Examkin

Question

Difficulty: MediumGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

Beacon Insurance Services handles two different interactions on a Tuesday. First, Individual X requests a one-time rate quote for auto insurance, decides not to purchase a policy, and leaves. Second, Individual Y purchases a standard homeowner's policy, establishing an ongoing relationship with the agency. Beacon Insurance Services has a strict policy of never sharing Nonpublic Personal Information (NPI) with nonaffiliated third parties. According to the Gramm-Leach-Bliley Act (GLBA), what are the agency's mandatory privacy notice requirements for these two individuals?

  1. The agency must provide an initial privacy notice to Individual Y, but is not required to provide a notice to Individual X.Answer
  2. B
    The agency must provide an initial privacy notice to both individuals before collecting any of their personal information.
  3. C
    The agency is exempt from providing privacy notices to either individual because it does not share NPI with nonaffiliated third parties.
  4. D
    The agency must provide an initial privacy notice to Individual X, while Individual Y only requires an annual notice.

Answer

The agency must provide an initial privacy notice to Individual Y, but is not required to provide a notice to Individual X.
Under the Gramm-Leach-Bliley Act, there is a strict distinction between a 'consumer' and a 'customer'. A consumer is someone who completes a one-time transaction (Individual X). An initial privacy notice is only required for a consumer if the agency plans to share their Nonpublic Personal Information (NPI) with nonaffiliated third parties. Since the agency does not share NPI, Individual X does not need a notice. A customer is someone with whom the agency has an ongoing relationship (Individual Y). The GLBA mandates that an initial privacy notice be provided to a customer no later than when the customer relationship is established, and annually thereafter, regardless of the agency's sharing practices.

Step-by-Step Solution

1
Define the status of each individual under the GLBA.
Individual X is a 'consumer' (one-time transaction). Individual Y is a 'customer' (ongoing relationship established by purchasing a policy).
GLBA rules for privacy notices depend entirely on whether the individual is classified as a consumer or a customer.
2
Apply the GLBA privacy notice rule for consumers (Individual X).
Since the agency does not share NPI with nonaffiliated third parties, no initial privacy notice is required for Individual X.
Under GLBA, a consumer only receives an initial privacy notice if the financial institution intends to share their NPI with nonaffiliated third parties.
3
Apply the GLBA privacy notice rule for customers (Individual Y).
Individual Y must receive an initial privacy notice at the time the customer relationship is established.
Under GLBA, a customer must always receive an initial privacy notice when the relationship is formed (and annual notices thereafter), regardless of the institution's information-sharing practices.

Key Concept

GLBA Consumer vs. Customer Definitions and Notice Requirements
Estimated Time:1m 15s
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic