18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
- GLBA requires insurers to give privacy notices and let consumers opt out of sharing nonpublic personal information with nonaffiliated third parties.
- Under the FCRA, any adverse action based in whole or part on a consumer report requires an adverse action notice naming the reporting agency.
- 18 U.S.C. 1033 makes insurance fraud a federal crime and bars felons convicted of dishonesty from the business of insurance without a commissioner's written waiver.
- Free-look periods (often 10 days) and replacement disclosure rules protect consumers from rushed or deceptive policy replacement.
- Match each protection to its law: privacy to GLBA, credit/adverse action to FCRA, fraud bars to 18 U.S.C. 1033, replacement to state UTPA rules.
Federal Privacy Framework
Insurance is state-regulated, but several federal laws govern privacy and consumer protection. The two most tested are the Gramm-Leach-Bliley Act (GLBA) of 1999 and the Fair Credit Reporting Act (FCRA) of 1970.
GLBA requires financial institutions, including insurers, to protect the privacy of nonpublic personal information (NPI). It mandates an initial and annual privacy notice describing information-sharing practices and giving consumers the right to opt out of sharing NPI with nonaffiliated third parties. The NAIC model implements GLBA in insurance, distinguishing financial information from health information (which generally requires opt-in / affirmative consent to share).
FCRA, Adverse Action, and Consumer Reports
The Fair Credit Reporting Act governs the use of consumer reports (including credit-based insurance scores and MVRs) in underwriting. If an insurer takes an adverse action — declining, cancelling, or charging more — based in whole or part on a consumer report, it must give the applicant an adverse action notice identifying the reporting agency and the right to a free copy of the report and to dispute errors.
| Law | Scope | Consumer Right |
|---|---|---|
| GLBA | Privacy of NPI | Privacy notice + opt-out |
| FCRA | Consumer/credit reports | Adverse action notice |
| Fair Credit Reporting Act (investigative) | Interviews about character/reputation | Right to know nature/scope |
Trap: the adverse action notice is required even if the report was only partly the reason for the higher premium.
Insurance Fraud and the Fraud Acts
Insurance fraud is the intentional deception to obtain an unauthorized benefit. It runs both ways: claimant fraud (staged losses, inflated claims) and insurer/producer fraud (premium theft, fictitious policies, fraudulent claim denial).
The Fraud and False Statements Act, 18 U.S.C. 1033/1034, is a federal law tested on the national exam. It makes it a federal crime for anyone engaged in the business of insurance to commit fraud affecting interstate commerce. Critically, 18 U.S.C. 1033 bars any person convicted of a felony involving dishonesty or breach of trust from working in insurance without written consent (a 1033 waiver) from the state insurance commissioner. Penalties include fines and imprisonment up to 10 years (longer if the act jeopardizes a insurer's solvency).
Consumer Protection: Replacement, Free-Look, and Suitability
Several consumer-protection rules round out this section:
- Replacement regulations require disclosure forms and comparisons when replacing an existing policy, protecting the consumer from twisting/churning.
- A free-look period (commonly 10 days) lets a policyholder review a delivered policy and obtain a full refund if cancelled.
- Suitability and disclosure rules require the producer to recommend products appropriate to the client's needs and to deliver required outlines/notices.
The National Flood Insurance Program (NFIP) and other federal programs also carry their own notice requirements. On the exam, link each consumer right to its governing law: privacy to GLBA, credit/adverse action to FCRA, fraud bars to 18 U.S.C. 1033, and replacement protection to state UTPA replacement rules.
Reporting Fraud and the SIU
Most states require insurers to maintain a Special Investigations Unit (SIU) or anti-fraud plan and to report suspected fraud to the state fraud bureau, often within a set window. Producers and insurers generally enjoy qualified immunity from civil liability for good-faith fraud reports, which removes the deterrent of a defamation suit. The exam may frame this as: an insurer that suspects a staged auto theft must report it and may share the report with the fraud bureau without exposure, provided the report is made in good faith.
Fraud also has a direct rate impact. Insurers estimate that fraudulent and inflated claims add a measurable surcharge to honest policyholders' premiums, which is why anti-fraud warnings ("any person who knowingly files a false claim is guilty of a crime") appear on application and claim forms in most states.
Tying It Together for the Exam
The national ethics questions reward a clean mental map. GLBA = privacy of nonpublic personal information, with notice and opt-out (health data needs affirmative consent). FCRA = consumer reports and credit-based scores, triggering an adverse action notice whenever a report contributes to a decline or higher premium. 18 U.S.C. 1033/1034 = federal insurance-fraud crime and the felony-dishonesty bar with its commissioner waiver. State replacement and free-look rules guard against rushed or deceptive switching.
When a scenario blends facts — say, a credit-based decline plus a felony-applicant plus a privacy complaint — answer each on its own governing law rather than reaching for a single statute. That discipline is what separates a passing ethics score from a near-miss.
Penalties Under the Federal Fraud Statute
The penalties under 18 U.S.C. 1033 scale with the harm. A general false statement or embezzlement affecting the business of insurance carries fines and up to 10 years imprisonment. If the conduct jeopardizes the safety and soundness of an insurer and was a significant cause of insolvency, the maximum rises to 15 years. Threatening or using force against someone for providing information to regulators is also a federal offense under the statute.
The 1033 waiver is heavily tested: a person convicted of any felony involving dishonesty or breach of trust is prohibited from the business of insurance unless the state insurance commissioner grants written consent. Disclosure on a license application, the passage of time, or completing a sentence does not by itself restore eligibility — only the written waiver does. Insurers that knowingly employ a barred person without a waiver face their own liability.
An insurer charges a higher auto premium based partly on the applicant's credit-based insurance score. Under the FCRA, the insurer must:
A person convicted of felony embezzlement wants to work for an insurance agency. Under 18 U.S.C. 1033, this person may work in insurance only if they: