18.3 Privacy, Fraud, and Consumer Protection

The Privacy Framework

Two federal/model layers are tested. The Gramm-Leach-Bliley Act (GLBA) requires financial institutions, including insurers and agencies, to deliver privacy notices describing information-sharing and to give consumers an opt-out of certain sharing with nonaffiliated third parties. The NAIC built on this with privacy model regulations.

Distinguish two categories the exam loves:

• Nonpublic personal financial information (NPI) — opt-OUT applies; the consumer is sharing-eligible unless they opt out.
• Nonpublic personal health information — generally opt-IN; the insurer needs authorization before disclosure.

A privacy notice must go out at the time the relationship is established and annually thereafter, with limited modern exceptions when sharing practices have not changed and the consumer has not opted out.

Watch the consumer-versus-customer distinction. A consumer has a one-time interaction (an applicant who does not buy); a customer has an ongoing relationship and is owed the initial and annual notices. Both get the opt-out right before NPI is shared with nonaffiliated third parties, except where an exception (servicing, joint marketing under contract, legally required disclosures) removes the opt-out entirely.

Other Consumer-Information Statutes

Adverse action trap: if an insurer raises a premium or declines coverage based even in part on a consumer report (including a credit-based insurance score where permitted), it must notify the applicant and disclose the source so the consumer can dispute errors.

Insurance Fraud and Anti-Fraud Statutes

Fraud is a knowing misrepresentation of a material fact to obtain a benefit or payment. It runs both directions:

• Claimant/insured fraud — staged losses, inflated claims, false applications.
• Producer/insurer fraud — fictitious policies, premium theft, fake claims, fronting unlicensed entities.

Key federal exposure: under 18 U.S.C. 1033/1034, it is a federal crime for anyone convicted of a felony involving dishonesty or breach of trust to work in the business of insurance without written 1033 consent from the state regulator. The exam frequently tests that a prior dishonesty felony bars insurance employment absent that waiver. Materiality is the lynchpin: a misstatement that would have changed the underwriting or claim decision is material; a trivial inaccuracy generally is not.

Consumer Protection: Disclosures, Free-Look, and Replacement

Consumer-protection rules cluster around transparency and time to reconsider:

• Buyer's guides and disclosure statements must be delivered for certain products so consumers can compare.
• Replacement regulations require notices and, often, a side-by-side comparison so a consumer is not churned/twisted into an inferior policy.
• Free-look / right-to-examine periods (commonly 10-30 days, product-dependent) let a buyer return a policy for a full refund.
• Complaint records and market-conduct exams let regulators detect patterns; a high complaint ratio invites a market-conduct examination.

The through-line with 18.1: privacy, FCRA adverse-action, and fraud rules all exist to protect the consumer's information and the integrity of the transaction, and violations feed into the same disciplinary machinery as unfair trade practices.

Worked Example: Complaint Ratio Triggers an Exam

Market-conduct oversight is data-driven. Suppose an insurer wrote 20,000 policies in a state and the department logged 80 justified complaints for the year. The complaint ratio is 80 / 20,000 = 0.4%, or 4 complaints per 1,000 policies. If the statewide norm for that line is roughly 1 per 1,000, this carrier is running about four times the expected rate.

That outlier ratio is exactly what triggers a market-conduct examination, where the regulator samples claim files and sales records looking for a general business practice (tying back to 18.1). A single complaint proves little; a sustained, above-norm ratio signals a pattern. Producers should know that their own complaint history rolls up into these numbers and that responsiveness to complaints is itself a regulated behavior.

Anti-Fraud Programs and Reporting Duties

Most states require insurers to maintain a special investigations unit (SIU) or anti-fraud plan and to place a fraud warning on applications and claim forms (the statement that knowingly providing false information is a crime). Producers and adjusters who suspect fraud generally have a duty to report it to the state fraud bureau, and these reports usually carry immunity from civil liability when made in good faith, so the producer is protected for reporting a suspected staged loss.

Distinguish the two consequences of a false statement. On an application, a material misrepresentation can let the insurer rescind the policy (treat it as void from inception) within the contestable framework. On a claim, the concealment or fraud condition lets the insurer void coverage for that loss. A homeowner who inflates a genuine $8,000 theft claim to $20,000 risks losing the entire claim, not just the padded portion, under the fraud condition.

Materiality remains the hinge: would the truth have changed the underwriting or the claim decision? If yes, it is material; if it is trivial, the remedy generally does not reach rescission or voiding.