CIPP/US Healthcare & Financial Privacy 2 — Questions and Answers
Question 1: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to provide customers with privacy notices and:
- Encrypt all customer financial data using government-approved algorithms
- Implement a comprehensive information security program to safeguard customer financial information (Correct answer)
- Register all data sharing activities with the FTC annually
- Obtain opt-in consent before collecting any financial data
Correct answer: Implement a comprehensive information security program to safeguard customer financial information
The GLBA requires financial institutions to provide privacy notices and, under the Safeguards Rule, to develop and maintain a comprehensive written information security program.
Question 2: The Fair Credit Reporting Act (FCRA) primarily governs:
- All financial transactions between consumers and banks
- The accuracy, fairness, and privacy of consumer credit reports and use of consumer report information (Correct answer)
- Only mortgage lending practices
- Only information held by the three major credit bureaus
Correct answer: The accuracy, fairness, and privacy of consumer credit reports and use of consumer report information
The FCRA regulates consumer reporting agencies and the use of consumer report information by furnishers and users of such reports.
Question 3: Under the FCRA, what right does a consumer have when adverse action is taken based on information in a credit report?
- The right to sue the creditor immediately
- The right to receive notice of the adverse action and the name of the consumer reporting agency that provided the report (Correct answer)
- The right to have negative information immediately deleted
- The right to a refund of any fees paid
Correct answer: The right to receive notice of the adverse action and the name of the consumer reporting agency that provided the report
The FCRA requires that when adverse action is taken based on a consumer report, the consumer must be notified and given the name of the reporting agency so they can access and dispute the report.
Question 4: Under the GLBA's opt-out provision, consumers may prevent financial institutions from doing which of the following?
- Collecting any financial data about them
- Sharing their nonpublic personal information with non-affiliated third parties for marketing purposes (Correct answer)
- Reporting them to credit bureaus
- Closing their accounts
Correct answer: Sharing their nonpublic personal information with non-affiliated third parties for marketing purposes
The GLBA's opt-out right allows consumers to prevent financial institutions from sharing their nonpublic personal information with non-affiliated third parties.
Question 5: The Right to Financial Privacy Act (RFPA) generally requires the federal government to do which of the following before accessing customer financial records from a bank?
- Notify the public 30 days in advance
- Obtain customer authorization, serve an administrative subpoena, or obtain a court order or search warrant (Correct answer)
- File a report with the FTC explaining the purpose of the access
- Provide the bank with compensation for compliance costs
Correct answer: Obtain customer authorization, serve an administrative subpoena, or obtain a court order or search warrant
The RFPA establishes procedural requirements the federal government must follow when seeking access to customers' financial records held by financial institutions.
Question 6: Under the FCRA, consumer reporting agencies must investigate disputed information within:
- 10 business days
- 30 days (generally) (Correct answer)
- 60 days
- 90 days
Correct answer: 30 days (generally)
The FCRA generally requires consumer reporting agencies to complete reinvestigation of disputed information within 30 days of receiving the dispute.
CIPP/US Healthcare & Financial Privacy 2
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to provide customers with privacy notices and: