18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
- Gramm-Leach-Bliley Act (GLBA) requires privacy notices and opt-out rights for sharing nonpublic personal information; the NAIC Insurance Information and Privacy Protection Act (Model 670) governs insurance data and adverse-underwriting notices.
- The Fair Credit Reporting Act (FCRA) governs use of consumer/credit reports; adverse action based on a report requires notice and the source's identity, and investigative consumer reports require advance disclosure.
- Insurance fraud (soft padding of claims or hard staged losses) is prohibited; the Fraud Enforcement provisions and state fraud bureaus can pursue criminal penalties, and the federal 18 U.S.C. 1033/1034 bars prohibited persons (felony of breach of trust/dishonesty) from the business without 1033 written consent.
- The Fair Credit Reporting Act and state laws restrict but do not forbid credit-based insurance scores; insurers must disclose their use and cannot use them as the sole reason to deny.
- Do-Not-Call rules, anti-money-laundering (AML) duties for certain products, and the National Flood Insurance Program's consumer protections also appear on the national exam.
Privacy of Consumer Information
Two layers of privacy law dominate the national exam.
- Gramm-Leach-Bliley Act (GLBA) - a federal financial-privacy law. Insurers must give an initial and annual privacy notice of the nonpublic personal information (NPI) they collect and share, and offer an opt-out before sharing NPI with nonaffiliated third parties (exceptions exist for servicing and law enforcement).
- NAIC Insurance Information and Privacy Protection Act (Model 670) - the insurance-specific framework. It requires notice of information practices and an adverse underwriting decision notice stating the reasons and the right to access and correct the file.
GLBA also requires a Safeguards Rule program to protect customer data; a breach that exposes NPI can trigger state notification laws and regulatory fines on top of reputational harm.
The Fair Credit Reporting Act (FCRA)
The FCRA governs the use of consumer reports and investigative consumer reports in underwriting.
| Concept | Rule |
|---|---|
| Consumer report | Credit/claims history data; permissible purpose required to pull it |
| Investigative consumer report | Based on personal interviews about character/reputation; requires ADVANCE written disclosure |
| Adverse action | Declination, increased rate, or reduced coverage based on a report |
| Adverse-action notice | Must tell the consumer and identify the reporting agency, plus the right to a free copy and to dispute |
Trap: the insurer need not have the credit data itself be wrong to owe a notice - the duty arises from taking adverse action based on the report.
An insurer declines an applicant largely because of information in a credit-based insurance score. Under the FCRA, the insurer must:
Insurance Fraud
Fraud is intentional deception for unlawful gain, and the exam splits it into two flavors:
- Soft fraud (opportunistic) - padding an otherwise legitimate claim or shading an application (e.g., inflating the value of stolen property).
- Hard fraud (premeditated) - deliberately staging or causing a loss, such as arson-for-profit or a faked theft.
Fraud flows both ways: applicants/insureds commit it, but so can producers and insurers (e.g., selling coverage from an unauthorized insurer, or pocketing premiums). Most states fund a fraud bureau and require a fraud warning on applications and claim forms.
Federal 18 U.S.C. 1033 and 1034
These federal statutes are heavily tested. 18 U.S.C. 1033 makes it a federal crime to engage in deceptive acts affecting interstate insurance commerce and prohibits any person convicted of a felony involving dishonesty or breach of trust from working in the business of insurance without written consent (a 1033 waiver) from the state insurance commissioner. 18 U.S.C. 1034 lets the U.S. Attorney General pursue civil penalties and injunctions.
Worked example: a producer convicted years ago of embezzlement (a breach-of-trust felony) cannot lawfully sell insurance until they secure a 1033 written consent; doing business without it is a separate federal crime carrying fines and up to 10+ years' imprisonment depending on harm.
Other Consumer Protections
A few additional rules round out the national ethics section:
- Do-Not-Call / TCPA - scrub against the federal Do-Not-Call registry and respect call-time and auto-dialer restrictions.
- Anti-Money-Laundering (AML) - applies chiefly to products with cash value/investment features; covered producers complete AML training and report suspicious activity.
- NFIP consumer protections - flood applicants must get accurate zone information and clear notice of the standard 30-day waiting period before coverage takes effect.
- Unfair discrimination overlap - using prohibited classes (race, religion, national origin) in data decisions violates both privacy and UTPA rules.
The consistent theme: disclose, document, and give the consumer a meaningful choice.
Credit-Based Insurance Scores
Many insurers use a credit-based insurance score as a rating factor because studies correlate it with loss frequency. The exam tests its legal boundaries:
- Insurers must disclose that credit information may be used at application.
- Most states prohibit using credit as the SOLE reason to deny, cancel, or non-renew.
- An applicant may request re-rating after an extraordinary life event (e.g., a medical catastrophe) distorts their credit.
- Adverse action based on the score triggers the FCRA adverse-action notice covered earlier.
Worked example: an insurer that quotes a higher premium driven by a thin credit file must still issue the adverse-action notice and cannot lawfully treat two applicants in the same class and hazard differently for reasons unrelated to risk - that crosses into unfair discrimination.
A producer was convicted of a felony for embezzlement and now wants to sell property and casualty insurance. Under 18 U.S.C. 1033, the producer:
Gramm-Leach-Bliley Privacy Notices and 18 U.S.C. 1033
The Gramm-Leach-Bliley Act (GLBA) governs the privacy of consumers' nonpublic personal financial information. Insurers must provide an initial privacy notice at the start of the relationship and annual notices, describe information-sharing practices, and give consumers the right to opt out of certain disclosures to nonaffiliated third parties.
18 U.S.C. 1033/1034 make it a federal crime for anyone convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance affecting interstate commerce without written consent (a 1033 waiver) from the state insurance commissioner; violations carry fines and imprisonment.
| Law | Protects / prohibits |
|---|---|
| GLBA | Privacy of nonpublic personal financial information; opt-out rights |
| HIPAA | Privacy of protected health information |
| FCRA | Use of consumer/credit reports; adverse-action notices |
| 18 U.S.C. 1033 | Bars dishonesty-felons from insurance without a 1033 waiver |
Trap: a producer with a prohibited felony conviction needs written 1033 consent from the commissioner to work in insurance — operating without it is a separate federal offense regardless of state licensing.
Under 18 U.S.C. 1033, what must a person previously convicted of a felony involving dishonesty obtain before engaging in the business of insurance?