1025-00008 · Quorum Insurance Holdings · Transaction Documents/Data Security & Privacy

fcra-permissible-purpose-certification.docx DOCUMENT M&A / Corporate

56 / 76 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

Schedule F — FCRA Permissible Purpose Certification

Schedule to the Master Data License Agreement by and between Meridian Credit intelligence, Inc. and Quorum Insurance Holdings Corp.

DRAFT — Prepared by Calderwood & Harkness LLP — February 2023 C&H Matter No. 1025-00008

Prepared by: Lisa Johannsen, Associate Data Privacy & Cybersecurity Practice Group Calderwood & Harkness LLP

Reviewed by: David Cartwright, Partner Data Privacy & Cybersecurity Practice Group Calderwood & Harkness LLP

Right-click to update Table of Contents

RECITALS

A. This Schedule F (this "Schedule" or "Certification") is attached to and forms an integral part of that certain Master Data License Agreement (the "MDLA" or "Agreement") entered into by and between Meridian Credit intelligence, Inc., a Georgia corporation ("Licensor" or "Meridian"), with its principal place of business at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326, and Quorum Insurance Holdings Corp., a Delaware corporation ("Licensee" or "Quorum"), with its principal place of business at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901. Capitalized terms used but not otherwise defined herein shall have the meanings ascribed to them in the MDLA.

B. Meridian is a consumer reporting agency ("CRA") as that term is defined under the Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq. ("FCRA"), and in the ordinary course of its business assembles, evaluates, and furnishes consumer reports and consumer credit information to permissible users thereof. Meridian maintains one of the largest proprietary consumer credit databases in the United States and provides data products and analytical services to financial institutions, insurance carriers, telecommunications providers, and other entities with permissible purposes to access consumer report information.

C. Pursuant to the MDLA, Meridian has agreed to license to Quorum access to certain data products that contain consumer information subject to the FCRA, specifically:

(i) MCI Consumer Credit File™ — a comprehensive consumer credit database containing approximately 310 million consumer records, refreshed daily via batch delivery and real-time API access, which includes trade-line data, public record information, credit inquiries, and other consumer credit information assembled by Meridian in its capacity as a CRA;

(ii) MCI AltSignal™ — an alternative-data consumer information product containing approximately 85 million consumer records, refreshed daily via batch delivery, which includes utility payment data, telecommunications payment data, rental payment history, and other non-traditional consumer credit indicators assembled by Meridian; and

(iii) MCI CommercialView™ — a commercial credit database containing approximately 42 million business records, which consists of commercial credit data and is generally not subject to FCRA consumer-report requirements. MCI CommercialView™ is excluded from the scope of this Schedule; provided, however, that the parties acknowledge that MCI CommercialView™ may contain information on sole proprietorships and individual guarantors that could implicate FCRA consumer-report requirements, and the parties shall address the treatment of such records in accordance with the provisions of the MDLA and applicable law.

D. The FCRA, including Section 604 thereof (15 U.S.C. § 1681b), restricts the circumstances under which consumer reports may be furnished by a CRA and imposes obligations on both CRAs and the users of consumer reports. In addition, various state statutes that are analogous to or supplement the FCRA (collectively, "State FCRA Analogues") impose additional or complementary requirements on the furnishing and use of consumer credit information. Regulations promulgated by the Consumer Financial Protection Bureau ("CFPB") under Regulation V (12 C.F.R. Part 1022) and by the Federal Trade Commission ("FTC") further govern the obligations of CRAs and users of consumer reports.

E. As a condition to Meridian's furnishing of consumer reports and consumer credit information to Quorum under the MDLA, and in accordance with Meridian's obligations as a CRA under FCRA Section 607(a) to maintain reasonable procedures to limit the furnishing of consumer reports to permissible purposes, Quorum is providing this Certification to establish and document its permissible purpose(s) for obtaining consumer reports and consumer credit information from Meridian.

F. The parties intend that this Schedule, together with the MDLA and all other schedules, addenda, and exhibits thereto, shall constitute the complete agreement between the parties with respect to FCRA permissible purpose certification, and that the terms of this Schedule shall be binding upon the parties and their respective successors, assigns, affiliates, and subsidiaries to the extent set forth herein.

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth in the MDLA and this Schedule, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

SECTION 1: DEFINITIONS

For purposes of this Schedule, the following terms shall have the meanings set forth below. All other capitalized terms used in this Schedule and not defined herein shall have the meanings ascribed to them in the MDLA.

1.1 "Consumer Report" shall have the meaning ascribed to such term in Section 603(d) of the FCRA (15 U.S.C. § 1681a(d)), and shall mean any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for: (a) credit or insurance to be used primarily for personal, family, or household purposes; (b) employment purposes; or (c) any other purpose authorized under Section 604 of the FCRA. The term "Consumer Report" does not include (i) any report containing information solely as to transactions or experiences between the consumer and the person making the report, (ii) any communication of information among persons related by common ownership or affiliated by corporate control, if it is clearly and conspicuously disclosed to the consumer that the information may be communicated among such persons and the consumer is given the opportunity to direct that such information not be communicated, (iii) any authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device, or (iv) any report in which a person who has been requested by a third party to make a specific extension of credit directly or indirectly to a consumer conveys his or her decision with respect to such request, provided that the third party advises the consumer of the name and address of the person to whom the request was made.

1.2 "Consumer Reporting Agency" shall have the meaning ascribed to such term in Section 603(f) of the FCRA (15 U.S.C. § 1681a(f)), and shall mean any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports. Meridian is acknowledged by the parties to be a Consumer Reporting Agency with respect to the MCI Consumer Credit File™ and MCI AltSignal™ data products.

1.3 "Permissible Purpose" shall mean any purpose enumerated under Section 604(a) of the FCRA (15 U.S.C. § 1681b(a)) for which a person may lawfully obtain a Consumer Report from a Consumer Reporting Agency, including, without limitation, the purposes set forth in Sections 604(a)(3)(A) through 604(a)(3)(F) thereof.

1.4 "Licensed Consumer Data" shall mean all Consumer Report information and consumer credit data furnished by Meridian to Quorum under the MDLA, including, without limitation, all data elements, records, files, and information contained in or delivered through the MCI Consumer Credit File™ and MCI AltSignal™ data products. For the avoidance of doubt, the term "Licensed Consumer Data" includes data furnished via batch delivery, real-time API access, and any other delivery mechanism specified in the MDLA.

1.5 "Insurance Transaction" shall mean the underwriting of insurance as described in Section 604(a)(3)(C) of the FCRA (15 U.S.C. § 1681b(a)(3)(C)), including, without limitation, the evaluation of an individual's application for insurance coverage, the setting of premiums, the determination of policy terms and conditions, and any other decision made by an insurer in connection with the issuance or proposed issuance of an insurance policy to a consumer.

1.6 "Account Review" shall mean a review of an existing insurance account or policy as described in Section 604(a)(3)(F)(ii) of the FCRA (15 U.S.C. § 1681b(a)(3)(F)(ii)), including, without limitation, a review conducted to determine whether a consumer continues to meet the terms of an existing insurance account or policy, renewal underwriting, periodic risk reassessment during the policy term, and any other review of an existing insurance relationship initiated by the insurer for a legitimate business purpose.

1.7 "Derived Data" shall have the meaning ascribed to such term in Article VII of the MDLA. The parties acknowledge and agree that, as of the date of this draft, the treatment of Derived Data under the MDLA remains a disputed term subject to ongoing negotiation between the parties. Notwithstanding any contractual resolution of the Derived Data provisions under Article VII of the MDLA, the FCRA obligations set forth in this Schedule shall apply to any Derived Data that constitutes or contains a Consumer Report or Consumer Report information, as further described in Section 7 of this Schedule.

1.8 Cross-References. All other capitalized terms used in this Schedule and not defined herein, including, without limitation, the terms "Effective Date," "Term," "Confidential Information," "Intellectual Property," "Data Security Addendum," "Data Processing Agreement," and "Authorized Users," shall have the meanings ascribed to such terms in the MDLA and the applicable schedules, addenda, and exhibits thereto.

SECTION 2: CERTIFICATION OF PERMISSIBLE PURPOSE

2.1 Primary Permissible Purposes

Quorum hereby certifies to Meridian that it will access, obtain, and use Licensed Consumer Data solely for the following Permissible Purposes, as authorized under Section 604(a) of the FCRA:

2.1.1 Insurance Underwriting — Section 604(a)(3)(C).

Quorum certifies that it will use Licensed Consumer Data in connection with the underwriting of insurance as authorized under Section 604(a)(3)(C) of the FCRA (15 U.S.C. § 1681b(a)(3)(C)). Quorum is a multi-line insurance carrier and insurance-technology platform operator engaged in the underwriting of property and casualty insurance, life insurance, and specialty lines of insurance across multiple jurisdictions within the United States. Quorum holds active insurance carrier licenses or is authorized to transact insurance business in all fifty (50) states, the District of Columbia, and Puerto Rico, and operates through its subsidiaries and affiliated entities as set forth in Exhibit C to the MDLA.

Quorum will use data obtained from the MCI Consumer Credit File™ and MCI AltSignal™ products to evaluate consumers' eligibility for insurance coverage, establish and set insurance premiums, make underwriting decisions regarding the acceptance or rejection of insurance applications, determine policy terms and conditions, assign consumers to appropriate risk classifications, and perform all other activities reasonably incident to the underwriting of insurance. This includes the use of Licensed Consumer Data as inputs to Quorum's automated underwriting models, predictive analytics engines, and risk-scoring algorithms, including, without limitation, the proprietary QuorumScore™ predictive underwriting model (United States Patent and Trademark Office application pending, Serial No. 97/482,116). Quorum's use of Licensed Consumer Data in automated underwriting systems is further addressed in Section 6 of this Schedule.

Quorum further certifies that its use of Licensed Consumer Data for insurance underwriting purposes is directly related to and in furtherance of bona fide Insurance Transactions in which the consumer whose Consumer Report is obtained has either (a) applied for insurance coverage with Quorum or one of its affiliated insurance carriers, or (b) is otherwise the subject of a legitimate underwriting evaluation initiated by Quorum in the ordinary course of its insurance business.

2.1.2 Account Review — Section 604(a)(3)(F)(ii).

Quorum certifies that it will use Licensed Consumer Data for the review and maintenance of existing insurance accounts and policies as authorized under Section 604(a)(3)(F)(ii) of the FCRA (15 U.S.C. § 1681b(a)(3)(F)(ii)). Specifically, Quorum will use Licensed Consumer Data to determine whether existing policyholders continue to meet the terms and conditions of their insurance policies, to conduct renewal underwriting in connection with the expiration and potential renewal of existing policies, to perform periodic risk reassessment during the policy term, to evaluate changes in a policyholder's risk profile that may affect premium pricing or coverage eligibility, and to perform all other activities reasonably incident to the review and maintenance of an existing insurance account.

Quorum's Account Review use of Licensed Consumer Data shall be limited to consumers with whom Quorum or one of its affiliated insurance carriers has an existing insurance relationship at the time of the data access. Quorum shall not use the Account Review permissible purpose to access Licensed Consumer Data with respect to consumers who do not have an active, in-force insurance policy or pending insurance application with Quorum or its affiliates.

2.2 Additional Permissible Purposes (If Applicable)

2.2.1 Claims Investigation and Fraud Detection — Section 604(a)(3)(D).

Quorum's intended use of Licensed Consumer Data extends to claims-fraud detection and claims investigation activities that are performed in connection with Quorum's insurance operations. Quorum utilizes proprietary claims-fraud detection algorithms and investigative analytics tools that incorporate Licensed Consumer Data to identify potentially fraudulent insurance claims, detect patterns of claims activity indicative of organized fraud rings, and support the investigation and adjudication of insurance claims submitted by policyholders.

The parties acknowledge that the permissible purpose basis for Quorum's claims-fraud detection activities may be analyzed under either (a) Section 604(a)(3)(C) of the FCRA, as an activity incident to the underwriting of insurance, or (b) Section 604(a)(3)(D)(i) of the FCRA, as a review of an account to determine whether the consumer continues to meet the terms of an existing account or as a legitimate business need for the information in connection with a business transaction that is initiated by the consumer. To the extent that Quorum's claims-fraud detection and claims investigation activities constitute a separate and independent permissible purpose under Section 604(a)(3)(D), Quorum hereby certifies such purpose in addition to the primary permissible purposes set forth in Section 2.1 above. Quorum represents that its claims-fraud detection activities are conducted solely in connection with and as a component of Quorum's insurance relationship with the consumer whose Consumer Report is accessed, and are not conducted for any purpose unrelated to Quorum's insurance operations.

2.2.2 Reservation of Right to Supplement.

Quorum reserves the right to supplement this Certification with additional Permissible Purpose categories if Quorum's intended uses of Licensed Consumer Data expand during the five-year Term of the MDLA or any renewal thereof. Any such supplemental certification shall be provided in writing to Meridian prior to Quorum's accessing Licensed Consumer Data for the new purpose and shall be in a form reasonably acceptable to Meridian. No supplemental certification shall be effective until acknowledged in writing by Meridian's Chief Privacy Officer or designee. Quorum acknowledges that any expanded use of Licensed Consumer Data must independently comply with all applicable FCRA requirements and that Meridian retains the right to decline to furnish Consumer Reports for any purpose that Meridian, in its reasonable discretion, determines does not constitute a valid Permissible Purpose under the FCRA.

2.3 Negative Certification / Prohibited Uses

Quorum hereby certifies that it will not access, obtain, or use Licensed Consumer Data for any purpose not authorized under Section 604 of the FCRA, including, without limitation, the following prohibited uses:

(a) Employment Screening. Quorum will not use Licensed Consumer Data for employment purposes as described in Section 604(a)(3)(B) of the FCRA (15 U.S.C. § 1681b(a)(3)(B)), including, without limitation, for the purpose of evaluating a consumer for employment, promotion, reassignment, or retention as an employee. Quorum's access to Licensed Consumer Data under the MDLA is not related to Quorum's role as an employer, and Quorum shall not access or use Licensed Consumer Data in connection with any employment decision.

(b) Government Licenses or Benefits. Quorum will not use Licensed Consumer Data for the purpose of determining a consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status, as described in Section 604(a)(3)(D) of the FCRA, except to the extent that such use falls within the insurance underwriting or account review purposes certified in Section 2.1 above.

(c) Non-Consumer-Initiated Transactions. Quorum will not use Licensed Consumer Data for any purpose that is not initiated by the consumer or not in connection with an Insurance Transaction or Account Review, except as otherwise permitted by applicable law.

(d) Direct Marketing and Solicitation. Quorum will not use Licensed Consumer Data for direct marketing or solicitation purposes to the extent prohibited under the FCRA. Quorum acknowledges that prescreened offers of insurance under Section 604(c) of the FCRA (15 U.S.C. § 1681b(c)) constitute a separate regulatory regime with independent requirements, including the firm-offer-of-credit or insurance requirements. Quorum is not seeking authorization under this Certification to conduct prescreened solicitations, and any future use of Licensed Consumer Data for prescreened offers shall require a separate certification and compliance with Section 604(c) requirements.

(e) Resale or Re-Dissemination. Quorum will not resell, sublicense, or otherwise re-disseminate Licensed Consumer Data constituting Consumer Reports to any third party, except as expressly permitted under the FCRA, this Schedule, and the MDLA, and subject to the restrictions set forth in Section 3.2 below.

(f) Any Other Unauthorized Purpose. Quorum will not use Licensed Consumer Data for any purpose not enumerated in Section 604(a) of the FCRA or otherwise authorized by applicable federal or state law.

SECTION 3: QUORUM'S COMPLIANCE OBLIGATIONS

3.1 End-User Obligations Under FCRA

As a user of Consumer Reports furnished by Meridian, Quorum shall comply with all obligations imposed on users of Consumer Reports under the FCRA, applicable CFPB and FTC regulations, and State FCRA Analogues. Without limiting the generality of the foregoing, Quorum shall comply with the following specific obligations:

3.1.1 Adverse Action Notices.

Quorum shall comply with Section 615 of the FCRA (15 U.S.C. § 1681m) and applicable CFPB regulations (12 C.F.R. § 1022.72) by providing adverse action notices to consumers whenever an adverse underwriting decision is made based in whole or in part on information contained in a Consumer Report obtained from Meridian. For purposes of this Section, an "adverse underwriting decision" includes, without limitation, a denial of insurance coverage, an increase in premium or surcharge based on credit information, a reduction or limitation of coverage, a cancellation or non-renewal of a policy, and any other action that is adverse to the interests of the consumer and is based in whole or in part on Consumer Report information.

Each adverse action notice provided by Quorum shall include: (a) the name, address, and telephone number of Meridian Credit intelligence, Inc. as the Consumer Reporting Agency that furnished the Consumer Report upon which the adverse action was based, in whole or in part; (b) a statement that Meridian did not make the adverse decision and is unable to provide the consumer with specific reasons for the adverse action; (c) a statement of the consumer's right to obtain a free copy of the Consumer Report from Meridian within sixty (60) days; and (d) a statement of the consumer's right to dispute the accuracy or completeness of any information in the Consumer Report. Quorum shall use the adverse action notice template provided by Meridian or a substantially similar form that complies with all applicable FCRA requirements.

3.1.2 Disposal of Consumer Report Information.

Quorum shall comply with the FTC's Disposal Rule (16 C.F.R. Part 682) and applicable CFPB regulations (12 C.F.R. § 1022.20 et seq.) regarding the proper disposal of Consumer Report information. Quorum shall take reasonable measures to protect against unauthorized access to or use of Consumer Report information in connection with its disposal, including the implementation of appropriate policies and procedures governing the destruction, erasure, or modification of records containing Consumer Report information. Such measures shall include, at a minimum: (a) burning, pulverizing, or shredding papers containing Consumer Report information so that the information cannot practicably be read or reconstructed; (b) destroying or erasing electronic media containing Consumer Report information so that the information cannot practicably be read or reconstructed; and (c) entering into a contract with a third-party disposal service provider that requires such service provider to implement and monitor compliance with reasonable disposal policies and procedures.

3.1.3 Accuracy and Integrity.

Quorum shall not use Licensed Consumer Data that it knows or has reasonable cause to believe is inaccurate for any purpose for which a Consumer Report may be furnished under the FCRA. If Quorum becomes aware that any Licensed Consumer Data is or may be inaccurate, Quorum shall promptly notify Meridian and shall refrain from using such data in connection with any underwriting, account review, or other decision affecting a consumer until the accuracy of such data has been verified or corrected by Meridian.

3.1.4 Consumer Dispute Assistance.

Quorum shall cooperate with Meridian in the investigation and resolution of consumer disputes under Section 611 of the FCRA (15 U.S.C. § 1681i) and applicable CFPB regulations. Such cooperation shall include, without limitation: (a) timely response to Meridian's requests for information related to the accuracy of disputed trade-line data, data elements, or other information that Quorum has furnished to or received from Meridian; (b) completion and return of all dispute verification forms within the timeframes required by the FCRA (generally within thirty (30) days after receipt of a dispute notice from Meridian, or fifteen (15) days in the case of expedited dispute investigations under Section 611(a)(7)); and (c) correction or deletion of any information that Meridian determines to be inaccurate or incomplete as a result of a consumer dispute investigation, to the extent such information is within Quorum's possession or control.

3.2 Restrictions on Re-Dissemination and Sharing

3.2.1 General Prohibition.

Quorum shall not resell, sublicense, distribute, publish, transfer, or otherwise re-disseminate Licensed Consumer Data constituting Consumer Reports to any third party, except as expressly permitted under the FCRA and the MDLA. Any permissible re-dissemination of Consumer Report information shall require the prior written consent of Meridian and shall be conducted in accordance with all applicable FCRA requirements, including the requirement that any third-party recipient independently certify a Permissible Purpose for receiving Consumer Report information.

3.2.2 Derived Data.

The parties acknowledge that the MDLA contains provisions in Article VII regarding the creation, ownership, and commercialization of Derived Data, and that certain terms relating to Derived Data remain in dispute as of the date of this draft. Notwithstanding the ongoing negotiation regarding Derived Data under Article VII, the parties agree that any commercialization, distribution, or re-dissemination of Derived Data to third parties must independently satisfy FCRA requirements to the extent that such Derived Data constitutes or contains a Consumer Report or Consumer Report information. In particular, any third-party recipient of Derived Data that constitutes a Consumer Report must independently certify a Permissible Purpose for receiving such information, and Quorum must comply with all applicable CRA obligations with respect to such re-dissemination, as further described in Section 7 of this Schedule.

3.2.3 Internal Sharing Among Affiliates.

Licensed Consumer Data may be shared among Quorum's affiliated entities and subsidiaries only to the extent that (a) each such affiliated entity or subsidiary independently certifies, in a form substantially similar to this Schedule, a Permissible Purpose for accessing and using Licensed Consumer Data; (b) each such affiliated entity or subsidiary is bound by the terms and conditions of this Schedule, whether through a joinder agreement, sub-certification, or other written instrument reasonably acceptable to Meridian; and (c) such sharing is conducted in accordance with the FCRA's provisions regarding the communication of information among persons related by common ownership or affiliated by corporate control, including the disclosure and opt-out requirements of Section 603(d)(2)(A)(iii) of the FCRA, to the extent applicable. Quorum shall provide Meridian with a list of all affiliated entities and subsidiaries that have been granted access to Licensed Consumer Data, and shall update such list promptly upon any change.

3.3 Data Security Requirements

3.3.1 General Security Obligations.

Quorum shall maintain administrative, technical, and physical safeguards reasonably designed to protect the security, confidentiality, and integrity of Licensed Consumer Data, consistent with the requirements of FCRA Section 628 (15 U.S.C. § 1681w), the FTC's Safeguards Rule (16 C.F.R. Part 314), and all applicable federal and state data security laws and regulations. The specific data security requirements applicable to Quorum's handling of Licensed Consumer Data are set forth in the Data Security Addendum ("DSA") to the MDLA, which is incorporated herein by reference.

3.3.2 SOC 2 Compliance.

As evidence of Quorum's security controls and their operating effectiveness, Quorum shall maintain and provide to Meridian upon request a current SOC 2 Type II Report (System and Organization Controls 2) covering the trust services criteria of security, availability, processing integrity, confidentiality, and privacy, as applicable to Quorum's systems that process, store, or transmit Licensed Consumer Data. Quorum's most recent SOC 2 Type II Report was issued by Felton Thorpe & Co. LLP for the twelve-month period ending December 31, 2023. Quorum shall provide updated SOC 2 Type II Reports to Meridian on an annual basis within thirty (30) days after issuance.

3.3.3 Regulatory Compliance.

Quorum represents that it is in compliance with the New York Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500) and all applicable state insurance data-security requirements in each jurisdiction in which Quorum conducts insurance business. Quorum shall promptly notify Meridian of any material changes to its compliance status under such regulations or of any regulatory examination findings or enforcement actions related to data security.

3.4 Record Retention and Audit

3.4.1 Record Retention.

Quorum shall maintain complete and accurate records documenting its Permissible Purpose for each access to or use of Licensed Consumer Data, including, at a minimum, the identity of the consumer whose Consumer Report was accessed, the date of access, the Permissible Purpose relied upon, the identity of the Quorum employee or system that initiated the access, and the business purpose for which the data was used. Such records shall be maintained for a period of not less than five (5) years following the date of access and shall be made available to Meridian upon request in connection with an audit conducted pursuant to Section 3.4.2 below.

3.4.2 Audit Rights.

Meridian shall have the right, upon reasonable prior written notice of not less than thirty (30) calendar days, and during Quorum's normal business hours, to audit and inspect Quorum's compliance with this Schedule, including, without limitation, verification of Permissible Purpose documentation, review of adverse action notice procedures, inspection of data security controls, and examination of Quorum's FCRA compliance policies and procedures. Such audits shall be conducted no more than once in any twelve (12) month period; provided, however, that if Meridian identifies a specific compliance concern based on a consumer complaint, regulatory inquiry, or other credible information suggesting a potential FCRA violation, Meridian may conduct one (1) additional audit within such twelve (12) month period, and such additional audit shall be limited in scope to the identified compliance concern. Quorum shall cooperate fully with any audit conducted under this Section and shall provide Meridian's auditors with reasonable access to relevant personnel, systems, records, and facilities.

3.4.3 Data Breach Notification.

Quorum's obligations regarding notification of data breaches or security incidents affecting Licensed Consumer Data are set forth in the DSA. Without limiting those obligations, Quorum shall notify Meridian within forty-eight (48) hours after Quorum becomes aware of any breach of security, unauthorized access, or unauthorized disclosure affecting Licensed Consumer Data constituting Consumer Reports, as further described in the DSA.

3.5 Post-Termination Obligations

3.5.1 Return or Destruction of Licensed Consumer Data.

Upon the termination or expiration of the MDLA for any reason, Quorum shall return to Meridian or destroy all Licensed Consumer Data constituting Consumer Reports within ninety (90) calendar days after the effective date of termination or expiration, in accordance with the MDLA's data return and destruction provisions (Article XII). Quorum shall certify in writing to Meridian, within ten (10) business days after the completion of such return or destruction, that all Licensed Consumer Data constituting Consumer Reports has been returned or destroyed and that no copies, excerpts, or derivatives thereof have been retained, except as otherwise permitted by applicable law or regulatory requirements.

3.5.2 Derived Data.

The parties acknowledge that the treatment of Derived Data upon termination or expiration of the MDLA is a disputed term under the ongoing MDLA negotiations as of the date of this draft, and this Schedule does not purport to resolve that dispute. The parties shall address the post-termination treatment of Derived Data in connection with the resolution of Article VII of the MDLA. Notwithstanding the foregoing, and regardless of the contractual resolution of the Derived Data provisions, to the extent that any Derived Data constitutes or contains Consumer Report information, all FCRA obligations — including, without limitation, obligations relating to permissible purpose, adverse action notices, consumer dispute investigation, data security, and proper disposal — shall survive the termination or expiration of the MDLA and shall continue to apply to Quorum's possession, use, and disposition of such Derived Data for so long as Quorum retains such data.

SECTION 4: REPRESENTATIONS AND WARRANTIES OF QUORUM

Quorum hereby makes the following representations and warranties to Meridian, each of which is material to Meridian's decision to furnish Consumer Reports to Quorum under the MDLA and this Schedule:

4.1 Insurance Business. Quorum represents and warrants that it is engaged in the business of insurance underwriting and is duly licensed, authorized, and in good standing under applicable law to engage in Insurance Transactions in each jurisdiction in which it operates and in which it will use Licensed Consumer Data. Quorum shall promptly notify Meridian if Quorum's insurance licenses are suspended, revoked, or materially restricted in any jurisdiction.

4.2 Written Policies and Procedures. Quorum represents and warrants that it has established and maintains written policies and procedures reasonably designed to ensure that Licensed Consumer Data is accessed and used solely for the Permissible Purposes certified herein, and that such policies and procedures are regularly reviewed and updated to reflect changes in applicable law and industry best practices. Such policies and procedures include, at a minimum, access controls limiting data access to authorized personnel, logging and monitoring of data access events, Permissible Purpose verification procedures, and procedures for responding to consumer inquiries and disputes.

4.3 Designated Compliance Officer. Quorum represents and warrants that it has designated a qualified compliance officer or compliance team responsible for overseeing FCRA compliance in connection with the use of Licensed Consumer Data. As of the date of this Schedule, the designated compliance contact within Quorum is Claudia Reeves, Vice President, Regulatory & Compliance, Quorum Insurance Holdings Corp. Quorum shall promptly notify Meridian in writing if the designated compliance contact changes.

4.4 Training. Quorum represents and warrants that all of its employees, agents, contractors, and other personnel who have access to Licensed Consumer Data have received training on FCRA requirements, Quorum's Permissible Purpose obligations, and the terms and conditions of this Schedule, and that such training is provided on an initial basis upon hire or engagement and on a recurring basis at least annually thereafter. Quorum shall maintain records of such training, including the dates of training, the names of participants, and the subject matter covered, and shall make such records available to Meridian upon request.

4.5 Notification of Violations. Quorum represents and warrants that it will promptly notify Meridian in writing if Quorum becomes aware of any actual or suspected violation of FCRA requirements, this Schedule, or applicable data protection laws in connection with its access to or use of Licensed Consumer Data. Such notification shall be provided within seventy-two (72) hours after Quorum becomes aware of the actual or suspected violation and shall include a reasonable description of the nature and scope of the violation, the Licensed Consumer Data affected, and the corrective measures taken or planned by Quorum.

4.6 No Enforcement Actions. Quorum represents and warrants that it is not currently, and has not within the past five (5) years been, the subject of any enforcement action, consent order, consent decree, civil investigative demand, civil penalty, or formal supervisory action by the FTC, the CFPB, any state attorney general, or any state insurance regulatory authority relating to FCRA compliance, the misuse of Consumer Report information, or the failure to comply with data security requirements applicable to Consumer Report information. If any such enforcement action, investigation, or proceeding is commenced during the Term of the MDLA, Quorum shall promptly notify Meridian in writing.

SECTION 5: MERIDIAN'S OBLIGATIONS AS CONSUMER REPORTING AGENCY

5.1 CRA Status. Meridian represents and warrants that it is a Consumer Reporting Agency as defined in Section 603(f) of the FCRA and that the Licensed Consumer Data furnished to Quorum under the MDLA constitutes Consumer Reports or information derived from Consumer Reports. Meridian acknowledges that, as a CRA, it is subject to the obligations imposed on CRAs under the FCRA, including, without limitation, the obligations set forth in Sections 607, 610, 611, 612, and 628 thereof.

5.2 CRA Compliance Obligations. Meridian shall maintain and comply with its obligations under the FCRA, including, without limitation:

(a) Section 607 — Compliance Procedures. Meridian shall maintain reasonable procedures designed to avoid violations of Section 605 (concerning obsolete information) and to limit the furnishing of Consumer Reports to persons that Meridian has reason to believe will use the information for a Permissible Purpose under Section 604. Meridian shall require prospective users of Consumer Reports, including Quorum, to identify the purposes for which the information is sought and to certify the purposes for which the information will be used.

(b) Section 610 — Conditions of Disclosure to Consumers. Meridian shall comply with the requirements of Section 610 regarding the disclosure of information to consumers upon request, including the obligation to clearly and accurately disclose all information in the consumer's file at the time of the request, the sources of information, and the identification of each person that procured a Consumer Report during specified periods.

(c) Section 611 — Procedure in Case of Disputed Accuracy. Meridian shall maintain reasonable procedures for investigating consumer disputes regarding the completeness or accuracy of information in Consumer Reports, including the obligation to conduct a reasonable reinvestigation within thirty (30) days (or forty-five (45) days in certain circumstances) after receiving a dispute notice, to record the current status of the disputed information or delete the item, and to provide written notice of the results of the reinvestigation to the consumer.

5.3 Notice of Material Changes. Meridian shall provide Quorum with reasonable advance written notice of any material changes to the accuracy, completeness, or composition of the Licensed Consumer Data, or to Meridian's consumer dispute resolution process, that could reasonably be expected to affect Quorum's use of the Licensed Consumer Data in its insurance underwriting or account review activities. Such notice shall be provided at least thirty (30) days prior to the effective date of any such material change, or as soon as reasonably practicable if advance notice is not feasible.

5.4 Security and Data Integrity. Meridian maintains comprehensive information security and data-integrity controls, as evidenced by (a) Meridian's SOC 2 Type II Report issued by Galloway Nash LLP for the twelve-month period ending March 31, 2023, covering the trust services criteria of security, availability, processing integrity, confidentiality, and privacy, and (b) Meridian's ISO 27001:2022 certification (Certificate No. IS 738291, issued by BSI Group, valid through September 30, 2025). Meridian shall provide updated SOC 2 Type II Reports to Quorum on an annual basis and shall promptly notify Quorum of any material changes to its ISO 27001 certification status.

SECTION 6: USE OF LICENSED CONSUMER DATA IN AUTOMATED DECISION-MAKING SYSTEMS

6.1 Acknowledgment of Automated Decision-Making.

The parties acknowledge that Quorum intends to use Licensed Consumer Data as inputs to automated underwriting models, claims-fraud detection algorithms, customer propensity scoring systems, and other automated decision-making tools and technologies, including, without limitation, the proprietary QuorumScore™ predictive underwriting model. QuorumScore™ is a machine-learning-based model that ingests consumer credit data, alternative credit data, and other variables to generate a composite risk score used in Quorum's insurance underwriting process. The parties agree that the use of Licensed Consumer Data in such automated systems is within the scope of the Permissible Purposes certified in Section 2 of this Schedule, provided that all FCRA requirements applicable to such use are satisfied.

6.2 Adverse Action Notice Obligations for Automated Decisions.

Quorum acknowledges and agrees that the use of Licensed Consumer Data in automated underwriting models and decision-making systems does not relieve Quorum of its obligation to provide adverse action notices to consumers in compliance with Section 615 of the FCRA. When an adverse underwriting decision is generated in whole or in part by an automated system that utilizes Licensed Consumer Data, Quorum shall: (a) provide the consumer with an adverse action notice that complies with all requirements of Section 615 and applicable CFPB regulations; (b) identify the principal reasons for the adverse action, which may include the key factors from the Licensed Consumer Data that contributed to the adverse decision, consistent with the FCRA's requirement to disclose up to four (4) key factors (or five (5) key factors if one of the factors is the number of inquiries); and (c) identify Meridian as the CRA that furnished the Consumer Report upon which the adverse action was based, in whole or in part. Quorum shall implement procedures to ensure that its automated systems are capable of generating the requisite adverse action reason codes and consumer-facing explanations.

6.3 Algorithmic Accountability Considerations.

The parties acknowledge that the regulatory landscape governing automated decision-making and algorithmic accountability is evolving at both the federal and state levels, including, without limitation, proposed rulemaking by the CFPB regarding automated valuation models and algorithmic accountability, state legislation addressing automated decision-making in insurance (including Colorado Senate Bill 21-169 and its implementing regulations), and broader trends in algorithmic fairness and transparency regulation. Quorum's compliance team should monitor these developments and assess whether additional obligations may apply to Quorum's use of Licensed Consumer Data in automated systems. This Section 6.3 is provided for advisory purposes and does not create binding obligations under the MDLA; however, the parties agree to consult in good faith regarding the impact of any new regulatory requirements on their respective obligations under this Schedule and the MDLA.

6.4 Machine-Learning Model Outputs and Derived Data.

The parties acknowledge that the question of whether machine-learning model outputs, model weights, and predictive scores generated by Quorum's automated systems trained on or incorporating Meridian data constitute "Derived Data" under Article VII of the MDLA remains an open negotiation point as of the date of this draft. The parties shall address this question in connection with the resolution of Article VII. Notwithstanding the contractual resolution of this issue, the parties agree that FCRA obligations attach to any model output, score, or analytical product that constitutes a Consumer Report — i.e., that bears on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living and is used or expected to be used as a factor in establishing the consumer's eligibility for insurance, credit, or other purposes enumerated in Section 604 — regardless of the contractual or intellectual property classification of such output under the MDLA.

SECTION 7: FCRA IMPLICATIONS FOR DERIVED DATA

7.1 When Derived Data Constitutes a Consumer Report.

The parties acknowledge that Derived Data, as defined under Article VII of the MDLA, may in certain circumstances itself constitute a "Consumer Report" within the meaning of Section 603(d) of the FCRA. Derived Data will constitute a Consumer Report when such data: (a) bears on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living; (b) is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for insurance, credit, employment, or any other purpose authorized under Section 604 of the FCRA; and (c) is communicated by a Consumer Reporting Agency (or by a person who, by virtue of its activities, meets the definition of a Consumer Reporting Agency) to a third party. The determination of whether specific Derived Data items constitute Consumer Reports must be assessed on a case-by-case basis, taking into account the nature of the data, the manner in which it is assembled and communicated, and the purpose for which it is used or expected to be used.

7.2 Quorum's Obligations with Respect to Derived Data.

Regardless of the contractual allocation of intellectual property ownership in Derived Data under Article VII of the MDLA, Quorum shall treat any Derived Data that constitutes or contains a Consumer Report as subject to all FCRA Permissible Purpose and compliance obligations set forth in this Schedule, including, without limitation, the obligations relating to Permissible Purpose certification (Section 2), adverse action notices (Section 3.1.1), data security (Section 3.3), record retention (Section 3.4), consumer dispute assistance (Section 3.1.4), and proper disposal (Section 3.1.2). The contractual characterization of data as "Derived Data" under the MDLA does not alter or diminish the statutory protections afforded to consumers under the FCRA.

7.3 Re-Dissemination of Derived Data to Third Parties.

If Quorum commercializes, distributes, or otherwise re-disseminates Derived Data to third parties (subject to the resolution of the Article VII disputes under the MDLA), and such Derived Data constitutes or contains Consumer Report information, the following FCRA implications will apply:

(a) Each third-party recipient of such Derived Data must independently certify a Permissible Purpose for receiving Consumer Report information, and Quorum must obtain and retain documentation of such certification prior to furnishing the Derived Data;

(b) Quorum would, by virtue of its regular assembly, evaluation, and furnishing of consumer information to third parties, itself function as a Consumer Reporting Agency with respect to such re-dissemination, thereby triggering Quorum's own obligations under FCRA Sections 607 (compliance procedures), 611 (dispute investigation procedures), 615 (adverse action notice requirements for users of reports furnished by Quorum), 612 (charges for disclosures), and 628 (disposal of records);

(c) Quorum would be subject to the full range of CRA obligations under the FCRA, including the obligation to maintain reasonable procedures to ensure the maximum possible accuracy of consumer information, to investigate and resolve consumer disputes within the timeframes prescribed by Section 611, and to provide consumer disclosures upon request under Section 610;

(d) Quorum would be subject to regulatory oversight by the CFPB as a Consumer Reporting Agency, including potential examination and enforcement authority; and

(e) Quorum shall be solely responsible for all compliance obligations arising from its status as a CRA with respect to such re-dissemination and shall indemnify Meridian against any losses, damages, or regulatory penalties arising therefrom.

The parties agree that the implications described in this Section 7.3 have significant regulatory consequences for Quorum and should be carefully evaluated by Quorum's legal and compliance teams before any decision is made to commercialize Derived Data containing Consumer Report information.

7.4 QuorumScore™ Outputs.

The parties specifically acknowledge that QuorumScore™ outputs — including composite risk scores, sub-scores, risk classifications, and associated reason codes — may constitute Consumer Reports when such outputs are based in part on Licensed Consumer Data (including data from the MCI Consumer Credit File™ or MCI AltSignal™) and are used in connection with insurance underwriting decisions or other purposes enumerated in Section 604 of the FCRA. Quorum shall treat QuorumScore™ outputs that meet the definition of a Consumer Report as subject to all applicable FCRA requirements, including adverse action notice obligations, and shall not furnish such outputs to third parties without ensuring compliance with the CRA obligations described in Section 7.3 above.

SECTION 8: STATE LAW CONSIDERATIONS

8.1 Acknowledgment of State FCRA Analogues.

The parties acknowledge that certain states have enacted statutes that are analogous to or supplement the FCRA and that impose additional obligations on the furnishing and use of consumer credit information. Such State FCRA Analogues include, without limitation:

(a) California: The California Consumer Credit Reporting Agencies Act (Cal. Civ. Code §§ 1785.1 et seq.), the Investigative Consumer Reporting Agencies Act (Cal. Civ. Code §§ 1786 et seq.), and the California Consumer Privacy Act / California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 et seq.) ("CCPA/CPRA"), which impose additional requirements on the collection, use, and disclosure of consumer information, including enhanced consumer rights and business obligations;

(b) Connecticut: Connecticut General Statutes § 31-51tt (regarding employee background checks) and various insurance-specific consumer credit regulations;

(c) New York: New York General Business Law Article 25 (Fair Credit Reporting Act), New York Insurance Law provisions restricting the use of credit information in insurance underwriting, and 23 NYCRR Part 500 (NY DFS Cybersecurity Regulation);

(d) Other States: Various state laws restricting or regulating the use of credit-based insurance scores, including, without limitation, statutes in Hawaii, Maryland, Massachusetts, Oregon, Utah, and Washington, among others.

8.2 Compliance with State Insurance Credit-Score Restrictions.

Quorum shall comply with all applicable state laws governing the use of consumer credit information in Insurance Transactions, including state-specific restrictions on the use of credit-based insurance scores. Quorum acknowledges that certain states prohibit or restrict the use of credit information as a factor in insurance underwriting, rating, or renewal decisions, and that such restrictions may limit Quorum's ability to use Licensed Consumer Data in connection with Insurance Transactions in those jurisdictions. Quorum shall maintain a current inventory of state-specific restrictions on the use of credit information in insurance and shall implement appropriate controls to ensure compliance with such restrictions.

8.3 Cross-Reference to CCPA/CPRA Compliance.

The CCPA/CPRA imposes obligations on businesses that collect, use, or disclose the personal information of California consumers, and the CCPA/CPRA's exemptions for information collected, processed, sold, or disclosed pursuant to the FCRA (Cal. Civ. Code § 1798.145(d)) may not extend to all of Quorum's intended uses of Licensed Consumer Data, particularly with respect to Derived Data or data used for purposes beyond those expressly covered by the FCRA exemption. Quorum's obligations under the CCPA/CPRA are addressed in the Data Processing Agreement ("DPA") attached to the MDLA, which is incorporated herein by reference. The parties shall also refer to the memoranda prepared by Calderwood & Harkness LLP analyzing the CCPA/CPRA implications for Derived Data commercialization, copies of which have been provided to both parties under separate cover.

SECTION 9: REMEDIES FOR NON-COMPLIANCE

9.1 Suspension and Termination.

If Meridian reasonably determines, based on an audit, consumer complaint, regulatory inquiry, or other credible information, that Quorum has accessed or used Licensed Consumer Data without a valid Permissible Purpose or in violation of the FCRA or the obligations set forth in this Schedule, Meridian may:

(a) Immediately suspend Quorum's access to the applicable data products (including suspension of batch data deliveries and API access) pending investigation by Meridian and Quorum of the alleged non-compliance. Such suspension shall take effect upon written notice to Quorum (which may be provided by electronic mail to the compliance and legal contacts identified in Section 11 below) and shall remain in effect until Meridian is reasonably satisfied that the non-compliance has been identified and remediated; and

(b) Terminate the MDLA in its entirety if the non-compliance is not cured within thirty (30) calendar days after written notice specifying the nature of the non-compliance is delivered to Quorum. Such termination shall be in addition to, and not in lieu of, Meridian's right to suspend access under clause (a) above. For the avoidance of doubt, if Quorum cures the non-compliance to Meridian's reasonable satisfaction within the thirty (30) day cure period, Meridian shall promptly reinstate Quorum's access to the applicable data products.

9.2 Indemnification.

Quorum shall defend, indemnify, and hold harmless Meridian and its officers, directors, employees, agents, affiliates, and successors (collectively, the "Meridian Indemnified Parties") from and against any and all losses, damages, liabilities, claims, demands, suits, judgments, settlements, fines, penalties, costs, and expenses (including reasonable attorneys' fees and costs of investigation) arising out of or relating to Quorum's failure to comply with FCRA Permissible Purpose requirements, the obligations set forth in this Schedule, or any applicable federal, state, or local law governing the use of Consumer Report information. This indemnification obligation shall survive the termination or expiration of the MDLA and this Schedule.

9.3 Cumulative Remedies.

Meridian's remedies under this Section 9 are in addition to, and not in lieu of, any other remedies available to Meridian under the MDLA, at law, or in equity, including, without limitation, any remedies for breach of contract, injunctive relief, and specific performance. No exercise of any remedy by Meridian shall constitute a waiver of any other remedy available to Meridian.

SECTION 10: ONGOING CERTIFICATION AND RENEWAL

10.1 Annual Re-Certification.

Quorum shall re-certify its Permissible Purposes under this Schedule on an annual basis, no later than thirty (30) calendar days after each anniversary of the Effective Date of the MDLA. Such annual re-certification shall be provided in the form attached hereto as Exhibit A (Form of Annual Re-Certification) or in such other form as Meridian may reasonably require. Failure to provide the annual re-certification within the required timeframe shall constitute a material breach of this Schedule and the MDLA, and Meridian may suspend Quorum's access to Licensed Consumer Data until such re-certification is received.

10.2 Updated Certifications.

If Quorum's Permissible Purposes change during the Term of the MDLA, Quorum shall promptly provide an updated Certification to Meridian prior to accessing Licensed Consumer Data for the new purpose. No access to Licensed Consumer Data for a new or modified Permissible Purpose shall be permitted until such updated Certification has been acknowledged in writing by Meridian. Any updated Certification shall be treated as an amendment to this Schedule and shall be attached hereto as a supplemental exhibit.

10.3 Supplemental Certifications.

Meridian reserves the right to require supplemental certifications, questionnaires, or other information from Quorum at any time during the Term of the MDLA if Meridian believes, in good faith, that additional verification of Quorum's Permissible Purpose is necessary. Such supplemental certification requests may be triggered by, among other things, (a) changes in applicable law or regulatory guidance, (b) consumer complaints or disputes suggesting potential misuse of Consumer Report information, (c) findings from audits conducted pursuant to Section 3.4.2, or (d) changes in Quorum's business operations that could affect its Permissible Purpose. Quorum shall respond to any supplemental certification request within fifteen (15) business days after receipt.

SECTION 11: AUTHORIZED CONTACTS

The following individuals are designated as the authorized contacts for purposes of communications and notices under this Schedule:

Quorum Insurance Holdings Corp.

FCRA Compliance Contact: Claudia Reeves Vice President, Regulatory & Compliance Quorum Insurance Holdings Corp. 1200 Atlantic Street, Suite 3400 Stamford, CT 06901

Email: c.reeves@quoruminsurance.com

Telephone: (203) 555-4218

Legal Contact: Gregory Stahl Vice President, Legal Affairs Quorum Insurance Holdings Corp. 1200 Atlantic Street, Suite 3400 Stamford, CT 06901

Email: g.stahl@quoruminsurance.com

Telephone: (203) 555-4305

Meridian Credit intelligence, Inc.

FCRA Compliance Contact: Lena Vasquez Chief Privacy Officer Meridian Credit intelligence, Inc. 3300 Peachtree Road NE, Suite 2100 Atlanta, GA 30326

Email: l.vasquez@meridianci.com

Telephone: (404) 555-7812

Legal Contact: Arthur Pennington General Counsel Meridian Credit intelligence, Inc. 3300 Peachtree Road NE, Suite 2100 Atlanta, GA 30326

Email: a.pennington@meridianci.com

Telephone: (404) 555-7900

Either party may change its designated contacts by providing written notice to the other party in accordance with the notice provisions of the MDLA. Such change shall be effective upon receipt of the written notice.

SECTION 12: GOVERNING LAW

12.1 Governing Law. This Schedule shall be governed by and construed in accordance with the laws of the State of New York, without regard to its conflicts-of-law principles, consistent with the governing law provisions set forth in Article XV of the MDLA.

12.2 Federal Preemption. To the extent that any provision of New York law or any other state law conflicts with the FCRA or any other applicable federal law governing the furnishing, use, or protection of Consumer Report information, federal law shall control and preempt such conflicting state law, in accordance with Section 625 of the FCRA (15 U.S.C. § 1681t) and applicable judicial interpretations thereof.

12.3 Severability. If any provision of this Schedule is held to be invalid, illegal, or unenforceable under applicable law, such invalidity, illegality, or unenforceability shall not affect any other provision of this Schedule, and this Schedule shall be construed and enforced as if such invalid, illegal, or unenforceable provision had not been included herein.

12.4 Entire Agreement. This Schedule, together with the MDLA and all other schedules, addenda, and exhibits thereto, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, representations, and understandings of the parties, whether written or oral, with respect to such subject matter.

IN WITNESS WHEREOF, the parties have executed this

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
Schedule F — FCRA Permissible Purpose Certification
Schedule to the Master Data License Agreement by and between Meridian Credit intelligence, Inc. and Quorum Insurance Holdings Corp.
DRAFT — Prepared by Calderwood & Harkness LLP — February 2023 C&H Matter No. 1025-00008
Prepared by: Lisa Johannsen, Associate Data Privacy & Cybersecurity Practice Group Calderwood & Harkness LLP
Reviewed by: David Cartwright, Partner Data Privacy & Cybersecurity Practice Group Calderwood & Harkness LLP
Right-click to update Table of Contents
RECITALS
A. This Schedule F (this "Schedule" or "Certification") is attached to and forms an integral part of that certain Master Data License Agreement (the "MDLA" or "Agreement") entered into by and between Meridian Credit intelligence, Inc., a Georgia corporation ("Licensor" or "Meridian"), with its principal place of business at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326, and Quorum Insurance Holdings Corp., a Delaware corporation ("Licensee" or "Quorum"), with its principal place of business at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901. Capitalized terms used but not otherwise defined herein shall have the meanings ascribed to them in the MDLA.
B. Meridian is a consumer reporting agency ("CRA") as that term is defined under the Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq. ("FCRA"), and in the ordinary course of its business assembles, evaluates, and furnishes consumer reports and consumer credit information to permissible users thereof. Meridian maintains one of the largest proprietary consumer credit databases in the United States and provides data products and analytical services to financial institutions, insurance carriers, telecommunications providers, and other entities with permissible purposes to access consumer report information.
C. Pursuant to the MDLA, Meridian has agreed to license to Quorum access to certain data products that contain consumer information subject to the FCRA, specifically:
(i) MCI Consumer Credit File™ — a comprehensive consumer credit database containing approximately 310 million consumer records, refreshed daily via batch delivery and real-time API access, which includes trade-line data, public record information, credit inquiries, and other consumer credit information assembled by Meridian in its capacity as a CRA;
(ii) MCI AltSignal™ — an alternative-data consumer information product containing approximately 85 million consumer records, refreshed daily via batch delivery, which includes utility payment data, telecommunications payment data, rental payment history, and other non-traditional consumer credit indicators assembled by Meridian; and
(iii) MCI CommercialView™ — a commercial credit database containing approximately 42 million business records, which consists of commercial credit data and is generally not subject to FCRA consumer-report requirements. MCI CommercialView™ is excluded from the scope of this Schedule; provided, however, that the parties acknowledge that MCI CommercialView™ may contain information on sole proprietorships and individual guarantors that could implicate FCRA consumer-report requirements, and the parties shall address the treatment of such records in accordance with the provisions of the MDLA and applicable law.
D. The FCRA, including Section 604 thereof (15 U.S.C. § 1681b), restricts the circumstances under which consumer reports may be furnished by a CRA and imposes obligations on both CRAs and the users of consumer reports. In addition, various state statutes that are analogous to or supplement the FCRA (collectively, "State FCRA Analogues") impose additional or complementary requirements on the furnishing and use of consumer credit information. Regulations promulgated by the Consumer Financial Protection Bureau ("CFPB") under Regulation V (12 C.F.R. Part 1022) and by the Federal Trade Commission ("FTC") further govern the obligations of CRAs and users of consumer reports.
E. As a condition to Meridian's furnishing of consumer reports and consumer credit information to Quorum under the MDLA, and in accordance with Meridian's obligations as a CRA under FCRA Section 607(a) to maintain reasonable procedures to limit the furnishing of consumer reports to permissible purposes, Quorum is providing this Certification to establish and document its permissible purpose(s) for obtaining consumer reports and consumer credit information from Meridian.
F. The parties intend that this Schedule, together with the MDLA and all other schedules, addenda, and exhibits thereto, shall constitute the complete agreement between the parties with respect to FCRA permissible purpose certification, and that the terms of this Schedule shall be binding upon the parties and their respective successors, assigns, affiliates, and subsidiaries to the extent set forth herein.
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth in the MDLA and this Schedule, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:
SECTION 1: DEFINITIONS
For purposes of this Schedule, the following terms shall have the meanings set forth below. All other capitalized terms used in this Schedule and not defined herein shall have the meanings ascribed to them in the MDLA.
1.1 "Consumer Report" shall have the meaning ascribed to such term in Section 603(d) of the FCRA (15 U.S.C. § 1681a(d)), and shall mean any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for: (a) credit or insurance to be used primarily for personal, family, or household purposes; (b) employment purposes; or (c) any other purpose authorized under Section 604 of the FCRA. The term "Consumer Report" does not include (i) any report containing information solely as to transactions or experiences between the consumer and the person making the report, (ii) any communication of information among persons related by common ownership or affiliated by corporate control, if it is clearly and conspicuously disclosed to the consumer that the information may be communicated among such persons and the consumer is given the opportunity to direct that such information not be communicated, (iii) any authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device, or (iv) any report in which a person who has been requested by a third party to make a specific extension of credit directly or indirectly to a consumer conveys his or her decision with respect to such request, provided that the third party advises the consumer of the name and address of the person to whom the request was made.
1.2 "Consumer Reporting Agency" shall have the meaning ascribed to such term in Section 603(f) of the FCRA (15 U.S.C. § 1681a(f)), and shall mean any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports. Meridian is acknowledged by the parties to be a Consumer Reporting Agency with respect to the MCI Consumer Credit File™ and MCI AltSignal™ data products.
1.3 "Permissible Purpose" shall mean any purpose enumerated under Section 604(a) of the FCRA (15 U.S.C. § 1681b(a)) for which a person may lawfully obtain a Consumer Report from a Consumer Reporting Agency, including, without limitation, the purposes set forth in Sections 604(a)(3)(A) through 604(a)(3)(F) thereof.
1.4 "Licensed Consumer Data" shall mean all Consumer Report information and consumer credit data furnished by Meridian to Quorum under the MDLA, including, without limitation, all data elements, records, files, and information contained in or delivered through the MCI Consumer Credit File™ and MCI AltSignal™ data products. For the avoidance of doubt, the term "Licensed Consumer Data" includes data furnished via batch delivery, real-time API access, and any other delivery mechanism specified in the MDLA.
1.5 "Insurance Transaction" shall mean the underwriting of insurance as described in Section 604(a)(3)(C) of the FCRA (15 U.S.C. § 1681b(a)(3)(C)), including, without limitation, the evaluation of an individual's application for insurance coverage, the setting of premiums, the determination of policy terms and conditions, and any other decision made by an insurer in connection with the issuance or proposed issuance of an insurance policy to a consumer.
1.6 "Account Review" shall mean a review of an existing insurance account or policy as described in Section 604(a)(3)(F)(ii) of the FCRA (15 U.S.C. § 1681b(a)(3)(F)(ii)), including, without limitation, a review conducted to determine whether a consumer continues to meet the terms of an existing insurance account or policy, renewal underwriting, periodic risk reassessment during the policy term, and any other review of an existing insurance relationship initiated by the insurer for a legitimate business purpose.
1.7 "Derived Data" shall have the meaning ascribed to such term in Article VII of the MDLA. The parties acknowledge and agree that, as of the date of this draft, the treatment of Derived Data under the MDLA remains a disputed term subject to ongoing negotiation between the parties. Notwithstanding any contractual resolution of the Derived Data provisions under Article VII of the MDLA, the FCRA obligations set forth in this Schedule shall apply to any Derived Data that constitutes or contains a Consumer Report or Consumer Report information, as further described in Section 7 of this Schedule.
1.8 Cross-References. All other capitalized terms used in this Schedule and not defined herein, including, without limitation, the terms "Effective Date," "Term," "Confidential Information," "Intellectual Property," "Data Security Addendum," "Data Processing Agreement," and "Authorized Users," shall have the meanings ascribed to such terms in the MDLA and the applicable schedules, addenda, and exhibits thereto.
SECTION 2: CERTIFICATION OF PERMISSIBLE PURPOSE
2.1 Primary Permissible Purposes
Quorum hereby certifies to Meridian that it will access, obtain, and use Licensed Consumer Data solely for the following Permissible Purposes, as authorized under Section 604(a) of the FCRA:
2.1.1 Insurance Underwriting — Section 604(a)(3)(C).
Quorum certifies that it will use Licensed Consumer Data in connection with the underwriting of insurance as authorized under Section 604(a)(3)(C) of the FCRA (15 U.S.C. § 1681b(a)(3)(C)). Quorum is a multi-line insurance carrier and insurance-technology platform operator engaged in the underwriting of property and casualty insurance, life insurance, and specialty lines of insurance across multiple jurisdictions within the United States. Quorum holds active insurance carrier licenses or is authorized to transact insurance business in all fifty (50) states, the District of Columbia, and Puerto Rico, and operates through its subsidiaries and affiliated entities as set forth in Exhibit C to the MDLA.
Quorum will use data obtained from the MCI Consumer Credit File™ and MCI AltSignal™ products to evaluate consumers' eligibility for insurance coverage, establish and set insurance premiums, make underwriting decisions regarding the acceptance or rejection of insurance applications, determine policy terms and conditions, assign consumers to appropriate risk classifications, and perform all other activities reasonably incident to the underwriting of insurance. This includes the use of Licensed Consumer Data as inputs to Quorum's automated underwriting models, predictive analytics engines, and risk-scoring algorithms, including, without limitation, the proprietary QuorumScore™ predictive underwriting model (United States Patent and Trademark Office application pending, Serial No. 97/482,116). Quorum's use of Licensed Consumer Data in automated underwriting systems is further addressed in Section 6 of this Schedule.
Quorum further certifies that its use of Licensed Consumer Data for insurance underwriting purposes is directly related to and in furtherance of bona fide Insurance Transactions in which the consumer whose Consumer Report is obtained has either (a) applied for insurance coverage with Quorum or one of its affiliated insurance carriers, or (b) is otherwise the subject of a legitimate underwriting evaluation initiated by Quorum in the ordinary course of its insurance business.
2.1.2 Account Review — Section 604(a)(3)(F)(ii).
Quorum certifies that it will use Licensed Consumer Data for the review and maintenance of existing insurance accounts and policies as authorized under Section 604(a)(3)(F)(ii) of the FCRA (15 U.S.C. § 1681b(a)(3)(F)(ii)). Specifically, Quorum will use Licensed Consumer Data to determine whether existing policyholders continue to meet the terms and conditions of their insurance policies, to conduct renewal underwriting in connection with the expiration and potential renewal of existing policies, to perform periodic risk reassessment during the policy term, to evaluate changes in a policyholder's risk profile that may affect premium pricing or coverage eligibility, and to perform all other activities reasonably incident to the review and maintenance of an existing insurance account.
Quorum's Account Review use of Licensed Consumer Data shall be limited to consumers with whom Quorum or one of its affiliated insurance carriers has an existing insurance relationship at the time of the data access. Quorum shall not use the Account Review permissible purpose to access Licensed Consumer Data with respect to consumers who do not have an active, in-force insurance policy or pending insurance application with Quorum or its affiliates.
2.2 Additional Permissible Purposes (If Applicable)
2.2.1 Claims Investigation and Fraud Detection — Section 604(a)(3)(D).
Quorum's intended use of Licensed Consumer Data extends to claims-fraud detection and claims investigation activities that are performed in connection with Quorum's insurance operations. Quorum utilizes proprietary claims-fraud detection algorithms and investigative analytics tools that incorporate Licensed Consumer Data to identify potentially fraudulent insurance claims, detect patterns of claims activity indicative of organized fraud rings, and support the investigation and adjudication of insurance claims submitted by policyholders.
The parties acknowledge that the permissible purpose basis for Quorum's claims-fraud detection activities may be analyzed under either (a) Section 604(a)(3)(C) of the FCRA, as an activity incident to the underwriting of insurance, or (b) Section 604(a)(3)(D)(i) of the FCRA, as a review of an account to determine whether the consumer continues to meet the terms of an existing account or as a legitimate business need for the information in connection with a business transaction that is initiated by the consumer. To the extent that Quorum's claims-fraud detection and claims investigation activities constitute a separate and independent permissible purpose under Section 604(a)(3)(D), Quorum hereby certifies such purpose in addition to the primary permissible purposes set forth in Section 2.1 above. Quorum represents that its claims-fraud detection activities are conducted solely in connection with and as a component of Quorum's insurance relationship with the consumer whose Consumer Report is accessed, and are not conducted for any purpose unrelated to Quorum's insurance operations.
2.2.2 Reservation of Right to Supplement.
Quorum reserves the right to supplement this Certification with additional Permissible Purpose categories if Quorum's intended uses of Licensed Consumer Data expand during the five-year Term of the MDLA or any renewal thereof. Any such supplemental certification shall be provided in writing to Meridian prior to Quorum's accessing Licensed Consumer Data for the new purpose and shall be in a form reasonably acceptable to Meridian. No supplemental certification shall be effective until acknowledged in writing by Meridian's Chief Privacy Officer or designee. Quorum acknowledges that any expanded use of Licensed Consumer Data must independently comply with all applicable FCRA requirements and that Meridian retains the right to decline to furnish Consumer Reports for any purpose that Meridian, in its reasonable discretion, determines does not constitute a valid Permissible Purpose under the FCRA.
2.3 Negative Certification / Prohibited Uses
Quorum hereby certifies that it will not access, obtain, or use Licensed Consumer Data for any purpose not authorized under Section 604 of the FCRA, including, without limitation, the following prohibited uses:
(a) Employment Screening. Quorum will not use Licensed Consumer Data for employment purposes as described in Section 604(a)(3)(B) of the FCRA (15 U.S.C. § 1681b(a)(3)(B)), including, without limitation, for the purpose of evaluating a consumer for employment, promotion, reassignment, or retention as an employee. Quorum's access to Licensed Consumer Data under the MDLA is not related to Quorum's role as an employer, and Quorum shall not access or use Licensed Consumer Data in connection with any employment decision.
(b) Government Licenses or Benefits. Quorum will not use Licensed Consumer Data for the purpose of determining a consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status, as described in Section 604(a)(3)(D) of the FCRA, except to the extent that such use falls within the insurance underwriting or account review purposes certified in Section 2.1 above.
(c) Non-Consumer-Initiated Transactions. Quorum will not use Licensed Consumer Data for any purpose that is not initiated by the consumer or not in connection with an Insurance Transaction or Account Review, except as otherwise permitted by applicable law.
(d) Direct Marketing and Solicitation. Quorum will not use Licensed Consumer Data for direct marketing or solicitation purposes to the extent prohibited under the FCRA. Quorum acknowledges that prescreened offers of insurance under Section 604(c) of the FCRA (15 U.S.C. § 1681b(c)) constitute a separate regulatory regime with independent requirements, including the firm-offer-of-credit or insurance requirements. Quorum is not seeking authorization under this Certification to conduct prescreened solicitations, and any future use of Licensed Consumer Data for prescreened offers shall require a separate certification and compliance with Section 604(c) requirements.
(e) Resale or Re-Dissemination. Quorum will not resell, sublicense, or otherwise re-disseminate Licensed Consumer Data constituting Consumer Reports to any third party, except as expressly permitted under the FCRA, this Schedule, and the MDLA, and subject to the restrictions set forth in Section 3.2 below.
(f) Any Other Unauthorized Purpose. Quorum will not use Licensed Consumer Data for any purpose not enumerated in Section 604(a) of the FCRA or otherwise authorized by applicable federal or state law.
SECTION 3: QUORUM'S COMPLIANCE OBLIGATIONS
3.1 End-User Obligations Under FCRA
As a user of Consumer Reports furnished by Meridian, Quorum shall comply with all obligations imposed on users of Consumer Reports under the FCRA, applicable CFPB and FTC regulations, and State FCRA Analogues. Without limiting the generality of the foregoing, Quorum shall comply with the following specific obligations:
3.1.1 Adverse Action Notices.
Quorum shall comply with Section 615 of the FCRA (15 U.S.C. § 1681m) and applicable CFPB regulations (12 C.F.R. § 1022.72) by providing adverse action notices to consumers whenever an adverse underwriting decision is made based in whole or in part on information contained in a Consumer Report obtained from Meridian. For purposes of this Section, an "adverse underwriting decision" includes, without limitation, a denial of insurance coverage, an increase in premium or surcharge based on credit information, a reduction or limitation of coverage, a cancellation or non-renewal of a policy, and any other action that is adverse to the interests of the consumer and is based in whole or in part on Consumer Report information.
Each adverse action notice provided by Quorum shall include: (a) the name, address, and telephone number of Meridian Credit intelligence, Inc. as the Consumer Reporting Agency that furnished the Consumer Report upon which the adverse action was based, in whole or in part; (b) a statement that Meridian did not make the adverse decision and is unable to provide the consumer with specific reasons for the adverse action; (c) a statement of the consumer's right to obtain a free copy of the Consumer Report from Meridian within sixty (60) days; and (d) a statement of the consumer's right to dispute the accuracy or completeness of any information in the Consumer Report. Quorum shall use the adverse action notice template provided by Meridian or a substantially similar form that complies with all applicable FCRA requirements.
3.1.2 Disposal of Consumer Report Information.
Quorum shall comply with the FTC's Disposal Rule (16 C.F.R. Part 682) and applicable CFPB regulations (12 C.F.R. § 1022.20 et seq.) regarding the proper disposal of Consumer Report information. Quorum shall take reasonable measures to protect against unauthorized access to or use of Consumer Report information in connection with its disposal, including the implementation of appropriate policies and procedures governing the destruction, erasure, or modification of records containing Consumer Report information. Such measures shall include, at a minimum: (a) burning, pulverizing, or shredding papers containing Consumer Report information so that the information cannot practicably be read or reconstructed; (b) destroying or erasing electronic media containing Consumer Report information so that the information cannot practicably be read or reconstructed; and (c) entering into a contract with a third-party disposal service provider that requires such service provider to implement and monitor compliance with reasonable disposal policies and procedures.
3.1.3 Accuracy and Integrity.
Quorum shall not use Licensed Consumer Data that it knows or has reasonable cause to believe is inaccurate for any purpose for which a Consumer Report may be furnished under the FCRA. If Quorum becomes aware that any Licensed Consumer Data is or may be inaccurate, Quorum shall promptly notify Meridian and shall refrain from using such data in connection with any underwriting, account review, or other decision affecting a consumer until the accuracy of such data has been verified or corrected by Meridian.
3.1.4 Consumer Dispute Assistance.
Quorum shall cooperate with Meridian in the investigation and resolution of consumer disputes under Section 611 of the FCRA (15 U.S.C. § 1681i) and applicable CFPB regulations. Such cooperation shall include, without limitation: (a) timely response to Meridian's requests for information related to the accuracy of disputed trade-line data, data elements, or other information that Quorum has furnished to or received from Meridian; (b) completion and return of all dispute verification forms within the timeframes required by the FCRA (generally within thirty (30) days after receipt of a dispute notice from Meridian, or fifteen (15) days in the case of expedited dispute investigations under Section 611(a)(7)); and (c) correction or deletion of any information that Meridian determines to be inaccurate or incomplete as a result of a consumer dispute investigation, to the extent such information is within Quorum's possession or control.
3.2 Restrictions on Re-Dissemination and Sharing
3.2.1 General Prohibition.
Quorum shall not resell, sublicense, distribute, publish, transfer, or otherwise re-disseminate Licensed Consumer Data constituting Consumer Reports to any third party, except as expressly permitted under the FCRA and the MDLA. Any permissible re-dissemination of Consumer Report information shall require the prior written consent of Meridian and shall be conducted in accordance with all applicable FCRA requirements, including the requirement that any third-party recipient independently certify a Permissible Purpose for receiving Consumer Report information.
3.2.2 Derived Data.
The parties acknowledge that the MDLA contains provisions in Article VII regarding the creation, ownership, and commercialization of Derived Data, and that certain terms relating to Derived Data remain in dispute as of the date of this draft. Notwithstanding the ongoing negotiation regarding Derived Data under Article VII, the parties agree that any commercialization, distribution, or re-dissemination of Derived Data to third parties must independently satisfy FCRA requirements to the extent that such Derived Data constitutes or contains a Consumer Report or Consumer Report information. In particular, any third-party recipient of Derived Data that constitutes a Consumer Report must independently certify a Permissible Purpose for receiving such information, and Quorum must comply with all applicable CRA obligations with respect to such re-dissemination, as further described in Section 7 of this Schedule.
3.2.3 Internal Sharing Among Affiliates.
Licensed Consumer Data may be shared among Quorum's affiliated entities and subsidiaries only to the extent that (a) each such affiliated entity or subsidiary independently certifies, in a form substantially similar to this Schedule, a Permissible Purpose for accessing and using Licensed Consumer Data; (b) each such affiliated entity or subsidiary is bound by the terms and conditions of this Schedule, whether through a joinder agreement, sub-certification, or other written instrument reasonably acceptable to Meridian; and (c) such sharing is conducted in accordance with the FCRA's provisions regarding the communication of information among persons related by common ownership or affiliated by corporate control, including the disclosure and opt-out requirements of Section 603(d)(2)(A)(iii) of the FCRA, to the extent applicable. Quorum shall provide Meridian with a list of all affiliated entities and subsidiaries that have been granted access to Licensed Consumer Data, and shall update such list promptly upon any change.
3.3 Data Security Requirements
3.3.1 General Security Obligations.
Quorum shall maintain administrative, technical, and physical safeguards reasonably designed to protect the security, confidentiality, and integrity of Licensed Consumer Data, consistent with the requirements of FCRA Section 628 (15 U.S.C. § 1681w), the FTC's Safeguards Rule (16 C.F.R. Part 314), and all applicable federal and state data security laws and regulations. The specific data security requirements applicable to Quorum's handling of Licensed Consumer Data are set forth in the Data Security Addendum ("DSA") to the MDLA, which is incorporated herein by reference.
3.3.2 SOC 2 Compliance.
As evidence of Quorum's security controls and their operating effectiveness, Quorum shall maintain and provide to Meridian upon request a current SOC 2 Type II Report (System and Organization Controls 2) covering the trust services criteria of security, availability, processing integrity, confidentiality, and privacy, as applicable to Quorum's systems that process, store, or transmit Licensed Consumer Data. Quorum's most recent SOC 2 Type II Report was issued by Felton Thorpe & Co. LLP for the twelve-month period ending December 31, 2023. Quorum shall provide updated SOC 2 Type II Reports to Meridian on an annual basis within thirty (30) days after issuance.
3.3.3 Regulatory Compliance.
Quorum represents that it is in compliance with the New York Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500) and all applicable state insurance data-security requirements in each jurisdiction in which Quorum conducts insurance business. Quorum shall promptly notify Meridian of any material changes to its compliance status under such regulations or of any regulatory examination findings or enforcement actions related to data security.
3.4 Record Retention and Audit
3.4.1 Record Retention.
Quorum shall maintain complete and accurate records documenting its Permissible Purpose for each access to or use of Licensed Consumer Data, including, at a minimum, the identity of the consumer whose Consumer Report was accessed, the date of access, the Permissible Purpose relied upon, the identity of the Quorum employee or system that initiated the access, and the business purpose for which the data was used. Such records shall be maintained for a period of not less than five (5) years following the date of access and shall be made available to Meridian upon request in connection with an audit conducted pursuant to Section 3.4.2 below.
3.4.2 Audit Rights.
Meridian shall have the right, upon reasonable prior written notice of not less than thirty (30) calendar days, and during Quorum's normal business hours, to audit and inspect Quorum's compliance with this Schedule, including, without limitation, verification of Permissible Purpose documentation, review of adverse action notice procedures, inspection of data security controls, and examination of Quorum's FCRA compliance policies and procedures. Such audits shall be conducted no more than once in any twelve (12) month period; provided, however, that if Meridian identifies a specific compliance concern based on a consumer complaint, regulatory inquiry, or other credible information suggesting a potential FCRA violation, Meridian may conduct one (1) additional audit within such twelve (12) month period, and such additional audit shall be limited in scope to the identified compliance concern. Quorum shall cooperate fully with any audit conducted under this Section and shall provide Meridian's auditors with reasonable access to relevant personnel, systems, records, and facilities.
3.4.3 Data Breach Notification.
Quorum's obligations regarding notification of data breaches or security incidents affecting Licensed Consumer Data are set forth in the DSA. Without limiting those obligations, Quorum shall notify Meridian within forty-eight (48) hours after Quorum becomes aware of any breach of security, unauthorized access, or unauthorized disclosure affecting Licensed Consumer Data constituting Consumer Reports, as further described in the DSA.
3.5 Post-Termination Obligations
3.5.1 Return or Destruction of Licensed Consumer Data.
Upon the termination or expiration of the MDLA for any reason, Quorum shall return to Meridian or destroy all Licensed Consumer Data constituting Consumer Reports within ninety (90) calendar days after the effective date of termination or expiration, in accordance with the MDLA's data return and destruction provisions (Article XII). Quorum shall certify in writing to Meridian, within ten (10) business days after the completion of such return or destruction, that all Licensed Consumer Data constituting Consumer Reports has been returned or destroyed and that no copies, excerpts, or derivatives thereof have been retained, except as otherwise permitted by applicable law or regulatory requirements.
3.5.2 Derived Data.
The parties acknowledge that the treatment of Derived Data upon termination or expiration of the MDLA is a disputed term under the ongoing MDLA negotiations as of the date of this draft, and this Schedule does not purport to resolve that dispute. The parties shall address the post-termination treatment of Derived Data in connection with the resolution of Article VII of the MDLA. Notwithstanding the foregoing, and regardless of the contractual resolution of the Derived Data provisions, to the extent that any Derived Data constitutes or contains Consumer Report information, all FCRA obligations — including, without limitation, obligations relating to permissible purpose, adverse action notices, consumer dispute investigation, data security, and proper disposal — shall survive the termination or expiration of the MDLA and shall continue to apply to Quorum's possession, use, and disposition of such Derived Data for so long as Quorum retains such data.
SECTION 4: REPRESENTATIONS AND WARRANTIES OF QUORUM
Quorum hereby makes the following representations and warranties to Meridian, each of which is material to Meridian's decision to furnish Consumer Reports to Quorum under the MDLA and this Schedule:
4.1 Insurance Business. Quorum represents and warrants that it is engaged in the business of insurance underwriting and is duly licensed, authorized, and in good standing under applicable law to engage in Insurance Transactions in each jurisdiction in which it operates and in which it will use Licensed Consumer Data. Quorum shall promptly notify Meridian if Quorum's insurance licenses are suspended, revoked, or materially restricted in any jurisdiction.
4.2 Written Policies and Procedures. Quorum represents and warrants that it has established and maintains written policies and procedures reasonably designed to ensure that Licensed Consumer Data is accessed and used solely for the Permissible Purposes certified herein, and that such policies and procedures are regularly reviewed and updated to reflect changes in applicable law and industry best practices. Such policies and procedures include, at a minimum, access controls limiting data access to authorized personnel, logging and monitoring of data access events, Permissible Purpose verification procedures, and procedures for responding to consumer inquiries and disputes.
4.3 Designated Compliance Officer. Quorum represents and warrants that it has designated a qualified compliance officer or compliance team responsible for overseeing FCRA compliance in connection with the use of Licensed Consumer Data. As of the date of this Schedule, the designated compliance contact within Quorum is Claudia Reeves, Vice President, Regulatory & Compliance, Quorum Insurance Holdings Corp. Quorum shall promptly notify Meridian in writing if the designated compliance contact changes.
4.4 Training. Quorum represents and warrants that all of its employees, agents, contractors, and other personnel who have access to Licensed Consumer Data have received training on FCRA requirements, Quorum's Permissible Purpose obligations, and the terms and conditions of this Schedule, and that such training is provided on an initial basis upon hire or engagement and on a recurring basis at least annually thereafter. Quorum shall maintain records of such training, including the dates of training, the names of participants, and the subject matter covered, and shall make such records available to Meridian upon request.
4.5 Notification of Violations. Quorum represents and warrants that it will promptly notify Meridian in writing if Quorum becomes aware of any actual or suspected violation of FCRA requirements, this Schedule, or applicable data protection laws in connection with its access to or use of Licensed Consumer Data. Such notification shall be provided within seventy-two (72) hours after Quorum becomes aware of the actual or suspected violation and shall include a reasonable description of the nature and scope of the violation, the Licensed Consumer Data affected, and the corrective measures taken or planned by Quorum.
4.6 No Enforcement Actions. Quorum represents and warrants that it is not currently, and has not within the past five (5) years been, the subject of any enforcement action, consent order, consent decree, civil investigative demand, civil penalty, or formal supervisory action by the FTC, the CFPB, any state attorney general, or any state insurance regulatory authority relating to FCRA compliance, the misuse of Consumer Report information, or the failure to comply with data security requirements applicable to Consumer Report information. If any such enforcement action, investigation, or proceeding is commenced during the Term of the MDLA, Quorum shall promptly notify Meridian in writing.
SECTION 5: MERIDIAN'S OBLIGATIONS AS CONSUMER REPORTING AGENCY
5.1 CRA Status. Meridian represents and warrants that it is a Consumer Reporting Agency as defined in Section 603(f) of the FCRA and that the Licensed Consumer Data furnished to Quorum under the MDLA constitutes Consumer Reports or information derived from Consumer Reports. Meridian acknowledges that, as a CRA, it is subject to the obligations imposed on CRAs under the FCRA, including, without limitation, the obligations set forth in Sections 607, 610, 611, 612, and 628 thereof.
5.2 CRA Compliance Obligations. Meridian shall maintain and comply with its obligations under the FCRA, including, without limitation:
(a) Section 607 — Compliance Procedures. Meridian shall maintain reasonable procedures designed to avoid violations of Section 605 (concerning obsolete information) and to limit the furnishing of Consumer Reports to persons that Meridian has reason to believe will use the information for a Permissible Purpose under Section 604. Meridian shall require prospective users of Consumer Reports, including Quorum, to identify the purposes for which the information is sought and to certify the purposes for which the information will be used.
(b) Section 610 — Conditions of Disclosure to Consumers. Meridian shall comply with the requirements of Section 610 regarding the disclosure of information to consumers upon request, including the obligation to clearly and accurately disclose all information in the consumer's file at the time of the request, the sources of information, and the identification of each person that procured a Consumer Report during specified periods.
(c) Section 611 — Procedure in Case of Disputed Accuracy. Meridian shall maintain reasonable procedures for investigating consumer disputes regarding the completeness or accuracy of information in Consumer Reports, including the obligation to conduct a reasonable reinvestigation within thirty (30) days (or forty-five (45) days in certain circumstances) after receiving a dispute notice, to record the current status of the disputed information or delete the item, and to provide written notice of the results of the reinvestigation to the consumer.
5.3 Notice of Material Changes. Meridian shall provide Quorum with reasonable advance written notice of any material changes to the accuracy, completeness, or composition of the Licensed Consumer Data, or to Meridian's consumer dispute resolution process, that could reasonably be expected to affect Quorum's use of the Licensed Consumer Data in its insurance underwriting or account review activities. Such notice shall be provided at least thirty (30) days prior to the effective date of any such material change, or as soon as reasonably practicable if advance notice is not feasible.
5.4 Security and Data Integrity. Meridian maintains comprehensive information security and data-integrity controls, as evidenced by (a) Meridian's SOC 2 Type II Report issued by Galloway Nash LLP for the twelve-month period ending March 31, 2023, covering the trust services criteria of security, availability, processing integrity, confidentiality, and privacy, and (b) Meridian's ISO 27001:2022 certification (Certificate No. IS 738291, issued by BSI Group, valid through September 30, 2025). Meridian shall provide updated SOC 2 Type II Reports to Quorum on an annual basis and shall promptly notify Quorum of any material changes to its ISO 27001 certification status.
SECTION 6: USE OF LICENSED CONSUMER DATA IN AUTOMATED DECISION-MAKING SYSTEMS
6.1 Acknowledgment of Automated Decision-Making.
The parties acknowledge that Quorum intends to use Licensed Consumer Data as inputs to automated underwriting models, claims-fraud detection algorithms, customer propensity scoring systems, and other automated decision-making tools and technologies, including, without limitation, the proprietary QuorumScore™ predictive underwriting model. QuorumScore™ is a machine-learning-based model that ingests consumer credit data, alternative credit data, and other variables to generate a composite risk score used in Quorum's insurance underwriting process. The parties agree that the use of Licensed Consumer Data in such automated systems is within the scope of the Permissible Purposes certified in Section 2 of this Schedule, provided that all FCRA requirements applicable to such use are satisfied.
6.2 Adverse Action Notice Obligations for Automated Decisions.
Quorum acknowledges and agrees that the use of Licensed Consumer Data in automated underwriting models and decision-making systems does not relieve Quorum of its obligation to provide adverse action notices to consumers in compliance with Section 615 of the FCRA. When an adverse underwriting decision is generated in whole or in part by an automated system that utilizes Licensed Consumer Data, Quorum shall: (a) provide the consumer with an adverse action notice that complies with all requirements of Section 615 and applicable CFPB regulations; (b) identify the principal reasons for the adverse action, which may include the key factors from the Licensed Consumer Data that contributed to the adverse decision, consistent with the FCRA's requirement to disclose up to four (4) key factors (or five (5) key factors if one of the factors is the number of inquiries); and (c) identify Meridian as the CRA that furnished the Consumer Report upon which the adverse action was based, in whole or in part. Quorum shall implement procedures to ensure that its automated systems are capable of generating the requisite adverse action reason codes and consumer-facing explanations.
6.3 Algorithmic Accountability Considerations.
The parties acknowledge that the regulatory landscape governing automated decision-making and algorithmic accountability is evolving at both the federal and state levels, including, without limitation, proposed rulemaking by the CFPB regarding automated valuation models and algorithmic accountability, state legislation addressing automated decision-making in insurance (including Colorado Senate Bill 21-169 and its implementing regulations), and broader trends in algorithmic fairness and transparency regulation. Quorum's compliance team should monitor these developments and assess whether additional obligations may apply to Quorum's use of Licensed Consumer Data in automated systems. This Section 6.3 is provided for advisory purposes and does not create binding obligations under the MDLA; however, the parties agree to consult in good faith regarding the impact of any new regulatory requirements on their respective obligations under this Schedule and the MDLA.
6.4 Machine-Learning Model Outputs and Derived Data.
The parties acknowledge that the question of whether machine-learning model outputs, model weights, and predictive scores generated by Quorum's automated systems trained on or incorporating Meridian data constitute "Derived Data" under Article VII of the MDLA remains an open negotiation point as of the date of this draft. The parties shall address this question in connection with the resolution of Article VII. Notwithstanding the contractual resolution of this issue, the parties agree that FCRA obligations attach to any model output, score, or analytical product that constitutes a Consumer Report — i.e., that bears on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living and is used or expected to be used as a factor in establishing the consumer's eligibility for insurance, credit, or other purposes enumerated in Section 604 — regardless of the contractual or intellectual property classification of such output under the MDLA.
SECTION 7: FCRA IMPLICATIONS FOR DERIVED DATA
7.1 When Derived Data Constitutes a Consumer Report.
The parties acknowledge that Derived Data, as defined under Article VII of the MDLA, may in certain circumstances itself constitute a "Consumer Report" within the meaning of Section 603(d) of the FCRA. Derived Data will constitute a Consumer Report when such data: (a) bears on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living; (b) is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for insurance, credit, employment, or any other purpose authorized under Section 604 of the FCRA; and (c) is communicated by a Consumer Reporting Agency (or by a person who, by virtue of its activities, meets the definition of a Consumer Reporting Agency) to a third party. The determination of whether specific Derived Data items constitute Consumer Reports must be assessed on a case-by-case basis, taking into account the nature of the data, the manner in which it is assembled and communicated, and the purpose for which it is used or expected to be used.
7.2 Quorum's Obligations with Respect to Derived Data.
Regardless of the contractual allocation of intellectual property ownership in Derived Data under Article VII of the MDLA, Quorum shall treat any Derived Data that constitutes or contains a Consumer Report as subject to all FCRA Permissible Purpose and compliance obligations set forth in this Schedule, including, without limitation, the obligations relating to Permissible Purpose certification (Section 2), adverse action notices (Section 3.1.1), data security (Section 3.3), record retention (Section 3.4), consumer dispute assistance (Section 3.1.4), and proper disposal (Section 3.1.2). The contractual characterization of data as "Derived Data" under the MDLA does not alter or diminish the statutory protections afforded to consumers under the FCRA.
7.3 Re-Dissemination of Derived Data to Third Parties.
If Quorum commercializes, distributes, or otherwise re-disseminates Derived Data to third parties (subject to the resolution of the Article VII disputes under the MDLA), and such Derived Data constitutes or contains Consumer Report information, the following FCRA implications will apply:
(a) Each third-party recipient of such Derived Data must independently certify a Permissible Purpose for receiving Consumer Report information, and Quorum must obtain and retain documentation of such certification prior to furnishing the Derived Data;
(b) Quorum would, by virtue of its regular assembly, evaluation, and furnishing of consumer information to third parties, itself function as a Consumer Reporting Agency with respect to such re-dissemination, thereby triggering Quorum's own obligations under FCRA Sections 607 (compliance procedures), 611 (dispute investigation procedures), 615 (adverse action notice requirements for users of reports furnished by Quorum), 612 (charges for disclosures), and 628 (disposal of records);
(c) Quorum would be subject to the full range of CRA obligations under the FCRA, including the obligation to maintain reasonable procedures to ensure the maximum possible accuracy of consumer information, to investigate and resolve consumer disputes within the timeframes prescribed by Section 611, and to provide consumer disclosures upon request under Section 610;
(d) Quorum would be subject to regulatory oversight by the CFPB as a Consumer Reporting Agency, including potential examination and enforcement authority; and
(e) Quorum shall be solely responsible for all compliance obligations arising from its status as a CRA with respect to such re-dissemination and shall indemnify Meridian against any losses, damages, or regulatory penalties arising therefrom.
The parties agree that the implications described in this Section 7.3 have significant regulatory consequences for Quorum and should be carefully evaluated by Quorum's legal and compliance teams before any decision is made to commercialize Derived Data containing Consumer Report information.
7.4 QuorumScore™ Outputs.
The parties specifically acknowledge that QuorumScore™ outputs — including composite risk scores, sub-scores, risk classifications, and associated reason codes — may constitute Consumer Reports when such outputs are based in part on Licensed Consumer Data (including data from the MCI Consumer Credit File™ or MCI AltSignal™) and are used in connection with insurance underwriting decisions or other purposes enumerated in Section 604 of the FCRA. Quorum shall treat QuorumScore™ outputs that meet the definition of a Consumer Report as subject to all applicable FCRA requirements, including adverse action notice obligations, and shall not furnish such outputs to third parties without ensuring compliance with the CRA obligations described in Section 7.3 above.
SECTION 8: STATE LAW CONSIDERATIONS
8.1 Acknowledgment of State FCRA Analogues.
The parties acknowledge that certain states have enacted statutes that are analogous to or supplement the FCRA and that impose additional obligations on the furnishing and use of consumer credit information. Such State FCRA Analogues include, without limitation:
(a) California: The California Consumer Credit Reporting Agencies Act (Cal. Civ. Code §§ 1785.1 et seq.), the Investigative Consumer Reporting Agencies Act (Cal. Civ. Code §§ 1786 et seq.), and the California Consumer Privacy Act / California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 et seq.) ("CCPA/CPRA"), which impose additional requirements on the collection, use, and disclosure of consumer information, including enhanced consumer rights and business obligations;
(b) Connecticut: Connecticut General Statutes § 31-51tt (regarding employee background checks) and various insurance-specific consumer credit regulations;
(c) New York: New York General Business Law Article 25 (Fair Credit Reporting Act), New York Insurance Law provisions restricting the use of credit information in insurance underwriting, and 23 NYCRR Part 500 (NY DFS Cybersecurity Regulation);
(d) Other States: Various state laws restricting or regulating the use of credit-based insurance scores, including, without limitation, statutes in Hawaii, Maryland, Massachusetts, Oregon, Utah, and Washington, among others.
8.2 Compliance with State Insurance Credit-Score Restrictions.
Quorum shall comply with all applicable state laws governing the use of consumer credit information in Insurance Transactions, including state-specific restrictions on the use of credit-based insurance scores. Quorum acknowledges that certain states prohibit or restrict the use of credit information as a factor in insurance underwriting, rating, or renewal decisions, and that such restrictions may limit Quorum's ability to use Licensed Consumer Data in connection with Insurance Transactions in those jurisdictions. Quorum shall maintain a current inventory of state-specific restrictions on the use of credit information in insurance and shall implement appropriate controls to ensure compliance with such restrictions.
8.3 Cross-Reference to CCPA/CPRA Compliance.
The CCPA/CPRA imposes obligations on businesses that collect, use, or disclose the personal information of California consumers, and the CCPA/CPRA's exemptions for information collected, processed, sold, or disclosed pursuant to the FCRA (Cal. Civ. Code § 1798.145(d)) may not extend to all of Quorum's intended uses of Licensed Consumer Data, particularly with respect to Derived Data or data used for purposes beyond those expressly covered by the FCRA exemption. Quorum's obligations under the CCPA/CPRA are addressed in the Data Processing Agreement ("DPA") attached to the MDLA, which is incorporated herein by reference. The parties shall also refer to the memoranda prepared by Calderwood & Harkness LLP analyzing the CCPA/CPRA implications for Derived Data commercialization, copies of which have been provided to both parties under separate cover.
SECTION 9: REMEDIES FOR NON-COMPLIANCE
9.1 Suspension and Termination.
If Meridian reasonably determines, based on an audit, consumer complaint, regulatory inquiry, or other credible information, that Quorum has accessed or used Licensed Consumer Data without a valid Permissible Purpose or in violation of the FCRA or the obligations set forth in this Schedule, Meridian may:
(a) Immediately suspend Quorum's access to the applicable data products (including suspension of batch data deliveries and API access) pending investigation by Meridian and Quorum of the alleged non-compliance. Such suspension shall take effect upon written notice to Quorum (which may be provided by electronic mail to the compliance and legal contacts identified in Section 11 below) and shall remain in effect until Meridian is reasonably satisfied that the non-compliance has been identified and remediated; and
(b) Terminate the MDLA in its entirety if the non-compliance is not cured within thirty (30) calendar days after written notice specifying the nature of the non-compliance is delivered to Quorum. Such termination shall be in addition to, and not in lieu of, Meridian's right to suspend access under clause (a) above. For the avoidance of doubt, if Quorum cures the non-compliance to Meridian's reasonable satisfaction within the thirty (30) day cure period, Meridian shall promptly reinstate Quorum's access to the applicable data products.
9.2 Indemnification.
Quorum shall defend, indemnify, and hold harmless Meridian and its officers, directors, employees, agents, affiliates, and successors (collectively, the "Meridian Indemnified Parties") from and against any and all losses, damages, liabilities, claims, demands, suits, judgments, settlements, fines, penalties, costs, and expenses (including reasonable attorneys' fees and costs of investigation) arising out of or relating to Quorum's failure to comply with FCRA Permissible Purpose requirements, the obligations set forth in this Schedule, or any applicable federal, state, or local law governing the use of Consumer Report information. This indemnification obligation shall survive the termination or expiration of the MDLA and this Schedule.
9.3 Cumulative Remedies.
Meridian's remedies under this Section 9 are in addition to, and not in lieu of, any other remedies available to Meridian under the MDLA, at law, or in equity, including, without limitation, any remedies for breach of contract, injunctive relief, and specific performance. No exercise of any remedy by Meridian shall constitute a waiver of any other remedy available to Meridian.
SECTION 10: ONGOING CERTIFICATION AND RENEWAL
10.1 Annual Re-Certification.
Quorum shall re-certify its Permissible Purposes under this Schedule on an annual basis, no later than thirty (30) calendar days after each anniversary of the Effective Date of the MDLA. Such annual re-certification shall be provided in the form attached hereto as Exhibit A (Form of Annual Re-Certification) or in such other form as Meridian may reasonably require. Failure to provide the annual re-certification within the required timeframe shall constitute a material breach of this Schedule and the MDLA, and Meridian may suspend Quorum's access to Licensed Consumer Data until such re-certification is received.
10.2 Updated Certifications.
If Quorum's Permissible Purposes change during the Term of the MDLA, Quorum shall promptly provide an updated Certification to Meridian prior to accessing Licensed Consumer Data for the new purpose. No access to Licensed Consumer Data for a new or modified Permissible Purpose shall be permitted until such updated Certification has been acknowledged in writing by Meridian. Any updated Certification shall be treated as an amendment to this Schedule and shall be attached hereto as a supplemental exhibit.
10.3 Supplemental Certifications.
Meridian reserves the right to require supplemental certifications, questionnaires, or other information from Quorum at any time during the Term of the MDLA if Meridian believes, in good faith, that additional verification of Quorum's Permissible Purpose is necessary. Such supplemental certification requests may be triggered by, among other things, (a) changes in applicable law or regulatory guidance, (b) consumer complaints or disputes suggesting potential misuse of Consumer Report information, (c) findings from audits conducted pursuant to Section 3.4.2, or (d) changes in Quorum's business operations that could affect its Permissible Purpose. Quorum shall respond to any supplemental certification request within fifteen (15) business days after receipt.
SECTION 11: AUTHORIZED CONTACTS
The following individuals are designated as the authorized contacts for purposes of communications and notices under this Schedule:
Quorum Insurance Holdings Corp.
FCRA Compliance Contact: Claudia Reeves Vice President, Regulatory & Compliance Quorum Insurance Holdings Corp. 1200 Atlantic Street, Suite 3400 Stamford, CT 06901
Email: c.reeves@quoruminsurance.com
Telephone: (203) 555-4218
Legal Contact: Gregory Stahl Vice President, Legal Affairs Quorum Insurance Holdings Corp. 1200 Atlantic Street, Suite 3400 Stamford, CT 06901
Email: g.stahl@quoruminsurance.com
Telephone: (203) 555-4305
Meridian Credit intelligence, Inc.
FCRA Compliance Contact: Lena Vasquez Chief Privacy Officer Meridian Credit intelligence, Inc. 3300 Peachtree Road NE, Suite 2100 Atlanta, GA 30326
Email: l.vasquez@meridianci.com
Telephone: (404) 555-7812
Legal Contact: Arthur Pennington General Counsel Meridian Credit intelligence, Inc. 3300 Peachtree Road NE, Suite 2100 Atlanta, GA 30326
Email: a.pennington@meridianci.com
Telephone: (404) 555-7900
Either party may change its designated contacts by providing written notice to the other party in accordance with the notice provisions of the MDLA. Such change shall be effective upon receipt of the written notice.
SECTION 12: GOVERNING LAW
12.1 Governing Law. This Schedule shall be governed by and construed in accordance with the laws of the State of New York, without regard to its conflicts-of-law principles, consistent with the governing law provisions set forth in Article XV of the MDLA.
12.2 Federal Preemption. To the extent that any provision of New York law or any other state law conflicts with the FCRA or any other applicable federal law governing the furnishing, use, or protection of Consumer Report information, federal law shall control and preempt such conflicting state law, in accordance with Section 625 of the FCRA (15 U.S.C. § 1681t) and applicable judicial interpretations thereof.
12.3 Severability. If any provision of this Schedule is held to be invalid, illegal, or unenforceable under applicable law, such invalidity, illegality, or unenforceability shall not affect any other provision of this Schedule, and this Schedule shall be construed and enforced as if such invalid, illegal, or unenforceable provision had not been included herein.
12.4 Entire Agreement. This Schedule, together with the MDLA and all other schedules, addenda, and exhibits thereto, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, representations, and understandings of the parties, whether written or oral, with respect to such subject matter.
IN WITNESS WHEREOF, the parties have executed this