18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
Gramm-Leach-Bliley (GLBA) requires insurers to give a PRIVACY NOTICE and an OPT-OUT before sharing nonpublic personal financial information with nonaffiliated third parties.
The Fair Credit Reporting Act (FCRA) requires ADVERSE ACTION notice when an insurance decision is based on a consumer/credit report, naming the reporting agency.
The Fraud and False Statements provision (18 U.S.C. 1033/1034) bars anyone convicted of a felony involving DISHONESTY from the insurance business without 1033 written consent.
Insurance fraud includes SOFT fraud (padding a legitimate claim) and HARD fraud (staging or fabricating a loss); both are crimes and reportable to the state fraud bureau.
Producers must protect nonpublic information, follow do-not-call and CAN-SPAM rules, and report suspected fraud rather than participate in it.
Privacy: Gramm-Leach-Bliley Act (GLBA)
The federal Gramm-Leach-Bliley Act (1999) sets the baseline for how financial institutions, including insurers and agencies, treat nonpublic personal information (NPI). NPI is information a consumer gives to obtain a product—application data, account numbers, health and financial details.
GLBA requires three things on the exam:
- Privacy notice — given at the start of the relationship and annually thereafter, describing what information is collected and shared.
- Opt-out right — before sharing NPI with a nonaffiliated third party for marketing, the insurer must give the consumer a reasonable opportunity to opt out.
- Safeguards — reasonable administrative, technical, and physical security to protect the data.
Exam Key: GLBA protects FINANCIAL NPI and gives an OPT-OUT for sharing with NONAFFILIATED third parties. Sharing with affiliates and for servicing the policy generally does not require opt-out.
Using Credit and Consumer Reports: FCRA
The Fair Credit Reporting Act (FCRA) governs consumer reports (including insurance credit scores). If an insurer takes an adverse action—declining, canceling, or charging a higher rate based on a consumer/credit report—it must send an adverse action notice that:
- States that the action was based in whole or part on the report,
- Names the consumer reporting agency that supplied it, and
- Tells the consumer of the right to a free copy and to dispute inaccurate information.
| Law | Protects | Key Trigger |
|---|---|---|
| GLBA | Nonpublic personal financial info | Sharing with nonaffiliated third party → opt-out |
| FCRA | Consumer/credit report accuracy | Adverse action based on report → notice |
| HIPAA | Protected health information | Use/disclosure of medical info |
Fraud and False Statements: 18 U.S.C. 1033 & 1034
Federal law 18 U.S.C. 1033/1034 makes it a crime to engage in deceptive acts affecting insurance in interstate commerce. The most-tested clause: a person convicted of a felony involving dishonesty or breach of trust may not work in the insurance business unless they obtain written consent (a "1033 waiver") from the state insurance regulator. Knowingly employing such a person without consent is itself a violation.
Insurance Fraud: Hard vs. Soft
Insurance fraud is a crime committed by applicants, insureds, producers, or even insurers.
- Soft fraud (opportunistic) — padding an otherwise legitimate claim, e.g., adding a stolen TV that never existed to a real burglary claim, or shading an application to lower the premium.
- Hard fraud (premeditated) — fabricating or staging an entire loss, e.g., arson-for-profit or a staged auto collision.
Both are illegal. A worked distinction the exam favors:
Real kitchen fire, actual damage: $8,000
Claim filed by insured: $12,000 (added fake items)
Soft fraud (padding): $4,000 inflated portion
No fire at all; barn deliberately burned
for the $80,000 policy proceeds -> HARD fraud (staged loss)
Most states require insurers to maintain an anti-fraud plan and to report suspected fraud to the state's fraud bureau, often with immunity for good-faith reports. Producers must report suspected fraud, not abet it—submitting a knowingly false application is fraud by the producer.
Consumer Protection Touchpoints
Producers also operate under marketing and communication rules:
- Do-Not-Call Registry / TCPA — no telemarketing to registered numbers absent an existing relationship.
- CAN-SPAM — commercial email must allow opt-out and identify the sender.
- Replacement regulations — special disclosure and comparison forms when replacing existing coverage (ties back to twisting/churning).
- Free-look and disclosure requirements that give consumers time and information to make an informed choice.
The theme across these laws is consistent: protect the consumer's information and money, disclose honestly, and report (never commit) fraud.
Affiliated vs. Nonaffiliated Sharing Under GLBA
The GLBA opt-out is narrower than students assume. An insurer may share NPI without an opt-out for ordinary servicing—issuing the policy, processing claims, reinsurance, fraud prevention, and responding to a subpoena. The opt-out matters only when NPI is disclosed to a nonaffiliated third party for that party's own marketing. Sharing among affiliates (companies under common control) is governed mainly by the FCRA affiliate-sharing rules, not the GLBA opt-out.
| Disclosure | Opt-out needed? |
|---|---|
| To process the insured's own claim | No |
| To a reinsurer or service vendor | No |
| To a nonaffiliated marketer | Yes |
| To an affiliate for marketing | FCRA opt-out, not GLBA |
State Privacy and the NAIC Models
Most states adopt the NAIC Privacy of Consumer Financial and Health Information Regulation, which layers health-information opt-IN on top of GLBA. For NPI that is health information, many states require affirmative consent (opt-in) before disclosure—stricter than the financial opt-out. The newer NAIC Insurance Data Security Model Law adds breach-notification and written information-security-program duties for licensees.
Exam Key: Financial NPI = OPT-OUT (consumer must act to stop sharing). Health NPI under many state rules = OPT-IN (insurer needs consent first). Affiliate marketing sharing is an FCRA opt-out, not GLBA.
The Producer's Anti-Fraud Duties
Producers are the front line against fraud. Practical duties tested on the exam:
- Verify the applicant's identity and the accuracy of application answers; do not coach an applicant to omit a material fact to lower the premium.
- Report suspected fraud to the insurer's special investigations unit (SIU) or the state fraud bureau; good-faith reports usually carry statutory immunity from defamation suits.
- Never submit a claim or application the producer knows to be false—doing so is the producer's own hard fraud and is criminal.
- Include the required fraud-warning statement on applications and claim forms where the state mandates it.
A producer who participates in even "minor" soft fraud—agreeing to inflate a real claim by a few hundred dollars—commits a crime and faces license revocation plus exposure under 18 U.S.C. 1033. The safe, ethical, and tested answer is always: protect the data, disclose honestly, and report rather than abet.
An insurer declines an applicant for auto coverage based partly on the applicant's insurance credit score from a consumer reporting agency. What is the insurer required to do?
Nothing, because credit scores are public information
Send an FCRA adverse action notice identifying the reporting agency and the right to a free report
Obtain a GLBA opt-out signature before declining
File a 1033 waiver with the state regulator
An applicant has a prior felony conviction for embezzlement (breach of trust). Under 18 U.S.C. 1033, what is required before they may work in the insurance business?
Nothing; federal law does not address prior convictions
Only completion of continuing education in ethics
Written consent (a 1033 waiver) from the state insurance regulator
A waiting period of five years with no further action needed
Sections you finish are checked off in the contents.