Examkin

Question

Difficulty: MediumGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

An independent insurance agency collects nonpublic personal information (NPI) to generate homeowners insurance proposals. Richard requests a quote from the agency but ultimately declines the offer and buys a policy from a different firm. A month later, the agency plans to sell Richard's contact and property details to an unaffiliated home security company for marketing purposes. Under the Gramm-Leach-Bliley Act (GLBA), which of the following correctly describes the agency's regulatory obligation regarding Richard?

  1. The agency must provide an initial privacy notice and a reasonable opportunity to opt out before disclosing his information.Answer
  2. B
    The agency is exempt from providing any privacy notices because Richard did not establish an ongoing customer relationship.
  3. C
    The agency must provide an initial privacy notice now, followed by annual privacy notices for as long as his file remains in their database.
  4. D
    The agency may share the data without notice as long as the third party signs a confidentiality agreement under the Safeguards Rule.

Answer

The agency must provide an initial privacy notice and a reasonable opportunity to opt out before disclosing his information.
The Gramm-Leach-Bliley Act (GLBA) distinguishes between a 'consumer' (someone who obtains a financial product or service for personal use, such as a quote) and a 'customer' (someone with an ongoing relationship, like an active policyholder). For a consumer, a financial institution is only required to give an initial privacy notice if it intends to disclose their nonpublic personal information (NPI) to nonaffiliated third parties. Since the agency plans to sell the consumer's data to an unaffiliated security company for marketing, it is legally required to provide the initial notice and an opportunity to opt out before any sharing occurs.

Step-by-Step Solution

1
Determine the individual's classification under the GLBA (Consumer vs. Customer).
Richard is classified as a 'consumer' because he only requested a quote and did not purchase a policy to establish an ongoing relationship.
The GLBA applies different notification rules based on whether the individual has an ongoing relationship with the financial institution.
2
Evaluate the agency's intended action with the individual's nonpublic personal information (NPI).
The agency intends to sell the NPI to an unaffiliated third party for marketing purposes, which does not fall under standard exceptions like policy servicing or fraud prevention.
Sharing NPI with nonaffiliated third parties for marketing triggers specific disclosure requirements under the Financial Privacy Rule.
3
Apply the GLBA notification rules for consumers.
The agency must provide an initial privacy notice and a clear, reasonable opportunity to opt out before the information can be shared.
Financial institutions are prohibited from disclosing a consumer's NPI to a nonaffiliated third party unless they first provide the necessary privacy notices and an opt-out mechanism.

Key Concept

Under the GLBA, individuals who engage in a one-time transaction (like requesting a quote) are consumers. If a financial institution wants to share a consumer's NPI with a nonaffiliated third party, it must provide an initial privacy notice and an opportunity to opt out.
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic