The CFPB’s final rule on HMDA (Regulation C) requires lenders to collect, record, and report information on 48 data points, of which 25 are new and 23 existing. For over 25 years, the Federal Financial Institutions Examination Council (FFIEC) also has annually released a transaction-level database of all the submitted HMDA data for the previous year. To reduce the possibility that anyone could identify particular applicants or borrowers, the modified LAR and “agencies’ release” excludes the following fields: application\loan number, the application date, and the date action was taken. In addition to deletion, modification can also take the form of rounding values, aggregation, redaction, interval recoding, and restricted access.
What will guide the bureau’s thought process in determining what 2018 data points will be modified before release to the public? In its final HMDA rule, the bureau indicated it will determine what to disclose to the public by applying a “balancing test” that weighs the risks of privacy interests against the benefits of public release considering HMDA’s statutory purposes. The bureau further establishes a high standard for privacy interests arising under the balancing test.
Using this guidance, I’ve predicted data points that likely require modification in the “agencies’ 2018 public release.”
Data points with a risk to privacy interests
Universal Loan Identifier – To the extent that this substitutes as an account number, it would be personally identifiable information (PII). Not previously disclosed under HMDA (NPDUH).
Application Date – NPDUH
Action Taken Date – NPDUH
Loan Amount – Currently publicly disclosed but rounded in 1000s. Reporting the full loan amount would make personal identification easier by association to public land records.
Property address – PII will not be made public.
Credit score – Ranges of scores could be as useful without the obvious privacy risks.
Debt-to-Income ratio – Combined with income which is already made public one could solve for the dollar amount of the individual’s debt. Suggested modification: relevant ranges.
Age (of applicant(s)) – My wife won’t like this at all. Exact age combined with race, ethnicity, and gender increases risk to privacy interests. Important as a prohibited basis group, but more useful to the public if recoded in bins or age categories for fair lending testing.
Introductory rate period: This points to an adjustable rate mortgage (ARM). ARM riders are usually recorded in the public records creating an opportunity to identify a borrower especially by matching exact interest rate, loan amount, and census tract to public land records.
Mortgage Loan Originator NMLSR Identifier: Being able to personally identify an originator could lead to a lot of unintended consequences regarding LO financial privacy, employment, compensation, social media reviews, and personal liability. The bureau took notice of some of these concerns. However, this may be an area where the value of public disclosure outweighs the potential harm to MLOs.