18.3 Privacy, Fraud, and Consumer Protection

The Federal Privacy Framework

Insurance is state-regulated, but two federal laws shape how producers and insurers handle consumer data. The exam expects you to distinguish them.

Gramm-Leach-Bliley Act (GLBA, 1999)

GLBA governs nonpublic personal information (NPI)—data a consumer provides that is not publicly available (income, Social Security number, claims history). Financial institutions, including insurers and producers, must:

• Provide an initial privacy notice at the start of the relationship and annually thereafter (annual notice may be waived if practices have not changed and no NPI is shared with non-affiliated third parties).
• Give consumers the right to opt out before NPI is shared with non-affiliated third parties.
• Maintain administrative, technical, and physical safeguards for data security.

GLBA splits privacy into two pieces tested separately: the Financial Privacy Rule (notices and opt-out) and the Safeguards Rule (data security program).

Fair Credit Reporting Act (FCRA, 1970)

The FCRA governs consumer reports—including credit-based insurance scores and claims-history reports such as C.L.U.E. When an insurer uses such a report to deny, cancel, or increase the premium, it must give the consumer an adverse action notice identifying the reporting agency and the consumer's right to a free copy of the report and to dispute errors.

Exam Key: GLBA = privacy NOTICES and OPT-OUT for financial data. FCRA = ADVERSE ACTION NOTICE when a credit or claims report causes denial, cancellation, or higher premium.

Insurance Fraud

Fraud is a knowing misrepresentation of a material fact made to obtain a benefit. It runs in two directions:

• Hard fraud — deliberately staging or inventing a loss (a faked theft, arson for profit).
• Soft fraud — padding an otherwise legitimate claim (inflating the value of stolen items).

Producer-side fraud includes fictitious payees, premium theft, fake policies, and application fraud (falsifying answers to bind a risk the insurer would reject). Insurer-side fraud includes selling coverage from a non-admitted, unauthorized company.

The Federal Fraud Statute — 18 U.S.C. § 1033/1034

Under the Violent Crime Control and Law Enforcement Act, it is a federal crime for anyone convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance affecting interstate commerce without written consent (a 1033 waiver) from the state insurance commissioner. Penalties include fines and up to 10 years (or more) imprisonment. This is heavily tested: a producer with a disqualifying felony must obtain a 1033 waiver to work in insurance.

Fraud Warnings and Reporting

Most states require a fraud warning on applications and claim forms ("Any person who knowingly files a false claim is guilty of a crime..."). Insurers must maintain anti-fraud plans and Special Investigation Units (SIUs), and many states grant immunity to those who report suspected fraud in good faith to the department or NICB.

Consumer Protection Mechanisms

• Free-look period — a window (commonly 10–30 days) to review a policy and get a full refund. More common in life/health but tested generally.
• Guaranty associations — state funds that pay covered claims when an admitted insurer becomes insolvent, up to statutory caps. Producers may not advertise guaranty-fund protection as a sales inducement.
• Replacement regulations — disclosure forms and comparison notices when replacing an existing policy, to combat twisting and churning.
• Filing systems — rates and forms are often filed under prior approval, file-and-use, or use-and-file systems so the department can police unfair or inadequate rates.

Worked Example: Adverse Action

An applicant is quoted a standard auto premium of $1,400, but the insurer pulls a credit-based insurance score and a C.L.U.E. report showing two prior at-fault claims and surcharges the premium to $2,050. Because a consumer report caused the higher premium, the FCRA requires an adverse action notice telling the applicant which agency supplied the report and how to obtain a free copy and dispute inaccuracies. Skipping that notice is an FCRA violation independent of whether the surcharge itself was actuarially justified.

Producer Data-Handling Duties

Under GLBA's Safeguards Rule, producers must implement reasonable security: locked files, password-protected systems, secure disposal (shredding) of NPI, and limiting access to staff who need it. A laptop with unencrypted client SSNs left in a car, leading to a breach, is a safeguards failure. Many states layer their own data-breach notification statutes on top, requiring prompt notice to affected consumers and the department after a breach of personal data.

Cancellation, Nonrenewal, and Notice

Consumer protection extends to how coverage ends. Statutes restrict an insurer's right to cancel mid-term (often only for nonpayment, fraud, or a substantial increase in hazard) and require advance written notice—commonly 10 days for nonpayment and 20–30 days for other reasons. Nonrenewal requires its own notice (often 30–60 days before expiration) so the insured can shop for replacement coverage. A denial, cancellation, or nonrenewal driven by a consumer report still triggers the FCRA adverse-action notice on top of the state cancellation notice.

Exam Key: A surcharge, cancellation, OR nonrenewal based on a credit/claims report requires BOTH the state cancellation notice AND the FCRA adverse-action notice—they are separate obligations.