18.3 Privacy, Fraud, and Consumer Protection

Privacy: Gramm-Leach-Bliley Act (GLBA)

The federal Gramm-Leach-Bliley Act (GLBA) of 1999 set the baseline for protecting a consumer's nonpublic personal information (NPI)—financial and health data gathered in the insurance transaction. States implement it through the NAIC Privacy of Consumer Financial and Health Information model regulation.

Three consumer rights flow from GLBA:

• An initial privacy notice describing what NPI is collected and shared.
• An annual privacy notice for ongoing customers.
• The right to opt out before NPI is disclosed to nonaffiliated third parties for marketing.

Opt-Out Mechanics and Exceptions

The opt-out right applies to sharing with nonaffiliated parties. Sharing with affiliates, or sharing necessary to service the policy or process a claim, generally does not require opt-out. Health information typically demands an affirmative opt-IN (authorization) before disclosure—a stricter standard than financial data's opt-out.

Exam Key: Financial NPI = OPT-OUT (sharing allowed unless the consumer says no). Health NPI = OPT-IN (no sharing until the consumer says yes).

Fair Credit Reporting Act (FCRA)

The Fair Credit Reporting Act (FCRA) governs how insurers use consumer reports and credit-based insurance scores in underwriting. If an insurer takes an adverse action—declines, cancels, charges more, or offers worse terms—based on information in a consumer report, it must:

1. Notify the applicant of the adverse action.
2. Identify the consumer reporting agency that supplied the report (and note the agency did not make the decision).
3. Inform the consumer of the right to obtain a free copy of the report and to dispute inaccuracies.

An investigative consumer report (interviews with neighbors/associates) requires advance disclosure to the applicant.

Insurance Fraud and 18 U.S.C. 1033/1034

Insurance fraud—filing false or inflated claims, staging losses, or falsifying applications—is a crime prosecuted under state fraud statutes, and most states operate a fraud bureau and require fraud-warning language on claim forms.

At the federal level, the Violent Crime Control Act's insurance fraud provisions, codified at 18 U.S.C. 1033 and 1034, make it a federal crime for any person convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance affecting interstate commerce without written consent from the state insurance commissioner. This is the 1033 consent (or 'waiver') letter. Hiring such a person without consent exposes the insurer to liability.

Marketing and Anti-Money-Laundering Rules

Producers also face conduct rules outside the insurance code:

• National Do Not Call Registry / TCPA — limits telemarketing to registered consumers; honor internal do-not-call lists.
• CAN-SPAM Act — commercial email needs accurate headers, a valid physical address, and a working unsubscribe link.
• USA PATRIOT Act / Anti-Money-Laundering (AML) — cash-value insurers must keep an AML program; producers get AML training and flag suspicious cash.
• Telemarketing fraud and unsolicited robo-texts can trigger federal penalties separate from state insurance law.

These rules overlap state insurance regulation rather than replace it. A producer who violates the Do Not Call rules can face both a federal penalty and a state market-conduct action, so compliance programs treat marketing and privacy as a single discipline.

Structural Consumer Protections

Several safeguards exist regardless of any single transaction:

1. Free-look period — commonly a 10-day window to review a delivered policy and return it for a full premium refund.
2. Mandatory disclosure documents — outline of coverage, buyer's guides, and policy summaries delivered at or before issue.
3. State guaranty association — assessment-funded; pays covered claims of insolvent admitted insurers but not surplus lines.
4. Complaint and market-conduct process — consumers complain to the state insurance department, which can open a market-conduct exam.

The guaranty-association limitation is heavily tested: because non-admitted (surplus lines) insurers pay nothing into the fund, their policyholders are unprotected if the carrier fails. That is one reason surplus lines is reserved for risks the admitted market declines and why producers must disclose the non-admitted status to clients in writing.

Privacy and Credit-Reporting Rules

Two federal laws govern how insurers handle consumer information:

• Gramm-Leach-Bliley Act (GLBA) - requires a privacy notice and an opt-out opportunity before sharing nonpublic personal financial information with nonaffiliated third parties. The NAIC privacy models implement it at the state level.
• Fair Credit Reporting Act (FCRA) - governs use of consumer/credit reports for underwriting. If an insurer takes adverse action (declines, surcharges, or non-renews) based on a report, it must give an adverse-action notice naming the source of the report.

The distinction: GLBA controls sharing information; FCRA controls acting on a credit report and requires notice when that action hurts the applicant.

Fraud Statutes and Consumer Protections

Insurance fraud - false claims, staged losses, application fraud - is a crime. The federal Fraud and False Statements provision, 18 U.S.C. 1033/1034, bars a person convicted of a felony involving dishonesty or breach of trust from working in insurance without written 1033 consent from the regulator. Producers must also comply with USA PATRIOT Act anti-money-laundering rules and marketing restrictions including the National Do Not Call Registry and CAN-SPAM.

Several consumer protections close the chapter and recur on the exam:

• The free-look period lets a new policyholder cancel for a full refund within a set number of days.
• Mandatory disclosure documents and a buyer's guide inform the purchase.
• The state guaranty association backstops claims if an admitted insurer becomes insolvent.
• The commissioner's complaint and market-conduct process gives consumers a path to challenge insurer behavior.

Together these rules answer the recurring question of what recourse a wronged consumer has and who may lawfully work in the insurance business.