Examkin

Question

Difficulty: MediumGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

Thomas contacts an independent agency, Summit Risk Advisors, to request a rate quote for a homeowners insurance policy. During this process, Thomas provides his Social Security number and financial history. After receiving the quote, he declines the offer and does not purchase a policy. Summit Risk Advisors' internal policy states that they only share Nonpublic Personal Information (NPI) with nonaffiliated third parties when it is strictly necessary to process requested transactions (such as obtaining quotes from insurance carriers). Under the Gramm-Leach-Bliley Act (GLBA), which of the following accurately describes the agency's privacy notice obligations to Thomas?

  1. The agency is not required to provide a privacy notice because Thomas is a consumer and his information is not shared outside of routine processing exceptions.Answer
  2. B
    The agency must issue an initial privacy notice at the exact time the quote is generated, regardless of whether a purchase occurs.
  3. C
    The act of collecting a Social Security number establishes an ongoing customer relationship, requiring both an initial and an annual privacy notice.
  4. D
    The agency must immediately provide an opt-out notice to prevent his information from being sent to the insurance carriers for quoting.

Answer

The agency is not required to provide a privacy notice because Thomas is a consumer and his information is not shared outside of routine processing exceptions.
The correct answer correctly identifies Thomas as a 'consumer' under the GLBA, which defines a consumer as an individual who obtains a financial product or service for personal use in an isolated transaction. Under the law, a financial institution is only obligated to provide an initial privacy notice to a consumer if it intends to share their NPI with nonaffiliated third parties outside of standard exceptions. Since Summit Risk Advisors only shares NPI to fulfill the requested transaction (obtaining the quote), no notice is mandated.

Step-by-Step Solution

1
Determine the individual's legal status under GLBA (Consumer vs. Customer).
Thomas is classified as a 'consumer' because he only requested a one-time service (a quote) and did not purchase a policy to establish an ongoing relationship.
GLBA rules apply differently depending on whether the individual has an ongoing relationship with the financial institution.
2
Evaluate the agency's information sharing practices.
The agency only shares NPI with nonaffiliated third parties to process the requested transaction (obtaining the quote).
Notice requirements for a consumer are triggered by the institution's sharing practices.
3
Apply the GLBA privacy notice mandate to the specific scenario.
No initial privacy notice or opt-out is required.
A financial institution is only required to give an initial privacy notice to a 'consumer' if it intends to disclose their NPI outside of standard legal exceptions (such as processing a transaction).

Key Concept

GLBA Consumer vs. Customer Privacy Notice Requirements
Estimated Time:1m 15s
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic