and a clear opportunity to opt out before disclosing his nonpublic personal information.Answer
- DRefrain from sharing the data entirely, because the GLBA strictly prohibits disclosing nonpublic personal information to unaffiliated entities under all circumstances.
Answer
Provide Marcus with an initial privacy notice and a clear opportunity to opt out before disclosing his nonpublic personal information.
Under the GLBA, an individual who obtains a one-time service (such as an insurance quote) without establishing an ongoing relationship is defined as a 'consumer,' not a 'customer.' A financial institution is only required to give a consumer a privacy notice if it intends to disclose their Nonpublic Personal Information (NPI) to an nonaffiliated third party. Since Summit Risk Advisors plans to share Marcus's NPI with an unaffiliated firm, they must provide an initial privacy notice and a reasonable opportunity to opt out before the disclosure occurs.
Step-by-Step Solution
Key Concept
GLBA distinction between consumers and customers regarding privacy notices and opt-out requirements.
Estimated Time:1m 15s