18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
- GLBA/NAIC privacy: nonpublic personal FINANCIAL info is opt-OUT, while nonpublic personal HEALTH info is opt-IN (affirmative authorization).
- FCRA requires an adverse-action notice naming the reporting agency whenever a consumer/credit report drives a declination or higher premium.
- 18 U.S.C. 1033 bars anyone convicted of a felony of dishonesty from the insurance business without a written 1033 waiver from the regulator.
- Material misrepresentation — a false statement that would have changed underwriting — can support policy rescission; immaterial errors cannot.
- Good-faith fraud reporting to the state fraud bureau is typically protected by statutory immunity.
Privacy: Three Overlapping Frameworks
The national exam tests three privacy regimes that interact:
- Gramm-Leach-Bliley Act (GLBA, 1999) — federal law requiring financial institutions (including insurers/producers) to give an initial and annual privacy notice and to let consumers opt out of certain sharing of nonpublic personal information (NPI) with nonaffiliated third parties.
- NAIC privacy model regulations — state adoptions that split data into nonpublic personal financial information and nonpublic personal health information. Health information generally requires opt-in (affirmative) authorization before disclosure, a stricter standard than the financial opt-out.
- Fair Credit Reporting Act (FCRA, 1970) — governs use of consumer/credit reports and investigative consumer reports in underwriting.
The core trap: financial info = opt-OUT; health info = opt-IN. Mixing those two is the single most-missed privacy point.
FCRA in Underwriting
When an insurer uses a consumer report (including a credit-based insurance score) and takes an adverse action — declination, higher premium, or less favorable terms — FCRA requires an adverse action notice telling the applicant the action was based partly on the report and identifying the consumer reporting agency, so the applicant can request a free copy and dispute errors.
For an investigative consumer report (information gathered through interviews with neighbors/associates about character and reputation), the applicant must be notified in writing within 3 days of the report being ordered and may request disclosure of the nature and scope of the investigation.
NPI, Affiliates, and Permitted Sharing
Nonpublic personal information (NPI) is information a consumer provides to obtain insurance, plus information from a transaction or a consumer report, that is not publicly available. Privacy rules distinguish sharing with affiliates (looser) from nonaffiliated third parties (the opt-out trigger).
Important exceptions where no opt-out is required: sharing necessary to service or administer the policy, to process a claim, to comply with law or regulatory exams, or with a service provider under a confidentiality agreement. The trap distractor offers an opt-out where one of these exceptions actually applies, or claims an exception when the purpose is plainly marketing to outsiders, which does require opt-out (financial) or opt-in (health).
An insurer wants to disclose an applicant's nonpublic personal HEALTH information to a nonaffiliated marketing partner. Under the NAIC privacy model, the insurer generally must:
Insurance Fraud
Fraud is intentional deception for unlawful gain and can be committed by insureds/claimants (staged losses, inflated claims, false applications) or by insurers/producers (premium theft, fictitious policies, embezzlement). Two concepts the exam tests:
| Concept | Meaning |
|---|---|
| Soft fraud | Opportunistic padding of an otherwise legitimate claim (e.g., adding undamaged items) |
| Hard fraud | Deliberately staging or fabricating a loss that never occurred |
| Material misrepresentation | A false statement on an application that, if known, would have changed the underwriting decision |
The Fraud and False Statements federal statute (18 U.S.C. 1033/1034) makes it a federal crime for someone who has been convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance without written consent (1033 waiver) from the regulator. The exam ties this to license eligibility.
A producer was previously convicted of a felony involving dishonesty. Under federal 18 U.S.C. 1033, she may work in the business of insurance only if she:
Material Misrepresentation and Rescission
If an applicant makes a material misrepresentation on the application, the insurer may have grounds to rescind the policy (void it as if never issued) and return premium — typically only within a contestability framework and based on facts that would have changed underwriting.
Worked example: An applicant states zero prior losses; the insurer later finds two large fire claims that, if disclosed, would have caused a decline. Because the misrepresentation was material (it would have changed the decision), the insurer may rescind. Contrast an immaterial error — a misspelled middle name — which does not support rescission. The exam hinges every rescission question on materiality.
Fraud Detection and the SIU
Most insurers operate a Special Investigations Unit (SIU) that reviews claims showing fraud indicators ("red flags"): a loss soon after coverage begins, an over-insured or recently increased limit, reluctance to provide documents, or losses with no police/medical corroboration.
State anti-fraud statutes commonly require insurers to report suspected fraud to the state fraud bureau and grant civil immunity for reports made in good faith without malice. The exam pairing to remember: a good-faith referral that later proves unfounded is protected, but a knowingly false fraud accusation made with malice forfeits that immunity and can itself expose the insurer to liability.
Concealment, Warranty, and Representation
The exam separates three application-statement concepts that drive coverage disputes:
| Term | Meaning | Effect when breached |
|---|---|---|
| Representation | A statement believed true when made | Voids only if material and false |
| Concealment | Deliberate failure to disclose a known material fact | Can void the policy |
| Warranty | A statement guaranteed to be literally true | Strict — even a minor breach can void |
Most personal-lines applications are treated as representations, so materiality governs. Property warranties (e.g., a protective-safeguards endorsement promising a sprinkler stays operational) are held to the stricter warranty standard, where the exam expects a literal-compliance answer.
Consumer Protection and Reporting
Consumer protection wraps these rules together:
- Privacy notices and opt-out/opt-in rights give consumers control over their data.
- FCRA adverse-action notices let applicants correct erroneous reports.
- Anti-fraud divisions and mandatory fraud-reporting statutes require insurers (and sometimes producers) to report suspected fraud to the state fraud bureau, often with immunity for good-faith reports.
- Free-look periods, clear disclosures, and complaint procedures through the state insurance department protect buyers after the sale.
Traps to avoid: confusing opt-out (financial) with opt-in (health); assuming a felon can sell insurance after merely waiting; treating a representation like a warranty; and assuming any application error supports rescission when only material ones do.