18.3 Privacy, Fraud, and Consumer Protection

Privacy: Gramm-Leach-Bliley Act (GLBA)

The federal Gramm-Leach-Bliley Act (1999) sets the baseline for how financial institutions, including insurers and agencies, treat nonpublic personal information (NPI). NPI is information a consumer gives to obtain a product—application data, account numbers, health and financial details.

GLBA requires three things on the exam:

1. Privacy notice — given at the start of the relationship and annually thereafter, describing what information is collected and shared.
2. Opt-out right — before sharing NPI with a nonaffiliated third party for marketing, the insurer must give the consumer a reasonable opportunity to opt out.
3. Safeguards — reasonable administrative, technical, and physical security to protect the data.

Exam Key: GLBA protects FINANCIAL NPI and gives an OPT-OUT for sharing with NONAFFILIATED third parties. Sharing with affiliates and for servicing the policy generally does not require opt-out.

Using Credit and Consumer Reports: FCRA

The Fair Credit Reporting Act (FCRA) governs consumer reports (including insurance credit scores). If an insurer takes an adverse action—declining, canceling, or charging a higher rate based on a consumer/credit report—it must send an adverse action notice that:

• States that the action was based in whole or part on the report,
• Names the consumer reporting agency that supplied it, and
• Tells the consumer of the right to a free copy and to dispute inaccurate information.

Fraud and False Statements: 18 U.S.C. 1033 & 1034

Federal law 18 U.S.C. 1033/1034 makes it a crime to engage in deceptive acts affecting insurance in interstate commerce. The most-tested clause: a person convicted of a felony involving dishonesty or breach of trust may not work in the insurance business unless they obtain written consent (a "1033 waiver") from the state insurance regulator. Knowingly employing such a person without consent is itself a violation.

Insurance Fraud: Hard vs. Soft

Insurance fraud is a crime committed by applicants, insureds, producers, or even insurers.

• Soft fraud (opportunistic) — padding an otherwise legitimate claim, e.g., adding a stolen TV that never existed to a real burglary claim, or shading an application to lower the premium.
• Hard fraud (premeditated) — fabricating or staging an entire loss, e.g., arson-for-profit or a staged auto collision.

Both are illegal. A worked distinction the exam favors:

Real kitchen fire, actual damage: $8,000
Claim filed by insured:          $12,000  (added fake items)
Soft fraud (padding):            $4,000 inflated portion

No fire at all; barn deliberately burned
for the $80,000 policy proceeds  -> HARD fraud (staged loss)

Most states require insurers to maintain an anti-fraud plan and to report suspected fraud to the state's fraud bureau, often with immunity for good-faith reports. Producers must report suspected fraud, not abet it—submitting a knowingly false application is fraud by the producer.

Consumer Protection Touchpoints

Producers also operate under marketing and communication rules:

• Do-Not-Call Registry / TCPA — no telemarketing to registered numbers absent an existing relationship.
• CAN-SPAM — commercial email must allow opt-out and identify the sender.
• Replacement regulations — special disclosure and comparison forms when replacing existing coverage (ties back to twisting/churning).
• Free-look and disclosure requirements that give consumers time and information to make an informed choice.

The theme across these laws is consistent: protect the consumer's information and money, disclose honestly, and report (never commit) fraud.

Affiliated vs. Nonaffiliated Sharing Under GLBA

The GLBA opt-out is narrower than students assume. An insurer may share NPI without an opt-out for ordinary servicing—issuing the policy, processing claims, reinsurance, fraud prevention, and responding to a subpoena. The opt-out matters only when NPI is disclosed to a nonaffiliated third party for that party's own marketing. Sharing among affiliates (companies under common control) is governed mainly by the FCRA affiliate-sharing rules, not the GLBA opt-out.

State Privacy and the NAIC Models

Most states adopt the NAIC Privacy of Consumer Financial and Health Information Regulation, which layers health-information opt-IN on top of GLBA. For NPI that is health information, many states require affirmative consent (opt-in) before disclosure—stricter than the financial opt-out. The newer NAIC Insurance Data Security Model Law adds breach-notification and written information-security-program duties for licensees.

Exam Key: Financial NPI = OPT-OUT (consumer must act to stop sharing). Health NPI under many state rules = OPT-IN (insurer needs consent first). Affiliate marketing sharing is an FCRA opt-out, not GLBA.

The Producer's Anti-Fraud Duties

Producers are the front line against fraud. Practical duties tested on the exam:

1. Verify the applicant's identity and the accuracy of application answers; do not coach an applicant to omit a material fact to lower the premium.
2. Report suspected fraud to the insurer's special investigations unit (SIU) or the state fraud bureau; good-faith reports usually carry statutory immunity from defamation suits.
3. Never submit a claim or application the producer knows to be false—doing so is the producer's own hard fraud and is criminal.
4. Include the required fraud-warning statement on applications and claim forms where the state mandates it.

A producer who participates in even "minor" soft fraud—agreeing to inflate a real claim by a few hundred dollars—commits a crime and faces license revocation plus exposure under 18 U.S.C. 1033. The safe, ethical, and tested answer is always: protect the data, disclose honestly, and report rather than abet.