An insurer wants to share its customers' nonpublic personal information with an unaffiliated marketing firm that is not providing a service to the insurer. Under the federal Gramm-Leach-Bliley Act, before sharing in this manner the insurer generally must:

Why A is correct

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions, including insurers, to protect the nonpublic personal information (NPPI) they collect about customers. Before disclosing NPPI to an unaffiliated third party that is not performing services for the institution, the institution must provide the customer with a privacy notice and a reasonable opportunity to opt out of the sharing. This opt-out requirement gives consumers control over whether their personal financial information is shared outside the institution and its service providers. GLBA also requires institutions to safeguard customer information and to explain their privacy policies clearly at the start of the customer relationship.

Why the other options are wrong

• B) A court order is not the mechanism GLBA uses for ordinary third-party marketing sharing; the statute relies on privacy notices and the opt-out right as the safeguards. The notice and opt-out regime is the statutory safeguard Congress chose for ordinary marketing disclosures, not a judicial order.
• C) GLBA does not require notification to state attorneys general before such sharing; the opt-out process under the privacy rule governs the disclosure. The privacy rule's opt-out mechanism is what protects consumers, and state attorney general notification is not part of the GLBA sharing framework.
• D) GLBA restricts NPPI sharing with unaffiliated parties; sharing without first providing the opt-out opportunity would violate the privacy rule. The customer's opt-out choice must be honored before any sharing with an unaffiliated third party, or the institution violates the privacy rule.

Memory hook

GLBA: your data is not a billboard — customers get a say before it is shared.