Contract analysis

I. Executive Summary This memorandum provides Quorum Insurance Holdings Corp. ("Quorum" or the "Company") with a comprehensive analysis of the federal and state regulatory framework governing Quorum's proposed five-year enterprise data-licensing arrangement with Meridian Credit intelligence, Inc. ("Meridian"). The engagement was opened on August 8, 2022, following receipt of the executed engagement letter, and this m

II. Background — Transaction Overview A. The Parties Quorum Insurance Holdings Corp. Quorum is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. The Company is headquartered at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901. For fiscal year 2023, Quorum reported total revenue of approximately $4.18 billion and total assets of approximately $27.6 billion. Q

III. Fair Credit Reporting Act (FCRA) — Analysis A. Overview of FCRA Framework The Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (the "FCRA"), enacted in 1970 and substantially amended by the Fair and Accurate Credit Transactions Act of 2003 ("FACTA"), establishes a comprehensive federal regulatory framework governing the collection, dissemination, and use of consumer credit information. The statute represents

Section 604 of the FCRA, 15 U.S.C. § 1681b, enumerates the exclusive permissible purposes for which a CRA may furnish a consumer report. A CRA may not furnish a consumer report to any person unless the CRA has reason to believe that the person intends to use the information for one or more of the purposes specified in Section 604(a). This permissible purpose requirement is the central gatekeeping mechanism of the FCR

Section 604(a)(3)(C) — Insurance Underwriting. Under this provision, a CRA may furnish a consumer report to a person who it has reason to believe "intends to use the information in connection with the underwriting of insurance involving the consumer." This is Quorum's primary permissible purpose for accessing and using Meridian consumer credit data. The insurance underwriting permissible purpose is well-established i

Section 604(a)(3)(A) — Credit Transaction. This provision permits furnishing of a consumer report to a person who it has reason to believe intends to use the information in connection with a credit transaction involving the consumer. While insurance underwriting is Quorum's principal basis for accessing Meridian data, this permissible purpose may be applicable with respect to certain financial products offered by Quo

Section 604(a)(3)(F)(i) — Legitimate Business Need. Under this provision, a consumer report may be furnished to a person who it has reason to believe "otherwise has a legitimate business need for the information — (i) in connection with a business transaction that is initiated by the consumer." This provision may serve as an alternative or supplemental permissible purpose basis for certain Quorum data uses, such as r

Section 604(f) — Unauthorized Access. Section 604(f) of the FCRA imposes criminal liability on any person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses. This provision underscores the importance of Quorum's permissible purpose certification being accurate and complete. Any use of Meridian data outside the scope of the certified permissible purpose

Section 607(a) — CRA Reasonable Procedures. As noted above, Meridian, as a CRA, is obligated under Section 607(a) to maintain reasonable procedures to limit the furnishing of consumer reports to permissible purposes. In the context of the MDLA, this obligation will manifest as Meridian's requirement for detailed contractual representations and certifications from Quorum regarding its intended uses of the data, as wel

Section 604(g) and Section 615 — Adverse Action Requirements. When Quorum takes an "adverse action" with respect to a consumer based in whole or in part on information contained in a consumer report, Section 615 of the FCRA requires Quorum to provide the consumer with an adverse action notice. In the insurance context, an adverse action includes a denial of insurance coverage, a cancellation or non-renewal of an insu

Section 612 and Section 609 — Consumer Access and Dispute Rights. The FCRA grants consumers the right to access the information in their credit files and to dispute the accuracy of that information. Section 609 requires CRAs to disclose to consumers, upon request, all information in the consumer's file, the sources of the information, and the identity of persons who have procured the consumer's report for certain pur

1. FCRA Permissible Purpose Certification Schedule. A detailed schedule to be attached to the MDLA, specifying each applicable permissible purpose category (insurance underwriting under Section 604(a)(3)(C); credit transaction under Section 604(a)(3)(A), to the extent applicable; legitimate business need under Section 604(a)(3)(F)(i), to the extent applicable), the lines of business to which each applies, and a descr

2. Permissible Purpose Representation and Warranty. A representation and warranty by Quorum that it will access and use consumer report data obtained from Meridian solely for the permissible purposes certified in the FCRA Permissible Purpose Certification Schedule, and that it will not use such data for any purpose not so certified without prior written amendment to the schedule and prior written consent of Meridian.

3. CRA Compliance Representation and Warranty. A representation and warranty by Meridian that it is a consumer reporting agency as defined in Section 603(f) of the FCRA and that it maintains reasonable procedures in compliance with Section 607 to ensure the accuracy of consumer report information and to limit the furnishing of consumer reports to persons with permissible purposes.

4. Adverse Action Notice Covenant. A covenant by Quorum to comply with all adverse action notice obligations under Section 615 of the FCRA when it takes adverse action with respect to any consumer based in whole or in part on information obtained from Meridian, and to maintain systems and procedures reasonably designed to ensure such compliance across all of its insurance lines and jurisdictions.

5. Use Restriction Covenant. A covenant by Quorum not to use consumer report data obtained from Meridian for any purpose not certified in the FCRA Permissible Purpose Certification Schedule, including but not limited to employment screening, tenant screening, or direct marketing (except to the extent permitted under the firm offer of credit or insurance provisions of Section 604(c)).

6. Derived-Data Commercialization Covenant. A covenant providing that if Quorum's commercialization of derived data products (including QuorumScore™) to third parties causes Quorum to become a consumer reporting agency under Section 603(f) of the FCRA, Quorum shall independently assume and bear all CRA compliance obligations with respect to such products, including but not limited to accuracy requirements, consumer d

7. Mutual Indemnification. Mutual indemnification provisions pursuant to which each party indemnifies the other for FCRA liabilities (including regulatory penalties, private action damages, and defense costs) attributable to the indemnifying party's breach of its FCRA-related representations, warranties, and covenants under the MDLA.

8. Audit Rights. A provision granting Meridian the right to audit Quorum's compliance with FCRA requirements, including permissible purpose certification, adverse action notice procedures, and data use restrictions. The scope, frequency, notice requirements, and cost allocation for such audits are subject to negotiation; we recommend that Quorum agree to annual compliance audits conducted by a mutually agreed-upon in

9. Consumer Dispute Resolution Procedures. A provision establishing a protocol for handling consumer disputes, including: (a) Meridian's obligation to promptly notify Quorum of any consumer dispute regarding data used by Quorum; (b) Quorum's obligation to cooperate with Meridian's reinvestigation and to respond to Meridian's inquiries within five (5) business days; and (c) Quorum's obligation to update its records to

IV. Gramm-Leach-Bliley Act (GLBA) — Analysis A. Overview of GLBA Framework The Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809 (the "GLBA"), enacted in 1999, imposes comprehensive obligations on "financial institutions" regarding the privacy and security of consumers' nonpublic personal information ("NPI"). The GLBA is the second principal federal regulatory regime applicable to the proposed Meridian data-licensing ar

Section 502(a) of the GLBA establishes a general prohibition against financial institutions disclosing NPI to nonaffiliated third parties unless the institution has provided notice to the consumer and an opportunity to opt out, or unless an exception to the opt-out requirement applies. NPI is defined broadly to include any information that a consumer provides to a financial institution, that results from a transactio

Section 502(e)(1) — Transaction-Related Disclosure. This exception permits disclosure of NPI to a nonaffiliated third party when the disclosure is necessary to effect, administer, or enforce a transaction requested or authorized by the consumer. In the insurance context, this exception may apply when a consumer submits an application for insurance to Quorum and Quorum obtains the consumer's credit report from Meridia

Section 502(e)(5) — CRA Disclosure. This exception permits disclosure of NPI to a consumer reporting agency in accordance with the FCRA. While this exception is framed to address the flow of information to a CRA rather than from a CRA, the interplay between the GLBA and the FCRA is relevant: the FCRA permissible purpose framework effectively serves as the primary gatekeeping mechanism for Meridian's furnishing of con

Section 501(b) of the GLBA and the Interagency Guidelines Establishing Information Security Standards require financial institutions to oversee third-party service providers that have access to customer information. The guidelines specify that a financial institution must: (i) exercise appropriate due diligence in selecting its service providers; (ii) require its service providers by contract to implement appropriate

1. Meridian Privacy Compliance Representation. A representation and warranty by Meridian that its disclosure of NPI to Quorum pursuant to the MDLA complies with all applicable GLBA privacy notice, opt-out, and exception requirements, including Regulation P and any state-specific insurance privacy regulations applicable to Meridian's activities.

2. Quorum Safeguards Representation. A representation and warranty by Quorum that it maintains a comprehensive information security program compliant with GLBA Safeguards Rule requirements and all applicable state insurance data-security regulations, including 23 NYCRR 500, and that such program covers the receipt, storage, processing, and use of Meridian NPI.

3. Annual Certification Exchange. A covenant requiring both parties to provide annual certifications of compliance with the GLBA and related regulations, including delivery of updated SOC 2 Type II reports and other relevant audit evidence.

4. Cross-Reference to Data Security Addendum. An express cross-reference to the Data Security Addendum for detailed security standards, minimum controls, and technical requirements, which should be drafted to incorporate the GLBA Safeguards Rule requirements as a floor, with additional controls as required by 23 NYCRR 500 and other applicable state regulations.

5. NPI Re-Disclosure Restrictions. Restrictions on Quorum's further disclosure of NPI received from Meridian to nonaffiliated third parties, except as expressly permitted by the MDLA's derived-data commercialization provisions (Article VII) and in compliance with GLBA, FCRA, and applicable state law. These restrictions should be coordinated with the derived-data provisions to ensure consistency and to avoid creating

6. Quorum Privacy Notice Obligations. A provision addressing Quorum's obligation to provide privacy notices to its own policyholders and applicants regarding its receipt and use of consumer credit data from third-party sources, including Meridian, in accordance with applicable state insurance privacy regulations.

V. State Insurance Data-Security Regulations A. Overview of Multi-State Landscape As a multi-line insurance carrier holding licenses in all 50 states, the District of Columbia, and several U.S. territories, Quorum is subject to the insurance department regulations and data-security requirements of each jurisdiction in which it operates. The state insurance regulatory landscape for data security has evolved significan

Section 500.02 — Cybersecurity Program. Quorum must maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of its information systems. The program must be based on Quorum's risk assessment and must be designed to perform core cybersecurity functions, including identification and assessment of internal and external cybersecurity risks, implementation of defensive infrastr

Section 500.03 — Cybersecurity Policy. Quorum must implement and maintain a written cybersecurity policy, approved by a senior officer or the board of directors, that addresses the following areas, among others: • Data governance and classification (including classification of Meridian data by sensitivity level); • Access controls and identity management (including role-based access to Meridian data); • Asset invento

Section 500.04 — Chief Information Security Officer (CISO). Quorum must designate a qualified individual to serve as its CISO, responsible for overseeing and implementing the cybersecurity program and enforcing the cybersecurity policy. The CISO must report at least annually to the board of directors or equivalent governing body on the cybersecurity program, including material cybersecurity risks, the overall effecti

Section 500.07 — Access Privileges. As part of its cybersecurity program, Quorum must limit access privileges to information systems that provide access to nonpublic information solely to those individuals who require such access for the performance of their responsibilities, and must periodically review such access privileges. This requirement is directly applicable to Quorum's access to and processing of Meridian c

Section 500.09 — Risk Assessment. Quorum must conduct