A Pennsylvania agency sells its customer list, including policyholders' account numbers and claim histories, to a marketing firm, without having given those customers any privacy notice or opt-out opportunity. Which statement is correct?
Select an option to reveal the answer and the full 3-part explanation — free, no signup.
Answer & full 3-part explanation (select an option above, or peek)
Why C is correct
Nonpublic personal financial information such as account numbers and claim histories may be disclosed to nonaffiliated third parties only after the customers receive the required notice of privacy practices and any required opt-out opportunity. Under 31 Pa. Code Ch. 146a and the statutory anchor at 40 P.S. § 310.77(a), the agency that sells the list without ever giving notice has violated Pennsylvania's privacy requirements, and the Pennsylvania Insurance Department can take enforcement action against it. The originating agency holds the duty; it cannot outsource the responsibility along with the data.
Why the other options are wrong
- A) Information in the agency's files is precisely what the privacy regulations protect; holding the data is what creates the duty, not a license to sell it.
- B) The disclosing agency bears the primary duty to give notice and honor opt-outs; it cannot shift the violation to the buyer.
- D) Removing names while keeping account numbers and claim histories leaves the nonpublic personal information unprotected; the notice-and-opt-out duty still applies.
Memory hook
No notice, no opt-out, no sale: privacy duties travel with the data in Pennsylvania.