18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
- The Gramm-Leach-Bliley Act (GLBA) requires insurers to give privacy notices and an opt-out before sharing nonpublic personal information with nonaffiliated third parties.
- The Fair Credit Reporting Act (FCRA) governs use of consumer reports and credit-based insurance scores, requiring adverse-action notices when a report leads to a declination, higher rate, or nonrenewal.
- Insurance fraud can be committed by applicants, insureds, claimants, producers, or insurers, and the federal 18 U.S.C. 1033 bars a person convicted of a felony involving dishonesty from the business of insurance without the commissioner's written consent.
- Soft fraud (padding a legitimate claim) and hard fraud (staging or fabricating a loss) are both crimes; most states require fraud-warning statements on applications and claim forms.
- Consumer protections include guaranty associations, free-look periods, complaint handling, and the NAIC Insurance Information and Privacy Protection Act safeguards.
Financial Privacy: The Gramm-Leach-Bliley Act
The Gramm-Leach-Bliley Act (GLBA) of 1999 governs how financial institutions, including insurers and producers, handle a consumer's nonpublic personal information (NPI)—data such as Social Security number, financial account details, claims history, and health information collected in the course of business.
GLBA imposes three core obligations:
- Privacy notice — give consumers a clear notice of information-sharing practices at the start of the relationship and annually thereafter.
- Opt-out right — before sharing NPI with nonaffiliated third parties, give the consumer a reasonable chance to opt out (with limited exceptions, such as servicing the policy).
- Safeguards — maintain administrative, technical, and physical safeguards to protect the data.
Exam Key: Opt-out is required for sharing with nonaffiliated parties. Sharing with affiliates and sharing needed to service or administer the policy generally does not require opt-out.
Many states layer the NAIC Insurance Information and Privacy Protection Act (IIPPA) on top, adding rules on the collection, use, and disclosure of personal data and giving consumers a right to access and correct their records. Health information receives heightened, opt-in treatment in many states.
Consumer Reports: The Fair Credit Reporting Act
The Fair Credit Reporting Act (FCRA) governs the use of consumer reports and credit-based insurance scores in underwriting and rating. When information in a consumer or credit report results in an adverse action—a declination, a higher premium, or a nonrenewal—the insurer must send an adverse-action notice telling the consumer of the action, identifying the reporting agency, and explaining the right to a free copy of the report and to dispute inaccuracies.
An insurer wants to share a policyholder's nonpublic personal information with an unrelated marketing company. Under the Gramm-Leach-Bliley Act, what must it do first?
Insurance Fraud
Insurance fraud is intentional deception to obtain an unfair benefit. It is not limited to consumers—it can be committed by applicants, insureds, claimants, producers, or insurers. The exam distinguishes two degrees:
| Type | Description | Example |
|---|---|---|
| Soft fraud | Padding or exaggerating an otherwise legitimate claim | Inflating a real theft loss from $4,000 to $7,000 |
| Hard fraud | Deliberately staging, faking, or causing a loss | Arson to collect a fire policy |
Most states require a fraud-warning statement on applications and claim forms—language warning that knowingly filing false information is a crime. States operate insurance fraud bureaus, and insurers maintain Special Investigation Units (SIUs) to detect and refer suspected fraud.
The Federal 18 U.S.C. 1033/1034 Bar
Federal law 18 U.S.C. 1033 makes it a federal crime for a person convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance affecting interstate commerce without the written consent of a state insurance commissioner (a 1033 waiver). There is no time limit on the disqualifying felony and no automatic cure. Base penalties reach up to 5 years in federal prison, rising for conduct that jeopardizes an insurer's safety and soundness.
The cost of fraud is borne by honest policyholders through higher premiums, which is why detection is a shared duty. Producers must never assist a client in misstating an application (a fraud the producer helps commit) and must refer suspected claim fraud to the insurer's SIU rather than ignore it. Knowingly submitting a false application or claim, or helping another do so, is itself a violation that can end a producer's career.
A claimant suffers a real $3,000 water-damage loss but submits a claim for $6,000 by listing items that were never damaged. This is best described as:
Telemarketing, CAN-SPAM, and Do-Not-Call
Privacy law reaches marketing channels too. The federal Telephone Consumer Protection Act (TCPA) and the National Do-Not-Call Registry restrict unsolicited sales calls, and the CAN-SPAM Act governs commercial email by requiring a working opt-out and accurate sender information. A producer who cold-calls numbers on the registry or sends marketing email without an unsubscribe link risks federal penalties separate from state insurance law. Treat consumer contact data as regulated information, not a free prospecting list.
Consumer Protection Backstops
Beyond privacy and fraud rules, several mechanisms protect policyholders directly:
- Guaranty associations — state funds that pay covered claims (up to statutory limits) when an admitted insurer becomes insolvent; surplus-lines (nonadmitted) policies are not protected.
- Free-look / examination periods — a window to review a new policy and cancel for a full refund.
- Complaint handling — the state insurance department investigates and mediates consumer complaints, and a pattern of complaints can trigger a market-conduct exam.
- Readability and required-provision standards — forms must be understandable and contain mandated provisions.
Worked Example: Adverse-Action Notice
An applicant's credit-based insurance score places her in the insurer's least-favorable tier, raising her annual auto premium from a base of $1,100 to $1,540—a 40% surcharge driven by the report. Because the consumer report caused a less-favorable rate, FCRA requires the insurer to send an adverse-action notice naming the reporting agency and explaining her right to a free copy and to dispute errors. Failing to send it is an FCRA violation even though coverage was issued.
Common Exam Traps
- GLBA opt-out applies to nonaffiliated sharing; servicing the policy and affiliate sharing are treated differently.
- FCRA adverse-action notice is required when a report drives a declination, higher rate, or nonrenewal.
- Fraud can be committed by the insurer too, not just claimants.
- The 1033 waiver comes from the commissioner, not the NAIC, and the disqualifying felony has no time limit.
- Guaranty associations do not cover surplus-lines (nonadmitted) insurers.