Examkin

Question

Difficulty: HardGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

Sterling Heritage Insurance Group, an independent personal lines agency, collects Nonpublic Personal Information (NPI) during its daily operations. Consider two individuals who interacted with the agency recently:

1. Arthur requested a quote for a personal umbrella policy, provided his financial details, but ultimately purchased coverage elsewhere.
2. Diana purchased a personal watercraft policy through Sterling Heritage, and the agency continues to service her active account.

The agency plans to sell its contact lists and related NPI to a nonaffiliated telecommunications company for independent marketing campaigns. Under the Gramm-Leach-Bliley Act (GLBA), which of the following accurately describes the agency's compliance requirements before sharing this data?

  1. The agency must provide an initial privacy notice and a reasonable opportunity to opt out to both Arthur and Diana; however, only Diana is required to receive annual privacy notices moving forward.Answer
  2. B
    The agency must provide an initial privacy notice, an opt-out opportunity, and annual notices to Diana because she is a customer, but it has no GLBA obligations toward Arthur because a formal business relationship was never established.
  3. C
    The agency must provide an initial privacy notice and an annual privacy notice to both Arthur and Diana, along with a mandatory opt-out opportunity, because both individuals submitted NPI for personal, family, or household purposes.
  4. D
    The agency is strictly prohibited from sharing Arthur's NPI because he is a consumer who did not complete a transaction, but it may share Diana's NPI provided she receives an initial privacy notice and an opt-out opportunity.

Answer

The agency must provide an initial privacy notice and a reasonable opportunity to opt out to both Arthur and Diana; however, only Diana is required to receive annual privacy notices moving forward.
Under the GLBA, Arthur is classified as a consumer (one-time transaction), and Diana is a customer (ongoing relationship). An agency is generally not required to provide an initial privacy notice to a consumer UNLESS it intends to share their NPI with a nonaffiliated third party outside of standard exceptions. Because the agency plans to sell the data to a telecom company, it must provide an initial notice and an opt-out opportunity to Arthur before sharing. As a customer, Diana automatically requires an initial notice when the relationship is established, the opt-out right for the sharing, AND ongoing annual privacy notices. Therefore, both need the initial notice and opt-out, but only Diana needs the annual notice.

Step-by-Step Solution

1
Identify the GLBA classification for each individual based on their relationship with the agency.
Arthur is a 'consumer' (one-time interaction for a quote), while Diana is a 'customer' (ongoing service relationship).
GLBA applies different notice requirements depending on whether the individual is a consumer or a customer.
2
Determine the trigger for initial privacy notices and opt-out rights.
Because the agency is sharing NPI with a nonaffiliated third party (the telecom company) outside of standard business exceptions, it must provide an initial notice and opt-out right to anyone whose data is shared, regardless of whether they are a consumer or customer.
GLBA mandates that NPI cannot be shared with nonaffiliated third parties unless the individual is given notice and a chance to opt out.
3
Determine the requirement for annual privacy notices.
Only Diana must receive annual privacy notices. Arthur does not.
GLBA requires annual privacy notices only for customers with an ongoing relationship, not for consumers.

Key Concept

Gramm-Leach-Bliley Act (GLBA) Consumer vs. Customer Definitions and Notice Requirements
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic