Examkin

Question

Difficulty: HardGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

Vanguard Risk Solutions, an independent brokerage, collects detailed financial and health data from two individuals on the same day. Marcus requests a one-time term life insurance quote but ultimately decides not to purchase a policy. Vanguard does not share Marcus's data with any nonaffiliated third parties. Chloe purchases a disability income policy through Vanguard, establishing an ongoing service relationship. Vanguard intends to share Chloe's data with a nonaffiliated marketing firm. Under the Gramm-Leach-Bliley Act (GLBA), which of the following accurately describes Vanguard's privacy notice obligations?

  1. Chloe must receive an initial privacy notice and an opt-out opportunity when the relationship is established, and annual notices thereafter; Marcus does not require any privacy notice.Answer
  2. B
    Both Marcus and Chloe must receive an initial privacy notice upon providing their nonpublic personal information, but only Chloe requires an annual privacy notice.
  3. C
    Both Marcus and Chloe are classified as customers under the Act and must uniformly receive initial privacy notices, an opt-out opportunity, and annual privacy notices.
  4. D
    Chloe must receive an initial privacy notice when the policy is delivered, while Marcus must receive a short-form notice with an opt-out opportunity.

Answer

Chloe must receive an initial privacy notice and an opt-out opportunity when the relationship is established, and annual notices thereafter; Marcus does not require any privacy notice.
The GLBA Financial Privacy Rule distinguishes between a 'consumer' and a 'customer.' A consumer (Marcus) is someone who obtains a financial product or service for an isolated transaction, like getting a quote. A financial institution is only required to give a consumer an initial privacy notice if it intends to share their Nonpublic Personal Information (NPI) with nonaffiliated third parties. Since Vanguard does not share Marcus's data, he requires no notice. A customer (Chloe) has an ongoing relationship with the institution. Customers must automatically receive an initial privacy notice no later than when the relationship is established, as well as an annual notice every year the relationship continues. Because Chloe's data is shared with a nonaffiliated third party, she must also receive a clear opportunity to opt out.

Step-by-Step Solution

1
Determine Marcus's legal classification and the agency's obligations toward him under GLBA.
Marcus is a 'consumer' because he engaged in an isolated transaction (a quote). Because Vanguard does not share his Nonpublic Personal Information (NPI) with nonaffiliated third parties, no privacy notice is legally required.
GLBA only requires an initial notice for a consumer if the financial institution intends to share their NPI with a nonaffiliated third party outside of statutory exceptions.
2
Determine Chloe's legal classification and the agency's obligations toward her under GLBA.
Chloe is a 'customer' because purchasing a policy establishes an ongoing relationship. Vanguard must provide her with an initial privacy notice, an opt-out opportunity (due to sharing with a marketing firm), and annual privacy notices.
GLBA mandates that all customers automatically receive an initial privacy notice no later than when the customer relationship is established, followed by annual notices for the duration of the relationship.
3
Select the option that correctly reflects the distinct obligations for both the consumer (Marcus) and the customer (Chloe).
The correct statement notes that Chloe gets initial, opt-out, and annual notices, while Marcus requires no notice.
This accurately reflects the GLBA Financial Privacy Rule's dual-tier system for consumers versus customers.

Key Concept

GLBA Financial Privacy Rule: Consumer vs. Customer Status
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic