PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 425 Park Avenue New York, NY 10022
MEMORANDUM
Right-click to update Table of Contents
I. Executive Summary
This memorandum provides Quorum Insurance Holdings Corp. ("Quorum" or the "Company") with a comprehensive analysis of the federal and state regulatory framework governing Quorum's proposed five-year enterprise data-licensing arrangement with Meridian Credit intelligence, Inc. ("Meridian"). The engagement was opened on August 8, 2022, following receipt of the executed engagement letter, and this memorandum reflects the state of our analysis as of the date hereof. The proposed transaction is valued at approximately $60,000,000 over the initial five-year term, with renewal options that could extend the relationship for up to an additional five years.
This memorandum addresses the following regulatory and compliance areas in detail:
(a) the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681 et seq., and its permissible purpose requirements as they apply to Quorum's intended receipt and use of consumer credit data from Meridian;
(b) the Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. §§ 6801–6809, and its privacy and safeguard obligations applicable to both Quorum and Meridian as financial institutions;
(c) state insurance data-security regulations, with particular focus on Connecticut insurance regulations (given Quorum's Stamford, Connecticut headquarters) and the New York Department of Financial Services Cybersecurity Regulation, 23 NYCRR 500 (given Quorum's New York insurance licenses and the stringency of the DFS regulatory regime);
(d) multi-state compliance considerations applicable to Quorum's operations across all 50 states, including a survey of recently enacted comprehensive state privacy laws and their interaction with federal regulatory frameworks; and
(e) recommended contractual provisions for the Master Data License Agreement ("MDLA") and ancillary agreements — including the Data Security Addendum ("DSA"), the Data Processing Agreement ("DPA"), the FCRA Permissible Purpose Certification schedule, and the Service Level Agreement ("SLA") — to ensure regulatory compliance throughout the term of the arrangement.
The transaction contemplates that Quorum will ingest three principal Meridian data products: the MCI Consumer Credit File™ (encompassing approximately 310 million consumer records), MCI CommercialView™ (encompassing approximately 42 million business records), and MCI AltSignal™ (encompassing approximately 85 million consumer alternative-data records). Quorum intends to deploy these data assets to enhance automated underwriting models, claims-fraud detection algorithms, and customer propensity scoring across its property and casualty, life, and specialty insurance lines. Additionally, Quorum contemplates the development and potential commercialization of derived data products, including the proprietary QuorumScore™ predictive underwriting model, which blends Meridian credit data with Quorum's first-party claims, policy, and telematics data.
Key Conclusion. The regulatory landscape imposes significant and overlapping obligations on both Quorum, as the licensee and end-user of consumer reports and nonpublic personal information, and Meridian, as the consumer reporting agency and disclosing financial institution. These obligations require carefully drafted contractual provisions addressing, at a minimum, permissible purpose certification, data handling restrictions, information security standards, breach notification protocols, data retention and disposal, and ongoing compliance monitoring. Of particular significance is the question of whether Quorum's commercialization of derived data products — including QuorumScore™ — to third-party purchasers would cause Quorum itself to become a "consumer reporting agency" under FCRA, thereby triggering the full panoply of CRA compliance obligations. This issue, which has material implications for both the MDLA negotiation and Quorum's broader business strategy, is flagged for further analysis and is discussed in detail in Section III.D of this memorandum.
We note that this memorandum does not address certain related regulatory topics that are being analyzed separately by other members of the Calderwood & Harkness engagement team, including: (i) the CCPA/CPRA implications of derived-data commercialization (a separate memorandum is being prepared by Lisa Johannsen in coordination with Patricia Heng); (ii) the intellectual property considerations relating to QuorumScore™ (being addressed by Wendy Schultz and Omar Siddiqui, in coordination with Angela Firth at Caldwell & Strauss LLP); and (iii) the credit agreement consent requirements (being addressed by Marcus Weill). This memorandum does, however, note the intersections with those workstreams where relevant to the regulatory analysis herein.
II. Background — Transaction Overview
A. The Parties
Quorum Insurance Holdings Corp. Quorum is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. The Company is headquartered at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901. For fiscal year 2023, Quorum reported total revenue of approximately $4.18 billion and total assets of approximately $27.6 billion. Quorum operates as a multi-line insurance carrier and insurance-technology platform operator, writing business across property and casualty, life, and specialty insurance lines. The Company holds insurance licenses in all 50 states, the District of Columbia, and several U.S. territories. Quorum's General Counsel and Executive Vice President is Carolyn Whitford, who has primary responsibility for oversight of this transaction on the legal side. Gregory Stahl, VP of Legal Affairs, serves as the day-to-day legal lead. Claudia Reeves, VP of Regulatory & Compliance, has been identified as the internal lead for insurance regulatory review of data usage under the Meridian license.
Meridian Credit intelligence, Inc. Meridian is a Georgia corporation, privately held, and headquartered at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326. For fiscal year 2023, Meridian reported total revenue of approximately $1.42 billion. Meridian operates as a consumer and commercial credit bureau and data analytics company, maintaining one of the nation's largest consumer credit databases. Meridian is majority-owned (62.5%) by Breckenridge Capital Partners Fund IV, L.P., a private equity fund affiliated with Breckenridge Capital Partners, LLC. Meridian is represented in this transaction by Kessler Pruitt & Ashe LLP (Atlanta, Georgia; New York office), with Graham Whitley serving as lead partner. As discussed throughout this memorandum, Meridian's status as a consumer reporting agency under FCRA is a central factor in the regulatory analysis.
Key Personnel. On the Quorum side, the Chief Data Officer is Rajesh Anand, who is responsible for the strategic vision for Quorum's data assets and analytics capabilities, including the QuorumScore™ initiative. The technical integration lead is Priya Nair, Director of Data Engineering, who will oversee the implementation of data feeds, API connectivity, and data lake ingestion architecture. These individuals will play critical roles in ensuring that the technical implementation of the Meridian data-licensing arrangement is consistent with the regulatory requirements described in this memorandum.
B. Data Products at Issue
The proposed MDLA contemplates that Meridian will license to Quorum three principal data products, each with distinct characteristics, delivery mechanisms, and regulatory implications:
MCI Consumer Credit File™. This product provides full-file consumer tradeline data covering approximately 310 million consumer records. The data includes traditional credit information such as account histories, payment patterns, credit inquiries, public record information (bankruptcies, liens, judgments), and consumer identification data. Delivery is available via both daily batch transmission (SFTP) and real-time programmatic access (REST API). This data product is unambiguously subject to the FCRA, as it constitutes the core consumer report information maintained by Meridian in its capacity as a consumer reporting agency.
MCI CommercialView™. This product provides commercial credit data on approximately 42 million business records, including business credit histories, payment trends, financial statements, corporate linkage information, and related business risk indicators. Delivery is via weekly batch transmission (SFTP). As discussed further in Section III.A below, commercial credit data on businesses is generally not subject to FCRA, as the statute applies to "consumers" (defined as natural persons). However, certain records pertaining to sole proprietorships and small business owners may overlap with consumer credit information, requiring careful data governance to ensure appropriate treatment.
MCI AltSignal™. This product provides alternative data encompassing utility payment histories, telecommunications payment records, and rental payment data, covering approximately 85 million consumer records. Delivery is via daily batch transmission (SFTP). The regulatory treatment of this data product is less settled than the MCI Consumer Credit File™ and is flagged as an open issue in Section VIII below. To the extent that MCI AltSignal™ data is used for FCRA-enumerated purposes (such as insurance underwriting), it may constitute "consumer report" information under FCRA, regardless of its characterization as "alternative data" by Meridian.
Total Estimated Volume. The combined monthly data volume across all three products is estimated at approximately 437 million records per month, representing approximately 87.4% of the 500-million-records-per-month base tier under the proposed pricing structure. This volume estimate is relevant both to the commercial terms of the MDLA and to the scale of Quorum's data governance and security obligations.
C. Quorum's Intended Uses
Quorum has identified the following intended uses for the Meridian data products, each of which must be evaluated against the applicable regulatory requirements:
Automated Underwriting Models. Quorum intends to integrate Meridian credit data into its automated underwriting decision engines across its P&C, life, and specialty insurance lines. The use of consumer credit information in insurance underwriting is a well-established practice in the industry, and the FCRA provides a specific permissible purpose for insurance-related consumer report access (Section 604(a)(3)(C)). However, the scope of permissible use varies by state, and certain states restrict or prohibit the use of credit information in insurance underwriting decisions.
Claims-Fraud Detection Algorithms. Quorum seeks to deploy Meridian data in its proprietary claims-fraud detection and investigation systems. The permissible purpose basis for this use requires careful analysis, as claims-fraud detection may not fall squarely within the insurance underwriting permissible purpose and may instead rely on alternative permissible purpose bases.
Customer Propensity Scoring. Quorum intends to use Meridian data to develop customer propensity models for marketing and cross-selling initiatives. The permissible purpose basis for marketing-related uses of consumer report data is more constrained under FCRA, and certain uses may require reliance on the "firm offer of credit or insurance" provisions of Section 604(c).
Derived Data Products — QuorumScore™. Of greatest regulatory significance, Quorum contemplates the development and potential commercialization of derived data products, including QuorumScore™, Quorum's proprietary predictive underwriting model. QuorumScore™ blends Meridian credit data with Quorum's first-party claims, policy, and telematics data to generate composite risk scores. Quorum has filed a trademark application with the United States Patent and Trademark Office (Serial No. 97/482,116) for the QuorumScore™ mark. Quorum projects that business-to-business licensing revenue from QuorumScore™ could reach $40–50 million by 2027. As discussed at length in Section III.D below, the commercialization of derived products that incorporate or are based on consumer report information raises the prospect that Quorum could itself become a consumer reporting agency under FCRA with respect to such products.
D. Counterparty Counsel
Meridian is represented in this transaction by Kessler Pruitt & Ashe LLP, a national law firm with offices in Atlanta, Georgia and New York, New York. The lead partner on the Meridian engagement is Graham Whitley. We have had several productive discussions with Mr. Whitley and his team regarding the structure of the MDLA and the regulatory issues identified in this memorandum. The principal areas of disagreement in the ongoing negotiation — the most favored nation pricing clause and the derived-data commercialization provisions — are discussed in Section VI below, including the regulatory overlay that informs our recommendations on those points.
III. Fair Credit Reporting Act (FCRA) — Analysis
A. Overview of FCRA Framework
The Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (the "FCRA"), enacted in 1970 and substantially amended by the Fair and Accurate Credit Transactions Act of 2003 ("FACTA"), establishes a comprehensive federal regulatory framework governing the collection, dissemination, and use of consumer credit information. The statute represents the foundational regulatory regime applicable to the proposed Meridian data-licensing arrangement and imposes obligations on both Meridian, as the entity that maintains and furnishes consumer credit data, and Quorum, as the entity that receives and uses that data.
Meridian as a Consumer Reporting Agency. Meridian, as a credit bureau that regularly engages in the practice of assembling and evaluating consumer credit information for the purpose of furnishing consumer reports to third parties, is a "consumer reporting agency" ("CRA") within the meaning of Section 603(f) of the FCRA, 15 U.S.C. § 1681a(f). This classification subjects Meridian to the full range of CRA obligations under the statute, including obligations regarding accuracy of information (Section 607(b)), reasonable procedures to limit furnishing of consumer reports to permissible purposes (Section 607(a)), consumer disclosure obligations (Section 609), and reinvestigation duties (Section 611). Meridian's CRA status is not in dispute and has been acknowledged by Meridian and its counsel in the course of the MDLA negotiations.
Consumer Reports. Data provided by Meridian via the MCI Consumer Credit File™ constitutes "consumer reports" under Section 603(d) of the FCRA, 15 U.S.C. § 1681a(d). The statute defines a "consumer report" broadly as any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for (A) credit or insurance to be used primarily for personal, family, or household purposes; (B) employment purposes; or (C) any other purpose authorized under Section 604. The MCI Consumer Credit File™ data unambiguously falls within this definition.
The MCI AltSignal™ data product (utility, telecom, and rental payment data) presents a closer question. To the extent that this data bears on consumers' creditworthiness, credit standing, or mode of living, and is used by Quorum for an enumerated purpose such as insurance underwriting, it would likely constitute consumer report information subject to the FCRA. The CFPB has issued guidance recognizing that alternative data sources may constitute consumer report information depending on their use. This issue is flagged for further analysis in Section VIII below.
The MCI CommercialView™ product (business credit data) is generally not subject to the FCRA, as the statute's protections apply to "consumers," defined in Section 603(c) as natural persons. However, we note that certain records within the MCI CommercialView™ database pertaining to sole proprietorships and individual business owners may contain information that overlaps with the consumer credit file, and Quorum should implement data governance procedures to identify and appropriately treat such records.
B. Permissible Purpose Requirements — Section 604
Section 604 of the FCRA, 15 U.S.C. § 1681b, enumerates the exclusive permissible purposes for which a CRA may furnish a consumer report. A CRA may not furnish a consumer report to any person unless the CRA has reason to believe that the person intends to use the information for one or more of the purposes specified in Section 604(a). This permissible purpose requirement is the central gatekeeping mechanism of the FCRA and imposes obligations on both the CRA (Meridian, which must have reasonable procedures to verify the recipient's permissible purpose) and the recipient (Quorum, which must certify its intended permissible purpose).
The following permissible purposes are applicable to Quorum's intended uses of Meridian data:
Section 604(a)(3)(C) — Insurance Underwriting. Under this provision, a CRA may furnish a consumer report to a person who it has reason to believe "intends to use the information in connection with the underwriting of insurance involving the consumer." This is Quorum's primary permissible purpose for accessing and using Meridian consumer credit data. The insurance underwriting permissible purpose is well-established in industry practice and has been the subject of regulatory guidance from the FTC and CFPB. It is important to note that this permissible purpose encompasses both the initial underwriting decision (i.e., whether to issue a policy and at what premium) and ongoing account review (i.e., renewal underwriting and mid-term policy modifications). Quorum should ensure that its FCRA permissible purpose certification specifies the full scope of insurance underwriting activities to which the data will be applied, including its P&C, life, and specialty lines of business.
Section 604(a)(3)(A) — Credit Transaction. This provision permits furnishing of a consumer report to a person who it has reason to believe intends to use the information in connection with a credit transaction involving the consumer. While insurance underwriting is Quorum's principal basis for accessing Meridian data, this permissible purpose may be applicable with respect to certain financial products offered by Quorum's subsidiaries, including premium finance arrangements. The scope of any credit-transaction permissible purpose certification should be limited to those Quorum subsidiaries and product lines for which a credit-transaction nexus exists.
Section 604(a)(3)(F)(i) — Legitimate Business Need. Under this provision, a consumer report may be furnished to a person who it has reason to believe "otherwise has a legitimate business need for the information — (i) in connection with a business transaction that is initiated by the consumer." This provision may serve as an alternative or supplemental permissible purpose basis for certain Quorum data uses, such as responding to consumer inquiries or processing consumer-initiated policy applications. However, reliance on this provision should be approached with caution, as its scope is narrower than the specific insurance underwriting permissible purpose and it requires that the transaction be consumer-initiated.
Certification Requirements. Section 607(a) of the FCRA requires that a CRA maintain reasonable procedures designed to limit the furnishing of consumer reports to the purposes listed under Section 604. In practice, this means that Meridian will require Quorum to execute a formal permissible purpose certification in connection with the MDLA. The proposed FCRA Permissible Purpose Certification, which will be attached as a schedule to the MDLA, is being prepared separately and should specify: (i) each applicable permissible purpose category; (ii) the specific lines of business and use cases to which each permissible purpose applies; (iii) a description of Quorum's internal compliance infrastructure for ensuring that data access and use is limited to certified permissible purposes; and (iv) a covenant by Quorum to notify Meridian of any changes to its intended uses that may affect the permissible purpose certification.
C. Restrictions on Use of Consumer Report Information
Beyond the threshold permissible purpose requirement, the FCRA imposes a number of specific restrictions and obligations on users of consumer report information that are directly relevant to Quorum's receipt and use of Meridian data:
Section 604(f) — Unauthorized Access. Section 604(f) of the FCRA imposes criminal liability on any person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses. This provision underscores the importance of Quorum's permissible purpose certification being accurate and complete. Any use of Meridian data outside the scope of the certified permissible purposes could expose Quorum to both civil and criminal liability under the FCRA.
Section 607(a) — CRA Reasonable Procedures. As noted above, Meridian, as a CRA, is obligated under Section 607(a) to maintain reasonable procedures to limit the furnishing of consumer reports to permissible purposes. In the context of the MDLA, this obligation will manifest as Meridian's requirement for detailed contractual representations and certifications from Quorum regarding its intended uses of the data, as well as Meridian's right to audit Quorum's compliance with those representations. Quorum should anticipate that Meridian will insist on robust audit rights in this area, and we recommend that Quorum agree to reasonable audit provisions subject to appropriate limitations on scope, frequency, and cost allocation.
Section 604(g) and Section 615 — Adverse Action Requirements. When Quorum takes an "adverse action" with respect to a consumer based in whole or in part on information contained in a consumer report, Section 615 of the FCRA requires Quorum to provide the consumer with an adverse action notice. In the insurance context, an adverse action includes a denial of insurance coverage, a cancellation or non-renewal of an insurance policy, or a change in the terms of coverage that is adverse to the consumer. The adverse action notice must include, among other things: (i) the name, address, and telephone number of the CRA that furnished the report (i.e., Meridian); (ii) a statement that the CRA did not make the adverse decision and is unable to provide the consumer with the specific reasons for the adverse action; and (iii) a notice of the consumer's right to obtain a free copy of the consumer report from the CRA within 60 days and to dispute the accuracy of any information in the report. Quorum must maintain systems and procedures to generate and deliver compliant adverse action notices across all of its insurance lines and in all jurisdictions in which it operates. The MDLA should include a covenant by Quorum to comply with these obligations and to indemnify Meridian against claims arising from Quorum's failure to provide adequate adverse action notices.
Section 612 and Section 609 — Consumer Access and Dispute Rights. The FCRA grants consumers the right to access the information in their credit files and to dispute the accuracy of that information. Section 609 requires CRAs to disclose to consumers, upon request, all information in the consumer's file, the sources of the information, and the identity of persons who have procured the consumer's report for certain purposes. Section 611 establishes a reinvestigation process for disputed information. While these obligations fall primarily on Meridian as the CRA, Quorum must be prepared to cooperate with Meridian in the dispute resolution process when consumers dispute information that Quorum has obtained from Meridian. The MDLA should include provisions establishing a clear protocol for handling consumer disputes, including Quorum's obligation to respond to Meridian's inquiries regarding disputed information within specified timeframes and to update its records to reflect the results of Meridian's reinvestigation.
D. FCRA Implications for Derived Data and QuorumScore™
The most significant FCRA issue presented by this transaction concerns the regulatory implications of Quorum's proposed development and commercialization of derived data products, particularly QuorumScore™. This issue has substantial implications for both the MDLA negotiation and Quorum's broader business strategy and warrants careful analysis.
The Core Issue. The critical question is whether scores, models, or analytics outputs created by Quorum using Meridian consumer report data as an input are themselves "consumer reports" under the FCRA. If so, and if Quorum furnishes those derived products to third parties, Quorum could itself become a "consumer reporting agency" under Section 603(f) with respect to such products, triggering the full range of CRA obligations — including accuracy requirements, consumer disclosure obligations, dispute resolution procedures, and permissible purpose verification for all downstream recipients.
Analysis of the "Consumer Report" Definition. Section 603(d) of the FCRA defines a "consumer report" as any communication by a consumer reporting agency that bears on a consumer's "credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living" and that is "used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for" credit, insurance, employment, or another authorized purpose. QuorumScore™, as currently conceived, generates individual-level risk scores that assess a consumer's insurability and predicted loss ratio. These outputs unambiguously bear on a consumer's "personal characteristics" and are intended to be used for the purpose of evaluating the consumer's eligibility for insurance. If Quorum furnishes these scores to third-party insurers or other commercial licensees, the outputs would very likely meet the statutory definition of a "consumer report."
CRA Classification Risk. Section 603(f) defines a "consumer reporting agency" as "any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties." If Quorum regularly furnishes QuorumScore™ outputs — which are assembled or evaluated from consumer credit information — to third-party commercial licensees, Quorum would satisfy each element of this definition and would be classified as a CRA. The projected B2B licensing revenue of $40–50 million by 2027 suggests that Quorum contemplates furnishing QuorumScore™ on a regular, ongoing basis to multiple third-party recipients, reinforcing the CRA classification risk.
Operational Implications of CRA Status. If Quorum were classified as a CRA, the operational and compliance implications would be substantial. Quorum would be required to: (i) maintain reasonable procedures to ensure maximum possible accuracy of the information in its files (Section 607(b)); (ii) maintain reasonable procedures to limit the furnishing of QuorumScore™ outputs to third parties with permissible purposes (Section 607(a)); (iii) verify the identity and permissible purpose of each downstream recipient before furnishing QuorumScore™ data; (iv) respond to consumer disclosure requests regarding information in QuorumScore™ files (Section 609); (v) investigate and resolve consumer disputes regarding the accuracy of QuorumScore™ data (Section 611); (vi) comply with prescreening requirements if QuorumScore™ is used in connection with firm offers of credit or insurance (Section 604(c)); and (vii) file as a CRA with the CFPB and comply with CFPB supervisory authority. These obligations would require significant investment in compliance infrastructure and would fundamentally alter the economics and operational model of the QuorumScore™ business.
Potential Exclusions. The FCRA contains certain exclusions from the definition of "consumer report" that Quorum should evaluate as potential structures for derived-data products. Most notably, Section 603(d)(2)(A)(i) excludes from the consumer report definition "any report containing information solely as to transactions or experiences between the consumer and the person making the report." If QuorumScore™ outputs could be structured to contain only information derived from Quorum's own first-party transactions and experiences with consumers (i.e., its claims data, policy data, and telematics data), without incorporating Meridian credit data or credit-data-derived features, the outputs would fall within this exclusion. However, the core value proposition of QuorumScore™ is its blending of Meridian credit data with Quorum first-party data, and stripping out the credit-data component would significantly diminish the product's predictive power and commercial value.
Recommendation. In light of the foregoing analysis, we recommend that any derived-data commercialization protocol in the MDLA account for Quorum's potential FCRA obligations. Specifically, Quorum should structure its derived-data products in one of two ways: (a) design products that qualify for an exclusion from the consumer report definition — for example, by generating sufficiently aggregated or de-identified outputs that do not bear on any individual consumer's characteristics and are not used or expected to be used to evaluate any individual consumer's eligibility for credit, insurance, or employment; or (b) accept CRA status with respect to derived products and build out the necessary compliance infrastructure to satisfy all CRA obligations. The choice between these approaches will depend on the commercial objectives for QuorumScore™ and the willingness to invest in CRA compliance infrastructure. We note that this analysis is being coordinated with Wendy Schultz and Omar Siddiqui, who are assessing the intellectual property dimensions of the derived-data strategy.
Cross-Reference. The separate memorandum on CCPA/CPRA implications for derived-data commercialization, currently in preparation, addresses the California privacy overlay that applies in addition to the FCRA analysis described here.
E. FCRA Enforcement and Penalties
The FCRA provides for multiple enforcement mechanisms that underscore the importance of compliance:
Federal Enforcement. The Federal Trade Commission ("FTC") and the Consumer Financial Protection Bureau ("CFPB") share enforcement authority under the FCRA. The CFPB has supervisory authority over larger consumer reporting agencies (those handling more than a specified volume of consumer reports annually) and has been increasingly active in FCRA enforcement actions. The FTC retains enforcement authority over entities not subject to CFPB supervision. In recent years, both agencies have brought significant enforcement actions against CRAs and users of consumer reports, resulting in consent orders with substantial monetary penalties and injunctive relief.
Private Right of Action. The FCRA provides consumers with a private right of action for both willful and negligent noncompliance. Section 616 provides that any person who willfully fails to comply with any requirement of the FCRA with respect to any consumer is liable to that consumer for: (i) actual damages sustained by the consumer or statutory damages of not less than $100 and not more than $1,000 per violation; (ii) punitive damages as the court may allow; and (iii) reasonable attorneys' fees and costs. Section 617 provides that any person who is negligent in failing to comply with any requirement of the FCRA is liable for: (i) actual damages sustained by the consumer; and (ii) reasonable attorneys' fees and costs. Given the scale of Meridian data that Quorum will be processing — approximately 310 million consumer records from the MCI Consumer Credit File™ alone — even modest per-consumer statutory damages could aggregate to extraordinary liability exposure in a class action.
State Enforcement. State attorneys general are authorized under Section 621(a)(1) of the FCRA to bring civil actions in federal district court to enforce the FCRA on behalf of their state's residents. Several state attorneys general have exercised this authority in recent years, and Quorum's multi-state operations expose it to enforcement risk in multiple jurisdictions.
Relevance to MDLA. The enforcement and penalty provisions of the FCRA have direct implications for the risk allocation provisions of the MDLA. The indemnification provisions should clearly allocate FCRA compliance risk between Quorum and Meridian, with each party indemnifying the other for FCRA liabilities arising from the indemnifying party's breach of its FCRA-related representations, warranties, and covenants. The limitation of liability provisions should be drafted with careful attention to whether FCRA liabilities are carved out from any general cap on damages, as is customary in data-licensing transactions of this nature.
F. Recommended MDLA Provisions — FCRA
Based on the foregoing analysis, we recommend that the MDLA and its ancillary agreements include the following FCRA-related provisions:
1. FCRA Permissible Purpose Certification Schedule. A detailed schedule to be attached to the MDLA, specifying each applicable permissible purpose category (insurance underwriting under Section 604(a)(3)(C); credit transaction under Section 604(a)(3)(A), to the extent applicable; legitimate business need under Section 604(a)(3)(F)(i), to the extent applicable), the lines of business to which each applies, and a description of Quorum's compliance infrastructure. This schedule is being prepared separately.
2. Permissible Purpose Representation and Warranty. A representation and warranty by Quorum that it will access and use consumer report data obtained from Meridian solely for the permissible purposes certified in the FCRA Permissible Purpose Certification Schedule, and that it will not use such data for any purpose not so certified without prior written amendment to the schedule and prior written consent of Meridian.
3. CRA Compliance Representation and Warranty. A representation and warranty by Meridian that it is a consumer reporting agency as defined in Section 603(f) of the FCRA and that it maintains reasonable procedures in compliance with Section 607 to ensure the accuracy of consumer report information and to limit the furnishing of consumer reports to persons with permissible purposes.
4. Adverse Action Notice Covenant. A covenant by Quorum to comply with all adverse action notice obligations under Section 615 of the FCRA when it takes adverse action with respect to any consumer based in whole or in part on information obtained from Meridian, and to maintain systems and procedures reasonably designed to ensure such compliance across all of its insurance lines and jurisdictions.
5. Use Restriction Covenant. A covenant by Quorum not to use consumer report data obtained from Meridian for any purpose not certified in the FCRA Permissible Purpose Certification Schedule, including but not limited to employment screening, tenant screening, or direct marketing (except to the extent permitted under the firm offer of credit or insurance provisions of Section 604(c)).
6. Derived-Data Commercialization Covenant. A covenant providing that if Quorum's commercialization of derived data products (including QuorumScore™) to third parties causes Quorum to become a consumer reporting agency under Section 603(f) of the FCRA, Quorum shall independently assume and bear all CRA compliance obligations with respect to such products, including but not limited to accuracy requirements, consumer disclosure obligations, dispute resolution procedures, and permissible purpose verification for downstream recipients, and shall indemnify Meridian against any claims arising from Quorum's CRA activities.
7. Mutual Indemnification. Mutual indemnification provisions pursuant to which each party indemnifies the other for FCRA liabilities (including regulatory penalties, private action damages, and defense costs) attributable to the indemnifying party's breach of its FCRA-related representations, warranties, and covenants under the MDLA.
8. Audit Rights. A provision granting Meridian the right to audit Quorum's compliance with FCRA requirements, including permissible purpose certification, adverse action notice procedures, and data use restrictions. The scope, frequency, notice requirements, and cost allocation for such audits are subject to negotiation; we recommend that Quorum agree to annual compliance audits conducted by a mutually agreed-upon independent third party, with the cost borne by Meridian (unless the audit reveals a material compliance deficiency, in which case Quorum bears the cost).
9. Consumer Dispute Resolution Procedures. A provision establishing a protocol for handling consumer disputes, including: (a) Meridian's obligation to promptly notify Quorum of any consumer dispute regarding data used by Quorum; (b) Quorum's obligation to cooperate with Meridian's reinvestigation and to respond to Meridian's inquiries within five (5) business days; and (c) Quorum's obligation to update its records to reflect the results of any Meridian reinvestigation.
IV. Gramm-Leach-Bliley Act (GLBA) — Analysis
A. Overview of GLBA Framework
The Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809 (the "GLBA"), enacted in 1999, imposes comprehensive obligations on "financial institutions" regarding the privacy and security of consumers' nonpublic personal information ("NPI"). The GLBA is the second principal federal regulatory regime applicable to the proposed Meridian data-licensing arrangement and operates alongside, and in certain respects overlaps with, the FCRA.
Both Quorum and Meridian qualify as "financial institutions" subject to the GLBA. Quorum is a financial institution by virtue of its status as an insurance company engaged in the business of insurance, which is expressly included within the GLBA's broad definition of "financial institution" (Section 509(3)(A), incorporating the definition from Section 4(k) of the Bank Holding Company Act). Meridian is a financial institution by virtue of its engagement in consumer credit reporting, which is a financial activity subject to GLBA regulation.
Two principal components of the GLBA are relevant to the proposed transaction:
(a) The Financial Privacy Rule — which restricts financial institutions' ability to disclose consumers' NPI to nonaffiliated third parties and requires notice to consumers regarding privacy practices. For Meridian, this rule is implemented through Regulation P (12 C.F.R. Part 1016), promulgated by the CFPB. For Quorum, as an insurance company, the privacy rule is implemented primarily through state insurance department regulations adopted pursuant to the NAIC Model Privacy Regulation, which is designed to implement the GLBA privacy provisions in the insurance context.
(b) The Safeguards Rule — which requires financial institutions to develop, implement, and maintain a comprehensive information security program containing administrative, technical, and physical safeguards appropriate to the size and complexity of the institution, the nature and scope of its activities, and the sensitivity of the customer information at issue. For non-bank financial institutions under FTC jurisdiction, the Safeguards Rule is codified at 16 C.F.R. Part 314 (as amended effective June 9, 2023, with significant enhancements to the security program requirements). For Quorum, the safeguards requirements are implemented through state insurance data-security regulations, discussed in Section V below.
B. GLBA Financial Privacy Rule — Restrictions on Data Sharing
Section 502(a) of the GLBA establishes a general prohibition against financial institutions disclosing NPI to nonaffiliated third parties unless the institution has provided notice to the consumer and an opportunity to opt out, or unless an exception to the opt-out requirement applies. NPI is defined broadly to include any information that a consumer provides to a financial institution, that results from a transaction with the consumer, or that a financial institution otherwise obtains about a consumer in connection with providing a financial product or service.
In the context of the proposed transaction, Meridian is the "disclosing" financial institution, and Quorum is the "receiving" nonaffiliated third party. Meridian must ensure that its sharing of consumer NPI with Quorum complies with the GLBA privacy rule — either by relying on an applicable exception or by having provided appropriate consumer notice and opt-out opportunity.
The following GLBA exceptions are potentially applicable:
Section 502(e)(1) — Transaction-Related Disclosure. This exception permits disclosure of NPI to a nonaffiliated third party when the disclosure is necessary to effect, administer, or enforce a transaction requested or authorized by the consumer. In the insurance context, this exception may apply when a consumer submits an application for insurance to Quorum and Quorum obtains the consumer's credit report from Meridian to evaluate the application — the consumer's act of applying for insurance could be deemed to authorize the transaction-related disclosure. However, the breadth of this exception is limited, and it may not cover all of Quorum's intended uses of Meridian data, particularly batch data access for model development, propensity scoring, and derived-product commercialization that are not tied to a specific consumer-initiated transaction.
Section 502(e)(5) — CRA Disclosure. This exception permits disclosure of NPI to a consumer reporting agency in accordance with the FCRA. While this exception is framed to address the flow of information to a CRA rather than from a CRA, the interplay between the GLBA and the FCRA is relevant: the FCRA permissible purpose framework effectively serves as the primary gatekeeping mechanism for Meridian's furnishing of consumer reports to Quorum. Where Meridian furnishes consumer reports to Quorum pursuant to a valid FCRA permissible purpose, the GLBA privacy rule is largely coordinated with and does not impose additional barriers to that disclosure. The CFPB has acknowledged this coordination in its regulatory guidance.
Other Exceptions. Additional GLBA exceptions that may be relevant include the exception for disclosures to comply with federal, state, or local laws (Section 502(e)(8)) and the exception for disclosures to protect against fraud (Section 502(e)(3)(B)), which may support Quorum's claims-fraud detection use case.
Contractual Implication. Regardless of the specific exceptions relied upon, the MDLA should include a representation and warranty by Meridian that its furnishing of NPI to Quorum complies with all applicable GLBA notice, opt-out, and exception requirements. This representation shifts the risk of GLBA privacy rule non-compliance to Meridian as the party best positioned to ensure that its own consumer disclosures and opt-out procedures are adequate.
C. GLBA Safeguards Rule
The GLBA Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive information security program containing administrative, technical, and physical safeguards appropriate to protect the security, confidentiality, and integrity of customer information. The FTC's revised Safeguards Rule (16 C.F.R. Part 314), which became effective on June 9, 2023, significantly enhanced the requirements for non-bank financial institutions, including requirements for designation of a qualified individual to oversee the security program, written risk assessments, access controls, encryption, multi-factor authentication, and incident response planning.
Quorum's Obligations. Quorum, as a financial institution receiving substantial volumes of NPI from Meridian, must maintain safeguards appropriate to protect the security and confidentiality of that information. Quorum's information security program must encompass the full lifecycle of Meridian data within Quorum's systems — from ingestion (via SFTP batch and REST API) through storage, processing, analysis, and eventual deletion or return. Quorum's safeguards program is subject to oversight by state insurance regulators (rather than the FTC), and the specific requirements are discussed in Section V below. However, the GLBA establishes the baseline federal obligation that state insurance regulations implement.
Meridian's Obligations. Meridian must maintain its own comprehensive information security program in compliance with the Safeguards Rule. As a non-bank financial institution under FTC jurisdiction, Meridian is directly subject to the FTC's revised rule. In the context of the MDLA negotiation, Meridian has represented that it maintains a SOC 2 Type II audit report (issued by Galloway Nash LLP, covering the period ending March 31, 2023) and ISO 27001 certification as evidence of its information security practices. Quorum should review these certifications carefully to verify that they cover the relevant systems and controls applicable to the data products being licensed. We have flagged this as an open item in Section VIII below.
Quorum's Certifications. Quorum maintains a SOC 2 Type II audit report (issued by Felton Thorpe & Co. LLP, covering the period ending December 31, 2023) and should ensure that its SOC 2 scope encompasses the systems and processes that will receive, store, and process Meridian data. We understand from discussions with Priya Nair that Quorum intends to ingest Meridian data into its enterprise data lake, which is hosted in a cloud environment. The SOC 2 audit scope should cover this cloud infrastructure.
D. GLBA Service Provider Oversight
Section 501(b) of the GLBA and the Interagency Guidelines Establishing Information Security Standards require financial institutions to oversee third-party service providers that have access to customer information. The guidelines specify that a financial institution must: (i) exercise appropriate due diligence in selecting its service providers; (ii) require its service providers by contract to implement appropriate measures designed to meet the guidelines' security objectives; and (iii) where indicated by the institution's risk assessment, monitor its service providers to confirm that they have satisfied their obligations.
Although the Quorum-Meridian relationship is structured as a licensor-licensee data-licensing arrangement rather than a traditional service provider relationship, the data flows create analogous oversight obligations. Each party is, in effect, a third party with access to the other's consumer information: Meridian holds the raw consumer data and transmits it to Quorum; Quorum receives and processes that data and may create derivative products. State insurance regulators — particularly the New York DFS under 23 NYCRR 500 — have adopted expansive definitions of "third-party service provider" that could encompass data licensors. Accordingly, both parties should approach the MDLA with the understanding that the service provider oversight framework applies, and the contractual provisions should reflect this reality.
Recommendation. The MDLA and Data Security Addendum should include provisions allowing each party to conduct periodic security assessments of the other's data handling practices, including the right to review SOC 2 reports, ISO certifications, and other audit evidence; the right to conduct questionnaire-based security assessments; and, in the event of a data security incident, the right to conduct a more detailed on-site assessment or engage a mutually agreed-upon independent assessor.
E. Recommended MDLA Provisions — GLBA
Based on the foregoing analysis, we recommend that the MDLA include the following GLBA-related provisions:
1. Meridian Privacy Compliance Representation. A representation and warranty by Meridian that its disclosure of NPI to Quorum pursuant to the MDLA complies with all applicable GLBA privacy notice, opt-out, and exception requirements, including Regulation P and any state-specific insurance privacy regulations applicable to Meridian's activities.
2. Quorum Safeguards Representation. A representation and warranty by Quorum that it maintains a comprehensive information security program compliant with GLBA Safeguards Rule requirements and all applicable state insurance data-security regulations, including 23 NYCRR 500, and that such program covers the receipt, storage, processing, and use of Meridian NPI.
3. Annual Certification Exchange. A covenant requiring both parties to provide annual certifications of compliance with the GLBA and related regulations, including delivery of updated SOC 2 Type II reports and other relevant audit evidence.
4. Cross-Reference to Data Security Addendum. An express cross-reference to the Data Security Addendum for detailed security standards, minimum controls, and technical requirements, which should be drafted to incorporate the GLBA Safeguards Rule requirements as a floor, with additional controls as required by 23 NYCRR 500 and other applicable state regulations.
5. NPI Re-Disclosure Restrictions. Restrictions on Quorum's further disclosure of NPI received from Meridian to nonaffiliated third parties, except as expressly permitted by the MDLA's derived-data commercialization provisions (Article VII) and in compliance with GLBA, FCRA, and applicable state law. These restrictions should be coordinated with the derived-data provisions to ensure consistency and to avoid creating unintended conflict between the data commercialization rights and the privacy restrictions.
6. Quorum Privacy Notice Obligations. A provision addressing Quorum's obligation to provide privacy notices to its own policyholders and applicants regarding its receipt and use of consumer credit data from third-party sources, including Meridian, in accordance with applicable state insurance privacy regulations.
V. State Insurance Data-Security Regulations
A. Overview of Multi-State Landscape
As a multi-line insurance carrier holding licenses in all 50 states, the District of Columbia, and several U.S. territories, Quorum is subject to the insurance department regulations and data-security requirements of each jurisdiction in which it operates. The state insurance regulatory landscape for data security has evolved significantly in recent years, driven in large part by the National Association of Insurance Commissioners' ("NAIC") adoption of the Insurance Data Security Model Law (Model Law #668) in October 2017 and the New York Department of Financial Services' issuance of its landmark Cybersecurity Regulation (23 NYCRR 500) in March 2017.
The key regulatory frameworks applicable to Quorum's receipt and processing of Meridian data include: (i) the Connecticut Insurance Data Security Act (Conn. Gen. Stat. § 38a-38 et seq.), which governs Quorum's home-state regulatory obligations; (ii) the New York DFS Cybersecurity Regulation (23 NYCRR 500), which applies to Quorum as an entity licensed under the New York Insurance Law and which represents the most stringent state-level data-security regulation in the nation; and (iii) the NAIC Insurance Data Security Model Law, which has been adopted in whole or in substantial part by a growing number of states.
Quorum's VP of Regulatory & Compliance, Claudia Reeves, has been identified as the internal lead for insurance regulatory review of data usage under the Meridian license. As discussed in Section VIII below, we recommend that Quorum provide us with a complete list of its insurance licenses to enable a comprehensive mapping of applicable state data-security requirements.
B. Connecticut Insurance Data Security Requirements
Quorum is headquartered in Stamford, Connecticut, and is therefore subject to the Connecticut Insurance Department's regulatory oversight as its domestic regulator. Connecticut has adopted the NAIC Insurance Data Security Model Law, codified at Conn. Gen. Stat. § 38a-38 et seq., which became effective on October 1, 2020.
The Connecticut Insurance Data Security Act imposes the following requirements that are directly relevant to the Meridian data-licensing arrangement:
Comprehensive Written Information Security Program. Quorum must develop, implement, and maintain a comprehensive written information security program that contains administrative, technical, and physical safeguards for the protection of nonpublic information. The program must be commensurate with the size and complexity of Quorum, the nature and scope of its activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by or in the custody of Quorum. The ingestion of Meridian credit data — encompassing hundreds of millions of consumer records — significantly increases both the volume of nonpublic information in Quorum's custody and the complexity of Quorum's data processing activities, and the information security program must be updated to account for these changes.
Risk Assessment. Quorum must conduct a risk assessment that identifies reasonably foreseeable internal and external threats that could result in unauthorized access to or misuse of nonpublic information, assesses the likelihood and potential damage of these threats, and evaluates the sufficiency of existing safeguards. The risk assessment must specifically address the risks posed by the receipt and processing of large-scale third-party credit data, including risks related to data transmission security, data lake security, access control, and insider threats.
Third-Party Service Provider Oversight. The Connecticut Act requires licensees to exercise due diligence in selecting third-party service providers and to require such providers to implement appropriate security measures. In the context of the Meridian arrangement, this obligation requires Quorum to conduct due diligence on Meridian's security practices before entering into the MDLA and to include contractual provisions requiring Meridian to maintain security measures consistent with the Connecticut Act's requirements. The MDLA and DSA should be drafted to satisfy this obligation.
Cybersecurity Event Investigation and Notification. Quorum must investigate any cybersecurity event (defined broadly to include any unauthorized access to or disruption of information systems or nonpublic information) and notify the Connecticut Insurance Commissioner of any cybersecurity event that has a reasonable likelihood of materially harming any consumer residing in Connecticut or any material part of Quorum's normal operations. The notification must be made within three (3) business days of the determination that a cybersecurity event has occurred.
Annual Certification. Quorum must annually certify to the Connecticut Insurance Department its compliance with the requirements of the Act, including its information security program, risk assessment, and third-party service provider oversight. This certification requirement creates an ongoing compliance obligation that Quorum must factor into its program maintenance and audit schedule.
C. New York DFS Cybersecurity Regulation (23 NYCRR 500)
The New York Department of Financial Services Cybersecurity Regulation, 23 NYCRR 500, applies to all entities operating under a license, registration, charter, certificate, permit, accreditation, or similar authorization under the New York Banking Law, the New York Insurance Law, or the New York Financial Services Law. Quorum, as an insurer licensed in the State of New York, is a "Covered Entity" within the meaning of 23 NYCRR 500 and is subject to its requirements.
23 NYCRR 500 is widely regarded as the most comprehensive and prescriptive state-level data-security regulation in the United States. Its requirements go well beyond those of the NAIC Model Law in several respects and effectively establish the highest-water mark for state insurance data-security compliance. For this reason, we recommend that the MDLA and DSA be drafted to the 23 NYCRR 500 standard, which will ensure compliance with the requirements of other states as well.
The following provisions of 23 NYCRR 500 are specifically applicable to the Meridian data-licensing arrangement:
Section 500.02 — Cybersecurity Program. Quorum must maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of its information systems. The program must be based on Quorum's risk assessment and must be designed to perform core cybersecurity functions, including identification and assessment of internal and external cybersecurity risks, implementation of defensive infrastructure, detection of cybersecurity events, response to and mitigation of identified cybersecurity events, recovery from cybersecurity events, and fulfillment of all applicable regulatory reporting obligations. The cybersecurity program must specifically encompass the systems that receive, store, and process Meridian data, including the enterprise data lake, API gateway infrastructure, and any downstream analytical systems.
Section 500.03 — Cybersecurity Policy. Quorum must implement and maintain a written cybersecurity policy, approved by a senior officer or the board of directors, that addresses the following areas, among others:
• Data governance and classification (including classification of Meridian data by sensitivity level);
• Access controls and identity management (including role-based access to Meridian data);
• Asset inventory and device management;
• Systems and network security, systems and network monitoring;
• Customer data privacy;
• Vendor and third-party service provider management (specifically including Meridian);
• Risk assessment;
• Incident response.
Section 500.04 — Chief Information Security Officer (CISO). Quorum must designate a qualified individual to serve as its CISO, responsible for overseeing and implementing the cybersecurity program and enforcing the cybersecurity policy. The CISO must report at least annually to the board of directors or equivalent governing body on the cybersecurity program, including material cybersecurity risks, the overall effectiveness of the program, and material cybersecurity events. To the extent that the Meridian data-licensing arrangement introduces new cybersecurity risks, these must be reflected in the CISO's reporting.
Section 500.07 — Access Privileges. As part of its cybersecurity program, Quorum must limit access privileges to information systems that provide access to nonpublic information solely to those individuals who require such access for the performance of their responsibilities, and must periodically review such access privileges. This requirement is directly applicable to Quorum's access to and processing of Meridian consumer credit data. Quorum must implement and enforce role-based access controls that restrict access to Meridian data to only those employees, contractors, and systems that have a legitimate business need for such access.
Section 500.09 — Risk Assessment. Quorum must conduct