Under North Carolina's Insurance Information and Privacy Protection Act, an insurer that wants to disclose a customer's personal information collected in connection with an accident and health application generally must first:

Why B is correct

Under Article 39 (G.S. 58-39-5 through 58-39-120), the Insurance Information and Privacy Protection Act governs the collection, use, and disclosure of personal information; as a general rule an insurer may disclose personal information only with the individual's authorization, subject to limited statutory exceptions, and individuals have rights of access and correction.

Why the other options are wrong

• A) The Act protects personal information rather than publicizing it; no newspaper publication mechanism exists in G.S. 58-39-5 through 58-39-120.
• C) The statute routes disclosures through the individual's authorization and defined exceptions; it does not require a 30-day waiting period administered by the Commissioner.
• D) Affiliates are not an unrestricted channel; disclosures, including within an insurance group, fit within the Act's authorization and exception framework.

Memory hook

Privacy Act: my information, my authorization first.

Why B is correct

Under the Insurance Information and Privacy Protection Act, G.S. 58-39-5 through 58-39-120, personal information collected by an insurer is protected: disclosure to third parties generally requires the individual's written authorization, with the statute permitting only limited exceptions such as those needed for ordinary business functions or as otherwise allowed by law. The Act also gives individuals rights of access and correction regarding their own information.

Why the other options are wrong

• A) Free sharing without the customer's knowledge is exactly what the Act forbids; authorization or a statutory exception is required.
• C) The Act relies on customer authorization and statutory exceptions, not on court orders, which are unnecessary for routine disclosures.
• D) The privacy protections reach insurance personal information generally, including health-related information held by insurers.

Memory hook

Privacy Act: your paper or a legal exception before any disclosure.

Why C is correct

Under the North Carolina Insurance Information and Privacy Protection Act, Article 39 of Chapter 58 (G.S. 58-39-5 through 58-39-120), an insurer may disclose an individual's personal information only with the individual's authorization or as otherwise permitted by the Act, and the individual has rights to access and correct the information maintained about them. Marketing to a third party is not among the permitted uses absent authorization, so the applicant's consent controls.

Why the other options are wrong

• A) The Act does not confine disclosures to regulators; with proper authorization or another permitted basis under G.S. 58-39-5 through 58-39-120, other disclosures are possible.
• B) Collection for a business purpose does not authorize unlimited sharing; disclosure requires authorization or a permitted basis under the Act.
• D) Disclosure is not flatly banned forever; the Act permits disclosure with the individual's authorization or where otherwise allowed by G.S. 58-39-5 through 58-39-120.

Memory hook

Your data, your signature: no authorization, no disclosure.