Evelyn contacts Meridian Insurance Associates to obtain a quote for a personal homeowners policy. During the process, she provides her social security number and financial details. After reviewing the quote, Evelyn decides not to purchase the policy. However, Meridian intends to sell Evelyn's contact information and profile to an unaffiliated home security company for marketing purposes.
Under the Gramm-Leach-Bliley Act (GLBA), which of the following correctly describes Meridian's legal obligations regarding Evelyn's nonpublic personal information (NPI)?
- Meridian must provide an initial privacy notice and an opportunity to opt out before sharing her information with the home security company.Answer
- BMeridian must provide an initial privacy notice immediately upon collecting her information, and must send an annual privacy notice for as long as they retain her data.
- CMeridian must provide an initial privacy notice, but an opt-out opportunity is only legally required for individuals who purchase a policy.
- DMeridian may share her information without providing any notice because GLBA privacy mandates only apply to individuals who actually purchase an insurance product.
Answer
Meridian must provide an initial privacy notice and an opportunity to opt out before sharing her information with the home security company.
Under GLBA, an individual who provides nonpublic personal information (NPI) to obtain an insurance quote is classified as a consumer. While a financial institution does not automatically have to provide an initial privacy notice to a consumer who does not purchase a product, it absolutely must do so if it intends to share their NPI with a nonaffiliated third party outside of standard exceptions. Therefore, before Meridian can sell Evelyn's information to the home security company, it must provide her with an initial privacy notice and a reasonable opportunity to opt out of the disclosure.
Step-by-Step Solution
Key Concept
GLBA Consumer Privacy Notice and Opt-Out Requirements