Examkin

Question

Difficulty: MediumGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

Vanguard InsureTech, an independent agency, is reviewing its data handling protocols to ensure compliance with federal privacy standards. Under the Gramm-Leach-Bliley Act (GLBA), which of the following practices regarding Nonpublic Personal Information (NPI) are legally compliant? Select all that apply.

  1. Delivering an initial privacy notice to a new policyholder no later than when the customer relationship is formally established.Answer
  2. Disclosing an applicant's health data to an unaffiliated medical laboratory for underwriting purposes without an opt-out option, under a strict confidentiality agreement.Answer
  3. C
    Mailing an annual privacy notice to an individual who only requested a single rate quote three years ago and never purchased a policy.
  4. D
    Selling a list of policyholders' contact information to an outside marketing firm without providing the policyholders a reasonable opportunity to opt out.

Answer

The compliant practices are delivering an initial privacy notice when a customer relationship is established and sharing underwriting data with an unaffiliated laboratory under a confidentiality agreement without an opt-out.
Under the Gramm-Leach-Bliley Act (GLBA), insurance agencies must provide an initial privacy notice when an ongoing 'customer' relationship is established. Furthermore, while the law generally requires an opt-out opportunity before sharing NPI with nonaffiliated third parties, there is a clear statutory exception for sharing information necessary to effect, administer, or enforce a transaction requested by the consumer (such as underwriting), as long as confidentiality agreements are maintained.

Step-by-Step Solution

1
Evaluate the requirement for initial and annual privacy notices based on the distinction between a 'consumer' and a 'customer'.
Initial notices are required when a customer relationship is established. Annual notices are only required for ongoing 'customers', not for one-time 'consumers' (like someone who only gets a quote).
GLBA specifically defines notice timing based on the depth of the financial relationship.
2
Evaluate the rules surrounding the opt-out requirement for sharing NPI with nonaffiliated third parties.
Opt-out opportunities are mandatory before sharing NPI with third-party marketers, but sharing data to process or service the actual insurance transaction (like underwriting) is exempt from the opt-out requirement.
The law balances consumer privacy with the practical necessity of processing insurance applications and claims.

Key Concept

GLBA Notice Requirements and Opt-Out Exceptions
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic