Under the Gramm-Leach-Bliley Act (GLBA), a property insurer collects a customer's income, claims history, and bank account information during the application process. The insurer wants to share this information with an unaffiliated third-party marketing firm that will use it to sell other companies' products. What must the insurer do BEFORE sharing?

Why this is the answer

The Gramm-Leach-Bliley Act (GLBA) applies to financial institutions, including insurance companies, that collect nonpublic personal information (NPI) — income, account numbers, claims history, Social Security numbers, and similar data. GLBA has three key requirements: (1) Financial Privacy Rule — provide an initial privacy notice at the start of the customer relationship and annually thereafter; the notice must describe what information is collected and with whom it is shared. (2) Opt-out right — before sharing NPI with unaffiliated third parties, the institution must give the customer a reasonable opportunity to opt out; if the customer opts out, sharing is prohibited. (3) Safeguards Rule — implement administrative, technical, and physical safeguards to protect NPI. Sharing with affiliates requires notice but not an opt-out; sharing for account processing, fraud prevention, or as required by law does not require opt-out. See FL Outline §III — GLBA.