An insurer wishes to share its customers' nonpublic personal financial information with a non-affiliated third-party marketing firm. Under the Gramm-Leach-Bliley Act Title V Financial Privacy Rule, which combination of requirements applies?

Why this is the answer

Under the Gramm-Leach-Bliley Act Title V Financial Privacy Rule, a financial institution (including an insurer) must (1) provide an initial privacy notice at the time the customer relationship is established, (2) provide annual privacy notices for as long as the relationship continues, and (3) before sharing nonpublic personal information with a non-affiliated third party, provide a clear notice of the practice and a reasonable opportunity for the customer to opt-out. GLBA uses an opt-out model for financial information (in contrast to HIPAA's opt-in approach for protected health information). Insurance carriers are NOT exempt from GLBA Title V — they fall within the definition of financial institution.