Examkin

Question

Difficulty: HardGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

An independent property and casualty insurance agency provides an auto insurance quote to David, who ultimately declines the offer. The same day, the agency issues a 12-month auto policy to Sarah. The agency's business model involves selling the Nonpublic Personal Information (NPI) of anyone who requests a quote to an unaffiliated third-party marketing firm that sells extended vehicle warranties. Under the Gramm-Leach-Bliley Act (GLBA), which of the following describes the agency's obligations regarding privacy notices for David and Sarah?

  1. The agency must provide both David and Sarah with an initial privacy notice and an opportunity to opt out before sharing their NPI, and must provide Sarah with an annual privacy notice for the duration of her policy.Answer
  2. B
    The agency is only required to provide an initial privacy notice and opt-out opportunity to Sarah because she established an ongoing customer relationship, whereas David is merely a consumer.
  3. C
    The agency must provide an initial privacy notice to Sarah at the time of the application, but must wait until the annual privacy notice is issued to both David and Sarah before allowing them to opt out of third-party sharing.
  4. D
    The agency must provide an initial privacy notice to Sarah, but cannot legally share David's NPI under any circumstances because he did not establish a formal customer relationship with the agency.

Answer

The agency must provide both individuals with an initial privacy notice and an opportunity to opt out before sharing their NPI, and must provide the policyholder with an annual privacy notice.
Under GLBA, establishing a customer relationship automatically triggers the requirement for an initial notice and subsequent annual notices. For consumers who do not establish an ongoing relationship, an initial notice is only required if their NPI will be shared with an unaffiliated third party. Because the agency plans to sell the data to an unaffiliated marketer, both individuals must receive the initial notice and the right to opt out before any sharing occurs. Only the individual with the active policy requires an ongoing annual notice.

Step-by-Step Solution

1
Identify the legal status of each individual under GLBA definitions.
David is a 'consumer' (involved in a one-time transaction by getting a quote) and Sarah is a 'customer' (has an ongoing relationship through an active policy).
GLBA applies different notification rules depending on whether an individual is a consumer or a customer.
2
Determine the trigger for an initial privacy notice.
A customer must always receive an initial notice. A consumer must receive an initial notice only if the institution intends to share their NPI with a nonaffiliated third party outside of standard regulatory exceptions.
This establishes who must receive the first disclosure.
3
Evaluate the agency's data-sharing intent against GLBA requirements.
Because the agency sells data to an unaffiliated marketing firm, the sharing falls outside standard exceptions. Therefore, both David and Sarah must receive an initial notice and a reasonable opportunity to opt out before any sharing occurs.
Institutions cannot share NPI with nonaffiliated third parties without first providing a notice and an opt-out right.
4
Determine annual privacy notice requirements.
Only Sarah will receive an annual privacy notice, as long as her policy remains active.
GLBA requires annual privacy notices only for customers with an ongoing relationship, not for consumers.

Key Concept

Under GLBA, initial privacy notices are always required for customers, but are only required for consumers if their NPI is being shared with nonaffiliated third parties. Opt-out opportunities must be provided before sharing occurs, and annual notices are exclusively for customers.
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic