Examkin

Question

Difficulty: HardGramm-Leach-Bliley Act (GLBA) and Consumer Privacy

Meridian Insurance Partners, an independent brokerage, offers a 'Quick-Rate' online tool. Individuals input their medical history, income range, and Social Security number to receive a preliminary life insurance quote. The transaction ends there for most individuals. However, a portion of these individuals subsequently finalize a policy purchase through a Meridian producer, who will service the policy continuously. Meridian intends to share the data collected from the online tool with an unaffiliated tax-preparation service for cross-marketing purposes.

According to the Gramm-Leach-Bliley Act (GLBA) regarding Nonpublic Personal Information (NPI), which of the following statements are correct? (Select all that apply)

  1. Meridian must provide an initial privacy notice and an opt-out opportunity to the individuals who only receive a quote before disclosing their data to the tax service.Answer
  2. Meridian must provide an initial privacy notice to the individuals who finalize a policy purchase no later than when the continuing relationship is established, regardless of its sharing practices.Answer
  3. C
    Meridian must deliver an annual privacy notice to all individuals who utilized the online tool, regardless of whether they finalized a policy purchase.
  4. D
    Meridian is legally prohibited from sharing the collected data with the unaffiliated tax service under any circumstances, even if a clear opt-out opportunity is provided.

Answer

The correct statements are that Meridian must provide notice and opt-out to quote-only consumers before sharing data, and must provide an initial notice to policy purchasers upon establishing the relationship regardless of sharing practices.
Under GLBA, a 'consumer' completes a one-time transaction, while a 'customer' has an ongoing relationship. Consumers only require an initial privacy notice and opt-out opportunity if their NPI is being shared with nonaffiliated third parties. Customers, however, must receive an initial privacy notice when the relationship begins, regardless of the agency's sharing practices. The correct options accurately apply these rules to the quote-only individuals and the policy purchasers.

Step-by-Step Solution

1
Classify the individuals interacting with the agency.
Quote-only individuals are 'consumers' (one-time transaction). Policy purchasers are 'customers' (ongoing relationship).
GLBA requirements differ significantly between consumers and customers.
2
Determine the notice requirements for the 'consumers' in this specific scenario.
Because Meridian intends to share their NPI with an unaffiliated third party, they must be given an initial privacy notice and an opportunity to opt out prior to the disclosure.
Consumers only require a privacy notice if their data is being shared outside of standard exceptions.
3
Determine the notice requirements for the 'customers'.
Customers must receive an initial privacy notice when the continuing relationship is established, plus annual notices thereafter.
Customer status automatically triggers the requirement for initial and annual privacy notices, regardless of the agency's sharing intent.
4
Evaluate the distractors regarding annual notices and data sharing prohibitions.
Annual notices are not required for one-time consumers. Furthermore, sharing NPI is not strictly prohibited; it is permitted if the opt-out mandate is satisfied.
This confirms the incorrect options.

Key Concept

GLBA Consumer vs. Customer Distinction and Privacy Notice Triggers
Rate this question

Topics

Gramm-Leach-Bliley Act (GLBA) and Consumer Privacy

More questions from this topic