Examkin

Question

Difficulty: Very hardGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

An independent property and casualty agency, Apex Risk Advisors, is updating its data-sharing practices. The agency gathers nonpublic personal information (NPI) from Marcus to provide a quote for personal auto insurance; however, Marcus declines the quote and does not purchase a policy. Separately, the agency issues a homeowner's policy to Sarah, who pays her premium and establishes an active account. Apex now intends to share the NPI collected from both individuals with an unaffiliated third-party marketing firm that sells home security systems. Under the Gramm-Leach-Bliley Act (GLBA), which of the following accurately describes the agency's obligations regarding privacy notices?

  1. Apex must provide an initial privacy notice and an opt-out opportunity to both individuals before sharing their data. Because Sarah has an ongoing relationship, she must also receive annual privacy notices, whereas Marcus requires no further notices.Answer
  2. B
    Because Marcus never purchased a policy, he is not considered a customer and his NPI cannot be legally shared with an unaffiliated third party under any circumstances; Sarah must receive an initial notice and an annual notice with opt-out provisions.
  3. C
    Both individuals are considered consumers who provided NPI that will be shared outside of permitted exceptions, meaning Apex must provide an initial privacy notice, an opt-out opportunity, and ongoing annual privacy notices to both Marcus and Sarah.
  4. D
    Apex must provide Sarah with an initial privacy notice no later than when her policy is issued, but Marcus only requires an initial privacy notice if he affirmatively requests a copy of the agency's privacy policy before his data is shared.

Answer

Apex must provide an initial privacy notice and an opt-out opportunity to both individuals before sharing their data. Because Sarah has an ongoing relationship, she must also receive annual privacy notices, whereas Marcus requires no further notices.
Under the Gramm-Leach-Bliley Act (GLBA), a 'consumer' is someone who engages in a single transaction (like Marcus getting a quote), while a 'customer' is someone who establishes a continuing relationship (like Sarah buying a policy). When a financial institution wants to share Nonpublic Personal Information (NPI) with a nonaffiliated third party, it must provide an initial privacy notice and a reasonable opportunity to opt out to both consumers and customers before the data is shared. However, only customers are legally entitled to receive ongoing annual privacy notices. Therefore, both Marcus and Sarah must receive the initial notice and opt-out right, but only Sarah receives the annual notices.

Step-by-Step Solution

1
Determine the legal status of Marcus under GLBA.
Marcus is a 'consumer' because he obtained a financial service (a quote) for personal use, but he did not establish a continuing relationship.
GLBA distinguishes between isolated transactions (consumers) and ongoing relationships (customers).
2
Determine the legal status of Sarah under GLBA.
Sarah is a 'customer' because she purchased a policy and established a continuing relationship with the agency.
Ongoing service of a policy elevates a consumer to customer status.
3
Analyze the agency's intent to share data with an unaffiliated third party.
Because Apex wants to share NPI with a nonaffiliated third party outside of standard regulatory exceptions, it triggers strict notice and opt-out mandates.
GLBA's Financial Privacy Rule strictly controls the sharing of NPI with nonaffiliated third parties.
4
Apply GLBA notice rules to both individuals based on their status.
Marcus (consumer) must receive an initial notice and an opt-out opportunity before sharing can occur. Sarah (customer) must receive an initial notice at the time the relationship is established, an opt-out opportunity before sharing, and subsequent annual notices.
Consumers only require an initial notice if sharing occurs. Customers require an initial notice upon relationship establishment and annual notices thereafter.

Key Concept

GLBA Consumer vs. Customer Distinctions and Privacy Notice Triggers
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic