18.3 Privacy, Fraud, and Consumer Protection

Privacy: Gramm-Leach-Bliley Act (GLBA)

The Gramm-Leach-Bliley Act governs how financial institutions, including insurers and producers, handle a consumer's nonpublic personal information (NPI) — financial data not publicly available. GLBA imposes three duties:

• Notice — provide a clear initial privacy notice at the start of the relationship and an annual notice thereafter, describing what information is collected and shared.
• Opt-out — before disclosing NPI to a nonaffiliated third party, give the consumer a reasonable opportunity to opt out. (Sharing with affiliates or as needed to service the policy generally does not require opt-out.)
• Safeguards — maintain administrative, technical, and physical safeguards to protect the data.

The NAIC model splits NPI into financial information (GLBA-driven opt-out) and health information, which generally requires affirmative opt-in authorization before disclosure.

Fair Credit Reporting Act (FCRA) and Insurance Scoring

The Fair Credit Reporting Act governs use of consumer reports — including credit-based insurance scores and motor-vehicle/loss-history reports (e.g., CLUE) — in underwriting. Key duties:

• Permissible purpose — the insurer may pull a report only for legitimate underwriting.
• Adverse action notice — if the insurer declines, cancels, surcharges, or otherwise adversely affects coverage based wholly or partly on a report, it must notify the consumer and provide the name, address, and phone of the consumer reporting agency.
• Free dispute — the consumer may obtain a free copy of the report and dispute inaccuracies.

Adverse-action quick reference

Insurance Fraud and 18 U.S.C. 1033/1034

Insurance fraud is a knowing misrepresentation made to obtain a benefit not entitled to. The exam distinguishes:

• Soft (opportunistic) fraud — inflating or padding an otherwise legitimate claim, or shading an application to lower premium.
• Hard fraud — deliberately staging or causing a loss (arson, faked theft, staged collision) to collect.

Suspected fraud is referred to the insurer's Special Investigations Unit (SIU) and often to a state fraud bureau.

Federal prohibited-person bar

The Fraud and False Statements Act, 18 U.S.C. 1033/1034, makes it a federal crime for anyone convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance affecting interstate commerce — unless that person obtains written consent (a 1033 waiver) from the state insurance regulator. Section 1034 authorizes civil penalties and injunctions. This bar applies to producers, adjusters, and company employees alike.

Consumer-Protection Mechanics

Several protections exist so consumers buy and switch coverage with full information and without coercion:

• Free-look period — a window (commonly 10–30 days, set by state and line) to review a delivered policy and return it for a full premium refund, no questions asked.
• Replacement regulation — when replacing existing coverage, the producer must provide required comparison disclosures so the consumer can judge whether the switch is suitable; this is the consumer-protection backstop against twisting/churning.
• Disclosure of fees and surplus-lines status — service fees and placement with nonadmitted (surplus-lines) carriers must be disclosed because nonadmitted carriers are not backed by the state guaranty association.
• Guaranty association — protects policyholders if an admitted insurer becomes insolvent, up to statutory caps; producers may not use guaranty-fund protection as a sales inducement, which is itself a prohibited practice.

Telemarketing, CAN-SPAM, and Data-Breach Notice

Federal consumer-protection law also reaches insurance prospecting. The Telephone Consumer Protection Act (TCPA) and the federal Do-Not-Call Registry restrict unsolicited sales calls and autodialed/prerecorded messages; the CAN-SPAM Act governs commercial email, requiring a valid sender identity and a working opt-out (unsubscribe) mechanism. Violations carry per-call and per-email penalties.

Data-breach response

The NAIC Insurance Data Security Model Law (adopted in a growing number of states) requires licensees to maintain an information security program and to notify the commissioner of a cybersecurity event, often within 72 hours of determining one occurred. Affected consumers must also be notified under state breach statutes. The producer's privacy duties under GLBA, FCRA, the data-security model, and state breach law are cumulative, not alternatives — compliance with one does not excuse the others.

Putting it together

On the exam, map each fact pattern to its source: sharing financial data without opt-out is GLBA; surcharging on a credit score without notice is FCRA; a felon working without a waiver is 1033; an unsolicited robocall is TCPA; and padding a real claim is soft fraud.

Mapping a Fact Pattern to Its Statute

The privacy and consumer-protection portion rewards matching the scenario to the right law. Sharing a consumer's nonpublic financial information with a nonaffiliated third party without an opt-out is a GLBA issue; health information generally needs affirmative opt-in. Surcharging or declining coverage based on a credit-based insurance score without an adverse-action notice violates FCRA. A felon convicted of dishonesty working in insurance without a regulator's written waiver violates 18 U.S.C. 1033, and an unsolicited robocall implicates the TCPA and Do-Not-Call rules.

Soft Fraud, Hard Fraud, and Consumer Safeguards

Distinguish soft fraud - padding an otherwise legitimate claim or shading an application - from hard fraud, which is deliberately staging or causing a loss such as arson or a faked theft. Both are referred to the insurer's Special Investigations Unit and often a state fraud bureau. Consumer safeguards round out the topic: a free-look period (commonly 10 to 30 days) lets a buyer return a policy for a full refund, replacement regulations require comparison disclosures to deter twisting and churning, and the NAIC data-security model requires notifying the commissioner of a cybersecurity event, often within 72 hours.

These duties are cumulative, so satisfying one law does not excuse the others.