Examkin

Question

Difficulty: HardGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

Marcus, an independent producer, receives a request from Elena for a commercial liability policy quote. To obtain competitive rates, Marcus collects Elena's Nonpublic Personal Information (NPI) and plans to submit it to three different nonaffiliated wholesale brokers. Additionally, Marcus intends to share Elena's contact information with a local accounting firm for cross-marketing purposes. Elena has not yet decided whether to purchase a policy. Based on the Gramm-Leach-Bliley Act (GLBA), which of the following statements correctly identifies Marcus's obligations regarding Elena's NPI?

  1. A
    He is exempt from providing any privacy notice or opt-out opportunity until she formally purchases a policy and transitions from a consumer to a customer.
  2. B
    He must provide an initial privacy notice and secure her affirmative written consent before disclosing her information to either the wholesale brokers or the accounting firm.
  3. He must provide an initial privacy notice and an opt-out opportunity before sharing data with the accounting firm, but he may share data with the wholesale brokers without providing an opt-out opportunity.Answer
  4. D
    He must provide an initial privacy notice before obtaining quotes from the wholesale brokers, because any disclosure to a nonaffiliated third party automatically triggers the notice requirement.

Answer

He must provide an initial privacy notice and an opt-out opportunity before sharing data with the accounting firm, but he may share data with the wholesale brokers without providing an opt-out opportunity.
The correct answer accurately synthesizes three critical GLBA components. First, Elena is a consumer. Second, a consumer only must receive a privacy notice if NPI is shared outside of exceptions. Third, obtaining a quote from wholesale brokers is an exempt disclosure (effectuating a requested transaction), whereas sharing data with an accounting firm for cross-marketing is non-exempt, triggering the mandatory initial notice and opt-out provision.

Step-by-Step Solution

1
Determine Elena's GLBA classification.
Elena is a 'consumer' because she is seeking a quote and has not yet established an ongoing relationship.
GLBA rules distinguish between consumers (one-time transactions or quotes) and customers (ongoing relationships).
2
Analyze the privacy notice requirements for consumers.
A financial institution is only required to give an initial privacy notice to a consumer if it plans to disclose NPI outside of specific statutory exceptions.
Consumers do not automatically receive notices unless their data will be shared with nonaffiliated third parties for non-exempt purposes.
3
Evaluate the planned disclosures against GLBA exceptions.
Sharing with wholesale brokers to get a quote is an exception (processing a requested transaction). Sharing with the accounting firm for marketing is NOT an exception.
GLBA allows necessary data sharing to fulfill the consumer's request without offering an opt-out, but strictly controls sharing for external marketing.
4
Synthesize the producer's obligations.
Marcus must provide the initial notice and opt-out opportunity solely because of the planned disclosure to the accounting firm.
This aligns the statutory requirements for consumers, opt-out mandates, and transaction exceptions.

Key Concept

GLBA Notice Requirements for Consumers vs. Customers and Statutory Exceptions
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic