[Federal Register Volume 82, Number 184 (Monday, September 25, 2017)]
[Notices]
[Pages 44586-44612]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2017-20409]
=======================================================================
-----------------------------------------------------------------------
BUREAU OF CONSUMER FINANCIAL PROTECTION
[Docket No. CFPB-2017-0025]
Disclosure of Loan-Level HMDA Data
AGENCY: Bureau of Consumer Financial Protection.
ACTION: Notice of proposed policy guidance with request for public
comment.
-----------------------------------------------------------------------
SUMMARY: The Bureau of Consumer Financial Protection (Bureau) is
proposing policy guidance that would describe modifications that the
Bureau intends to apply to the loan-level HMDA data that financial
institutions will report under the Home Mortgage Disclosure (Regulation
C) before the data is disclosed to the public. The proposed policy
guidance applies to HMDA data to be reported under Regulation C
effective January 1, 2018. The Bureau will make this data available to
the public beginning in 2019.
DATES: Comments must be received on or before November 24, 2017.
ADDRESSES: You may submit comments, identified by Docket No. CFPB-2017-
0025, by any of the following methods:
Email: [email protected]. Include Docket
No. CFPB-2017-0025 in the subject line of the email.
Federal eRulemaking Portal: http://www.regulations.gov.
Follow the instructions for submitting comments.
Mail: Monica Jackson, Office of the Executive Secretary,
Consumer Financial Protection Bureau, 1700 G Street NW., Washington, DC
20552.
Hand Delivery/Courier: Monica Jackson, Office of the
Executive Secretary, Consumer Financial Protection Bureau, 1700 G
Street NW., Washington, DC 20552.
Instructions: All submissions should include the agency name and
docket number or Regulatory Information Number (RIN). Because paper
mail in the Washington, DC area and at the Bureau is subject to delay,
commenters are encouraged to submit comments electronically. In
general, all comments received will be posted without change to http://www.regulations.gov. In addition, comments will be available for public
inspection and copying at 1700 G Street NW., Washington, DC 20552, on
official business days between the hours of 10 a.m. and 5:00 p.m.
Eastern Time. You can make an appointment to inspect the documents by
telephoning 202-435-7275.
All comments, including attachments and other supporting materials,
will become part of the public record and subject to public disclosure.
Sensitive personal information, such as account numbers or Social
Security numbers, should not be included. Comments will not be edited
to remove any identifying or contact information.
FOR FURTHER INFORMATION CONTACT: David Jacobs, Counsel, or Laura Stack,
Senior Counsel, Office of Regulations, at 202-435-7700 or https://reginquiries.consumerfinance.gov/.
SUPPLEMENTARY INFORMATION:
I. Summary
The Home Mortgage Disclosure Act (HMDA) requires certain financial
institutions to collect, report, and disclose data about their mortgage
lending activity on an ongoing basis to both Federal regulators and the
general public. The home mortgage market is the country's single
largest market for consumer financial products and services, with $10
trillion outstanding.\1\ It is a critical source of wealth-building for
both individual families and communities, and has a substantial impact
on the nation's economy as evidenced by its role in triggering in 2008,
the worst financial crisis since the Great Depression. As of 2015, 48
million consumers had a mortgage, representing 65 percent of all owner-
occupied homes.\2\
---------------------------------------------------------------------------
\1\ Federal Reserve Bank of St. Louis, Board of Governors of the
Federal Reserve System (US), ``Mortgage Debt Outstanding by Type of
Property: One- to Four-Family Residences (MDOTP1T4FR),'' https://fred.stlouisfed.org/series/MDOTP1T4FR (last updated June 9, 2017).
\2\ U.S. Census Bureau, ``Selected Housing Characteristics:
2011-2015 American Community Survey 5-Year Characteristics,''
https://factfinder.census.gov/faces/tableservices/jsf/pages/productview.xhtml?src=bkmk (last visited Aug. 31, 2017).
---------------------------------------------------------------------------
HMDA is implemented by Regulation C, which describes its purposes
as helping to determine whether financial institutions are serving the
housing needs of their communities; assisting public officials in
distributing public-sector investment so as to attract private
investment to areas where it is needed; and assisting in identifying
possible discriminatory lending patterns and enforcing
antidiscrimination statutes. As described further below, public
disclosure of HMDA data is central to
[[Page 44587]]
the achievement of the statutory goals established by Congress.
In 2010, Congress enacted the Dodd-Frank Wall Street Reform and
Consumer Protection Act (Dodd-Frank Act), which amended HMDA to require
collection of additional mortgage market data and transferred HMDA
rulemaking authority and other functions from the Board of Governors of
the Federal Reserve System (Board) to the Bureau. On October 28, 2015,
the Bureau published a final rule amending Regulation C (2015 HMDA
Final Rule) to implement the Dodd-Frank Act amendments. In the 2015
HMDA Final Rule, the Bureau interpreted HMDA, as amended by the Dodd-
Frank Act, to require that the Bureau use a balancing test to determine
whether and how HMDA data should be modified prior to its disclosure to
the public in order to protect applicant and borrower privacy while
also fulfilling HMDA's public disclosure purposes. The Bureau
interpreted HMDA to require that public HMDA data be modified when the
release of the unmodified data creates risks to applicant and borrower
privacy interests that are not justified by the benefits of such
release to the public in light of the statutory purposes.
This proposed Policy Guidance describes the Bureau's application of
the balancing test to date and the loan-level HMDA data that it
proposes to make available to the public beginning in 2019, with
respect to data compiled by financial institutions in or after 2018,
including modifications that the Bureau intends to apply to the data.
In developing this guidance, the Bureau has consulted with the
prudential regulators--Board, the Federal Deposit Insurance
Corporation, the National Credit Union Administration, and the Office
of the Comptroller of the Currency--the Department of Housing and Urban
Development, and the Federal Housing Finance Agency. The Bureau
proposes to publicly disclose the loan-level HMDA data reported under
the 2015 HMDA Final Rule with the following modifications. First, the
Bureau proposes to modify the public loan-level HMDA data to exclude:
The universal loan identifier; the date the application was received or
the date shown on the application form; the date of action taken by the
financial institution on a covered loan or application; the address of
the property securing the loan or, in the case of an application,
proposed to secure the loan; the credit score or scores relied on in
making the credit decision; the unique identifier assigned by the
Nationwide Mortgage Licensing System and Registry for the mortgage loan
originator; and the result generated by the automated underwriting
system used by the financial institution to evaluate the application.
The Bureau also intends to exclude free-form text fields used to report
the following data: Applicant or borrower race; applicant or borrower
ethnicity; the name and version of the credit scoring model used to
generate each credit score or credit scores relied on in making the
credit decision; the principal reason or reasons the financial
institution denied the application, if applicable; and the automated
underwriting system name.
Second, the Bureau proposes to modify the public loan-level HMDA
data to reduce the precision of most of the values reported for the
following data fields. With respect to the amount of the covered loan
or the amount applied for, the Bureau proposes to disclose the midpoint
for the $10,000 interval into which the reported value falls. The
Bureau also proposes to indicate whether the reported value exceeds the
applicable dollar amount limitation on the original principal
obligation in effect at the time of application or origination as
provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2). With
respect to the age of an applicant or borrower, the Bureau proposes to
bin reported values into the following ranges, as applicable: 25 to 34,
35 to 44, 45 to 54, 55 to 64, and 65 to 74; bottom-code reported values
under 25; top-code reported values over 74; and indicate whether the
reported value is 62 or higher. With respect to the ratio of the
applicant's or borrower's total monthly debt to the total monthly
income relied on in making the credit decision, the Bureau proposes to
disclose without modification reported values greater than or equal to
40 percent and less than 50 percent; bin reported values into the
following ranges, as applicable: 20 percent to less than 30 percent; 30
percent to less than 40 percent; and 50 percent to less than 60
percent; bottom-code reported values under 20 percent; and top-code
reported values of 60 percent or higher. With respect to the value of
the property securing the covered loan or, in the case of an
application, proposed to secure the covered loan, the Bureau proposes
to disclose the midpoint for the $10,000 interval into which the
reported value falls.
This proposed Policy Guidance is exempt from notice and comment
rulemaking requirements under the Administrative Procedure Act pursuant
to 5 U.S.C. 553(b). It is non-binding in part to preserve flexibility
to revise the modifications to be applied to the public loan-level HMDA
data as necessary to maintain a proper balancing of the privacy risks
and benefits of disclosure, especially in the event the Bureau becomes
aware of new facts and circumstances that might contribute to privacy
risks. However, the Bureau invites public comment on the proposed
Policy Guidance to provide transparency, obtain public feedback on its
application of the balancing test, and improve the Bureau's
decisionmaking. This proposal does not re-open any portion of the 2015
HMDA Final Rule, and the Bureau does not intend in this proposal to
revisit any decisions made in that rulemaking.
II. Background
A. HMDA's Purposes and the Public Disclosure of HMDA Data
The Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et seq.,
requires certain financial institutions to collect, report, and
disclose data about their mortgage lending activity on an ongoing basis
to both Federal regulators and the general public. HMDA is implemented
by Regulation C, 12 CFR part 1003. HMDA identifies its purposes as
providing the public and public officials with sufficient information
to enable them to determine whether financial institutions are serving
the housing needs of the communities in which they are located, and to
assist public officials in their determination of the distribution of
public sector investments in a manner designed to improve the private
investment environment.\3\ In 1989, Congress expanded HMDA to require,
among other things, financial institutions to report racial
characteristics, gender, and income information on applicants and
borrowers.\4\ In light of these amendments, the Board subsequently
recognized a third HMDA purpose of identifying possible discriminatory
lending patterns and enforcing antidiscrimination statutes, which now
appears with HMDA's other purposes in Regulation C.\5\
---------------------------------------------------------------------------
\3\ 12 U.S.C. 2801(b).
\4\ Financial Institutions Reform, Recovery, and Enforcement
Act, Public Law 101-73, section 1211, 103 Stat. 183, 524-26 (1989).
\5\ 54 FR 51356, 51357 (Dec. 15, 1989) (codified at 12 CFR
1003.1(b)(1)) (Bureau's post-Dodd-Frank Act Regulation C).
---------------------------------------------------------------------------
Public disclosure of HMDA data is central to the achievement of
HMDA's goals. Since HMDA's enactment in 1975, the data financial
institutions are required to disclose under HMDA and Regulation C have
been expanded, public access to HMDA data has increased, and the
formats in which
[[Page 44588]]
HMDA data have been disclosed to the public have evolved to provide
more useful information to the public and public officials. Amendments
to the statute and Regulation C over time illustrate the importance of
public access to HMDA data to fulfill the statute's purposes.
As originally promulgated, HMDA and Regulation C required a covered
financial institution to make available to the public at its home and
branch offices a ``disclosure statement'' reflecting aggregates of
certain mortgage loan data.\6\ In 1980, Congress amended HMDA to
increase the public's access to and the utility of the aggregated HMDA
data. First, Congress amended HMDA section 304 to require that the
Federal Financial Institutions Examination Council (FFIEC) implement a
system to facilitate public access to the data required to be disclosed
under the statute, and provided that such system must include
arrangements for a ``central depository of data'' in each standard
metropolitan statistical area (MSA).\7\ In amending Regulation C to
implement this requirement, the Board noted that ``the principal
benefit of the central repository system is that users of HMDA data
will be able to obtain all of the various institutions' disclosure
statements at one location. The current system requires users to
contact the institutions on an individual basis to obtain the
disclosure data.\8\ Second, the 1980 HMDA amendments required that the
FFIEC compile annually for each MSA aggregate data by census tract for
all financial institutions required to disclose data under HMDA, and
produce tables indicating, for each MSA, aggregate lending patterns for
various categories of census tracts grouped according to location, age
of housing stock, income level, and racial characteristics.\9\ A
principal benefit cited to support these requirements was that the
utility of individual institutions' disclosure statements ``would be
enhanced if they could be compared to aggregate [MSA] lending
patterns.'' \10\
---------------------------------------------------------------------------
\6\ 12 CFR part 203.
\7\ Housing and Community Development Act, Public Law 96-399,
section 340, 94 Stat. 1614 (1980).
\8\ 46 FR 11780, 11786 (Feb. 10, 1981).
\9\ Housing and Community Development Act, Public Law 96-399,
section 34010, Sec. 340, 94 Stat. 1614 (1980).
\10\ 46 FR 11780, 11786 (Feb. 10, 1981).
---------------------------------------------------------------------------
In 1989, as noted above, Congress amended HMDA to expand the data
financial institutions were required to disclose to the public.\11\ In
addition to requiring that financial institutions disclose data
concerning the race, sex, and income of applicants and borrowers, the
1989 amendments required that institutions disclose data on loan
applications in addition to originations and purchases. In implementing
these amendments in Regulation C, the Board required financial
institutions to report HMDA data to their supervisory agencies on a
loan-by-loan and application-by-application basis using the ``loan/
application register'' format.\12\ Commenters on the Board's proposal
to amend Regulation C to implement the 1989 amendments urged the Board
to require that financial institutions make their loan/application
registers available to the public to provide for more meaningful
analysis of the data than that permitted by the required aggregate
disclosures.\13\ The Board declined to require that financial
institutions make available to the public their loan/application
registers, but in 1990 the FFIEC announced that it believed public
disclosure of the reported loan-level HMDA data to be ``consistent with
the congressional intent to maximize the utilization of lending data''
and that it would make all reported HMDA data available to the public
in a loan-level format, after deleting three fields to protect
applicant and borrower privacy.\14\ The FFIEC first disclosed the
reported loan-level HMDA data to the public in October 1991.
---------------------------------------------------------------------------
\11\ Financial Institutions Reform, Recovery and Enforcement
Act, Public Law 101-73, section 1211, 103 Stat. 183 (1989).
\12\ 12 CFR 203.4, 203.5; see also 54 FR 51356, 51359-60 (Dec.
15, 1989).
\13\ 54 FR 51356, 51360-61 (Dec. 15, 1989).
\14\ 55 FR 27886, 27888 (July 6, 1990). In announcing that the
loan-level data submitted to the supervisory agencies on the loan/
application register would be made available to the public, the
FFIEC noted that ``[a]n unedited form of the data would contain
information that could be used to identify individual loan
applicants'' and that the data would be edited prior to public
release to remove the application identification number, the date of
application, and the date of final action.
---------------------------------------------------------------------------
The following year, Congress amended HMDA to require that each
financial institution make available to the public its ``loan
application register information'' for each year as early as March 31
of the succeeding year, as required under regulations prescribed by the
Board.\15\ New section 304(j) directed the Board to require such
deletions from the loan application register information made available
to the public as the Board determined to be appropriate to protect any
privacy interest of any applicant, and identified as appropriate for
deletion the same three fields the FFIEC had determined should be
deleted from the loan-level HMDA data it disclosed to the public.\16\ A
House Report characterizes the 1992 amendment to HMDA as making
``changes . . . to ensure that the public receives useful and timely
information regarding the lending records of financial institutions.''
\17\ The Board implemented this amendment by requiring that financial
institutions make their ``modified'' loan/application registers
available to the public after deleting the same fields deleted from the
loan-level HMDA data disclosed by the FFIEC.\18\
---------------------------------------------------------------------------
\15\ Housing and Community Development Act, Public Law 102-550,
section 932, 106 Stat. 3672 (1992).
\16\ HMDA section 304(j) identifies as appropriate for deletion
``the applicant's name and identification number, the date of the
application, and the date of any determination by the institution
with respect to such application.''
\17\ H. Rept. 102-760 (1992).
\18\ See 12 CFR 1003.5(c) (Bureau's successor Regulation C,
which restates the Board's predecessor Regulation C). Section
1003.5(c) requires that, before making its loan/application register
available to the public, a financial institution must delete three
fields to protect applicant and borrower privacy: Application or
loan number, the date that the application was received, and the
date action was taken.
---------------------------------------------------------------------------
Today, HMDA data are the preeminent data source that regulators,
researchers, economists, industry, and advocates use to achieve HMDA's
purposes and to analyze the mortgage market. HMDA and current
Regulation C \19\ continue to require that data be made available to
the public in both aggregate and loan-level formats. Each financial
institution is required to make its modified loan/application register
available to the public, with three fields deleted to protect applicant
and borrower privacy,\20\ and also make available to the public a
disclosure statement prepared by the FFIEC that shows the financial
institution's HMDA data in aggregate form.\21\ In addition, the FFIEC
makes available to the public disclosure statements for each financial
institution,\22\ aggregate reports for each MSA and metropolitan
division (MD) showing lending patterns by certain property and
applicant characteristics,\23\ and the loan-level dataset containing
all reported HMDA data for the preceding calendar year, modified to
protect
[[Page 44589]]
applicant and borrower privacy (the agencies' loan-level release).\24\
---------------------------------------------------------------------------
\19\ Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et
seq., as implemented by Regulation C, 12 CFR part 1003. ``Current
Regulation C'' as used herein refers to Regulation C in effect as of
the date of publication of this proposed Policy Guidance.
\20\ HMDA section 304(j)(2)(B); 12 CFR 1003.5(c).
\21\ HMDA section 304(k); 12 CFR 1003.5(b).
\22\ HMDA section 304(f); 12 CFR 1003.5(f).
\23\ HMDA section 310; 12 CFR 1003.5(f).
\24\ 55 FR 27886 (July 6, 1990) (announcing that the loan-level
HMDA data submitted on the loan/application register would be made
available to the public after deletion of three fields to protect
applicant and borrower privacy).
---------------------------------------------------------------------------
B. The Dodd-Frank Act and Amendments to HMDA and Regulation C
In 2010, the Dodd-Frank Act, which amended HMDA and also
transferred HMDA rulemaking authority and other functions from the
Board to the Bureau, was enacted into law.\25\ Among other changes, the
Dodd-Frank Act again expanded the scope of information relating to
mortgage applications and loans that must be collected, reported, and
disclosed under HMDA and authorized the Bureau to require financial
institutions to collect, report, and disclose additional information.
The Dodd-Frank Act amendments to HMDA also added new section
304(h)(1)(E), which directs the Bureau to develop regulations, in
consultation with the agencies identified in section 304(h)(2),\26\
that ``modify or require modification of itemized information, for the
purpose of protecting the privacy interests of the mortgage applicants
or mortgagors, that is or will be available to the public.'' Section
304(h)(3)(B), also added by the Dodd-Frank Act, directs the Bureau to
``prescribe standards for any modification under paragraph (1)(E) to
effectuate the purposes of [HMDA], in light of the privacy interests of
mortgage applicants or mortgagors. Where necessary to protect the
privacy interests of mortgage applicants or mortgagors, the Bureau
shall provide for the disclosure of information . . . in aggregate or
other reasonably modified form, in order to effectuate the purposes of
[HMDA].'' \27\
---------------------------------------------------------------------------
\25\ Dodd Frank Wall Street Reform and Consumer Protection Act,
Public Law 111-203, 124 Stat. 1376, 1980, 2035-38, 2097-101 (2010).
\26\ These agencies are the prudential regulators--the Board of
Governors of the Federal Reserve System, the Federal Deposit
Insurance Corporation, the National Credit Union Administration, and
the Office of the Comptroller of the Currency--and the Department of
Housing and Urban Development. Together with the Bureau, these
agencies are referred to herein as ``the agencies.''
\27\ Section 304(h)(3)(A) provides that a modification under
section 304(h)(1)(E) shall apply to information concerning ``(i)
credit score data . . . in a manner that is consistent with the
purpose described in paragraph (1)(E); and (ii) age or any other
category of data described in paragraph (5) or (6) of subsection
(b), as the Bureau determines to be necessary to satisfy the purpose
described in paragraph (1)(E), and in a manner consistent with that
purpose.''
---------------------------------------------------------------------------
On August 29, 2014, the Bureau published proposed amendments to
Regulation C (2014 HMDA Proposed Rule) to implement the Dodd-Frank Act
amendments and to make additional changes.\28\ After careful
consideration of comments received on its proposal, the Bureau
published a final rule on October 28, 2015 (2015 HMDA Final Rule)
amending Regulation C.\29\ The 2015 HMDA Final Rule implements the
Dodd-Frank Act amendments and makes other changes to Regulation C. Most
provisions of the 2015 HMDA Final Rule go into effect on January 1,
2018 \30\ and apply to data financial institutions will collect
beginning in 2018 and will report beginning in 2019.\31\
---------------------------------------------------------------------------
\28\ 79 FR 51732 (Aug. 29, 2014).
\29\ Home Mortgage Disclosure (Regulation C), 80 FR 66128 (Oct.
28, 2015); see also 80 FR 69567 (Nov. 10, 2015) (making technical
corrections).
\30\ Certain amendments to the definition of financial
institution went into effect on January 1, 2017. See 12 CFR 1003.2;
80 FR 66128, 66308 (Oct. 28, 2015).
\31\ Beginning in 2018, with respect to data compiled in 2017
and later, financial institutions will file their HMDA data with the
Bureau. The Bureau will collect and process HMDA data on behalf of
the FFIEC and the agencies.
---------------------------------------------------------------------------
The 2015 HMDA Final Rule addressed the public disclosure of HMDA
data in two ways. First, the 2015 HMDA Final Rule made changes to
financial institutions' public disclosure obligations under Regulation
C. Under the 2015 HMDA Final Rule, the public disclosure of HMDA data
is shifted entirely to the agencies. Effective with respect to HMDA
data compiled in 2017 and later, financial institutions will no longer
be required to provide their modified loan/application registers and
disclosure statements directly to the public and will be required
instead to provide only a notice advising members of the public seeking
their data that it may be obtained on the Bureau's Web site. In
addition to reducing burden on financial institutions associated with
their disclosure of HMDA data, the 2015 HMDA Final Rule eliminates
risks to financial institutions associated with errors in preparing
their modified loan/application registers that could result in the
unintended disclosure of data. Further, the 2015 HMDA Final Rule allows
decisions with respect to what to include on the modified loan/
application register to be made in conjunction with decisions regarding
the agencies' loan-level data release, providing flexibility and
allowing for consistency with respect to both releases. This shift of
responsibility also permits the Bureau to consider modifications to
protect applicant and borrower privacy that preserve data utility but
that may be burdensome for financial institutions to implement.
Finally, shifting the disclosure of HMDA data to the agencies will
allow for easier adjustment of privacy protections applied to
disclosures of loan-level HMDA data as privacy risks and potential uses
of HMDA data evolve.
Also in the 2015 HMDA Final Rule, in consultation with the agencies
and after notice and comment, the Bureau interpreted HMDA, as amended
by the Dodd-Frank Act, to require that the Bureau use a balancing test
to determine whether and how HMDA data should be modified prior to its
disclosure to the public in order to protect applicant and borrower
privacy while also fulfilling HMDA's public disclosure purposes. The
Bureau interpreted HMDA to require that public HMDA data be modified
when the release of the unmodified data creates risks to applicant and
borrower privacy interests that are not justified by the benefits of
such release to the public in light of the statutory purposes.\32\ In
such circumstances, the need to protect the privacy interests of
mortgage applicants or mortgagors requires that the itemized
information be modified. This binding interpretation implemented HMDA
sections 304(h)(1)(E) and 304(h)(3)(B) because it prescribed standards
for requiring modification of itemized information, for the purpose of
protecting the privacy interests of mortgage applicants and borrowers,
that is or will be available to the public.\33\ The 2015 HMDA Final
Rule's interpretation of HMDA section 304(h)(1)(E) and 304(h)(3)(B) to
require a balancing test is a regulation that limits the Bureau's
discretion with respect to public release of HMDA data. The standards
impose binding obligations on the Bureau to evaluate the HMDA data,
individually and in combination, to assess whether and how HMDA data
should be modified prior to its disclosure to the public in order to
protect applicant and borrower privacy while also fulfilling HMDA's
public disclosure purposes. The standards for modification of itemized
information that is or will be available to the public apply to all
data reported under the 2015 HMDA Final Rule.\34\
---------------------------------------------------------------------------
\32\ 80 FR 66128, 66134 (Oct. 28, 2015).
\33\ Id.
\34\ Id. at 66133, 66252 (noting that the Bureau's application
of the balancing test would include data fields currently disclosed
on the modified loan/application register and in the agencies' loan-
level release).
---------------------------------------------------------------------------
Part III of this proposed Policy Guidance describes the Bureau's
application of the balancing test to date and its proposals concerning
the public disclosure of the loan-level HMDA data that will be reported
to the agencies pursuant to Regulation C as amended by
[[Page 44590]]
the 2015 HMDA Final Rule.\35\ Part IV of this proposed Policy Guidance
addresses other considerations related to the disclosure of HMDA data,
including the disclosure of aggregate HMDA data.\36\
---------------------------------------------------------------------------
\35\ The Bureau received some comments on the 2014 HMDA Proposed
Rule suggesting that disclosure of certain HMDA data fields could
reveal confidential business information and that such data fields
should not be disclosed to the public in order to protect such
information. The Bureau notes that HMDA requires modification of the
HMDA data to protect the privacy interests of applicants and
borrowers without mentioning the protection of confidential business
information. Although the balancing test adopted in the 2015 HMDA
Final Rule addresses risks to applicant and borrower privacy created
by the disclosure of HMDA data, the modifications resulting from its
application may mitigate some of the confidentiality concerns raised
by commenters.
\36\ As discussed above and also below in part IV.C, HMDA and
Regulation C require the FFIEC to make available to the public
certain aggregated data. The FFIEC, the Bureau, and the other
agencies continue to evaluate options for disclosure of the required
aggregates of data that will be reported under the 2015 HMDA Final
Rule.
---------------------------------------------------------------------------
III. Application of the Balancing Test
A. The Balancing Test
As noted above, in the 2015 HMDA Final Rule, the Bureau interpreted
HMDA to require that public HMDA data be modified when the disclosure
of the unmodified data creates risks to applicant and borrower privacy
interests that are not justified by the benefits of such disclosure to
the public in light of the statutory purposes. Considering the public
disclosure of the loan-level HMDA dataset as a whole, risks to
applicant and borrower privacy interests arise under the balancing test
only where the disclosure of the unmodified loan-level HMDA dataset may
both substantially facilitate the identification of an applicant or
borrower in the data and disclose information about the applicant or
borrower that is not otherwise public and may be harmful or
sensitive.\37\ Thus, under the balancing test, risks to applicant and
borrower privacy interests would not arise if a loan-level dataset
substantially facilitated the identification of applicants and
borrowers in the data but revealed no information about applicants and
borrowers that was harmful or sensitive and not otherwise public.
Alternatively, risks to applicant and borrower privacy interests would
not arise under the balancing test if a loan-level dataset contained
harmful or sensitive information about applicants and borrowers that
was not otherwise public but it was not possible to identify an
applicant or borrower in the dataset.
---------------------------------------------------------------------------
\37\ 80 FR 66128, 66134 (Oct. 28, 2015).
---------------------------------------------------------------------------
Accordingly, under the balancing test, the disclosure of the loan-
level HMDA dataset creates risks to applicant and borrower privacy
interests only where at least one data field or a combination of data
fields in the dataset substantially facilitates the identification of
an applicant or borrower, and at least one data field or combination of
data fields discloses information about the applicant or borrower that
is not otherwise public and may be harmful or sensitive. At the
individual data field level, a field may create ``re-identification
risk'' by substantially facilitating the identification of an applicant
or borrower in the HMDA data (for example, as discussed below, because
it may be used to match a HMDA record to an identified record), or may
create ``risk of harm or sensitivity'' by disclosing information about
the applicant or borrower that is not otherwise public and may be
harmful or sensitive. Assessing the risks to applicant and borrower
privacy under the balancing test requires an evaluation of the
unmodified HMDA dataset as a whole and of the individual data fields
contained in the dataset.
Where the public disclosure of the unmodified loan-level HMDA
dataset would create risks to applicant and borrower privacy, the
balancing test requires that the Bureau consider the benefits of
disclosure to HMDA's purposes and, where these benefits do not justify
the privacy risks the disclosure would create, modify the dataset to
appropriately balance the privacy risks and disclosure benefits. An
individual data field is a candidate for potential modification under
the balancing test if its disclosure in unmodified form would create a
risk of re-identification or a risk of harm or sensitivity.
As discussed further below, with respect to the HMDA data that will
be reported to the agencies under the 2015 HMDA Final Rule and based on
its analysis to date, the Bureau believes that public disclosure of the
unmodified loan-level dataset, as a whole, would create risks to
applicant and borrower privacy interests under the HMDA balancing test.
This is due to the presence in the dataset of individual data fields
that the Bureau believes would create re-identification risk and the
presence of individual data fields that the Bureau believes are not
currently public and would create a risk of harm or sensitivity. The
Bureau thus has applied the balancing test to determine whether and how
it should modify the HMDA data that will be reported under the 2015
HMDA Final Rule before it is disclosed to the public. Based on its
analysis, the Bureau believes that the balancing test requires the
loan-level HMDA dataset to be modified before it is disclosed to the
public to reduce risks to applicant and borrower privacy created by
disclosure and appropriately balance them with the benefits of
disclosure for HMDA's purposes. The Bureau proposes to modify the
public loan-level dataset as described in this proposed Policy
Guidance.\38\ The Bureau believes that the modifications to the loan-
level HMDA dataset proposed in this Policy Guidance would reduce risks
to applicant and borrower privacy and appropriately balance them with
the benefits of disclosure for HMDA's purposes. The Bureau seeks
comment on all aspects of this proposed Policy Guidance, including its
analysis of risks to applicant and borrower privacy, its application of
the balancing test, and its proposed modifications.
---------------------------------------------------------------------------
\38\ With respect to data compiled in 2018 or later, this
proposed Policy Guidance describes the modifications the Bureau
proposes to apply to the agencies' loan-level release and to each
financial institution's modified loan/application register. The
terms ``loan-level dataset'' and ``loan-level data'' used herein
refer to HMDA data disclosed on the loan level, whether the data are
those submitted by an individual financial institution or by all
reporting financial institutions.
---------------------------------------------------------------------------
This part III.A describes the benefits of public disclosure of the
data that will be reported under the 2015 HMDA Final Rule, the risks to
applicant and borrower privacy that may be created by the public
disclosure of the unmodified HMDA data that the Bureau has considered,
and the Bureau's approach to balancing these benefits and risks. Part
III.B describes the application of the balancing test to the data that
will be reported under the 2015 HMDA Final Rule and the Bureau's
proposed modifications to the loan-level HMDA data that will be
disclosed to the public.
Disclosure Benefits
Under the balancing test, the Bureau considers the benefits of
disclosure of the loan-level HMDA data to the public. As described
above, HMDA has a long history of providing the public with information
about mortgage lending activity, and Congress has repeatedly amended
the statute to increase the scope and utility of the data disclosed to
the public. Users of HMDA data have relied on this information to help
achieve HMDA's purposes: Helping to determine whether financial
institutions are serving the housing needs of their communities;
assisting public officials in distributing public-sector investment so
as to attract private investment to areas where it is needed; and
assisting in identifying possible discriminatory lending patterns and
enforcing antidiscrimination statutes. Today,
[[Page 44591]]
HMDA data are the preeminent data source that regulators, researchers,
economists, industry, and advocates rely on to achieve HMDA's purposes
and to analyze the mortgage market.\39\
---------------------------------------------------------------------------
\39\ For more information about the history and benefits of
HMDA, see the supplementary information to the Bureau's 2014 HMDA
Proposed Rule, 79 FR 51732, 51735-36 (Aug. 29, 2014), and the
Bureau's 2015 HMDA Final Rule, 80 FR 66128, 66129-31 (Oct. 28,
2015).
---------------------------------------------------------------------------
Community groups, researchers, and public officials have used HMDA
data to help determine whether financial institutions are serving the
housing needs of their communities. For example, HMDA data have enabled
community groups to understand the magnitude of disinvestment within
minority neighborhoods.\40\ Public officials have relied on HMDA data
to compare the lending activity of financial institutions to the credit
needs of communities and to examine whether minority communities were
disproportionately affected by foreclosures following the financial
crisis.\41\ Further, community groups relied on HMDA data to document
the rise in subprime lending among minority communities in the years
before the financial crisis.\42\
---------------------------------------------------------------------------
\40\ See John Goering and Ron Wienk, ``Mortgage Lending, Racial
Discrimination and Federal Policy,'' at 10 (Urban Inst. Press 1996).
\41\ Robert B. Avery & Thomas M. Buynak, ``Economic Review--
Mortgage Redlining: Some New Evidence,'' at 18-32 (Fed. Reserve Bank
of Cleveland, Working Paper No. 0013-0281, 1981), available at
https://fraser.stlouisfed.org/scribd/?item_id=4183&filepath=/files/docs/publications/frbclevreview/rev_frbclev_198102.pdf; Carolina
Reid and Elizabeth Laderman, ``The Untold Costs of Subprime Lending:
Examining the Links Among Higher-Priced Lending, Foreclosures and
Race in California'' (Fed. Reserve Bank of S.F., Working Paper No.
2009-09, 2009), available at https://iasp.brandeis.edu/pdfs/Author/reid-carolina/The%20Untold%20Costs%20of%20Subprime%20Lending%203.pdf.
\42\ ``Home Mortgage Disclosure Act: Newly Collected Data and
What It Means,'' Hearing on the 2004 Home Mortgage Disclosure Act
before the Subcomm. on Fin. Servs. and Consumer Credit of the H.
Comm. on Fin. Servs., 109th Cong. 4 (2006) (written testimony of
Calvin Bradford, President, Calvin Bradford Assocs., Ltd., on behalf
of the Nat'l Fair Hous. Alliance).
---------------------------------------------------------------------------
Public officials also have used HMDA data to develop and allocate
housing and community development investments. For example, local
governments have used HMDA data to characterize neighborhoods for
purposes of determining the most effective use of housing grants, to
select financial institutions for contracts and participation in local
programs, and to identify a need for homebuyer counseling and
education.\43\ Similarly, the Department of Housing and Urban
Development used HMDA data to develop the formula by which funding
would be provided to communities suffering from foreclosures and
abandonment under the Neighborhood Stabilization Program.\44\
---------------------------------------------------------------------------
\43\ See City of Albuquerque, Dep't of Family and Comty. Hous.,
``Five Year Consolidated Housing Plan and Workforce Housing Plan
(2008-2012),'' at 100 (2008), available at http://www.cabq.gov/family/documents/ConsolidatedWorkforceHousingPlan20082012final.pdf;
City of Antioch, Cal., ``Fiscal Year 2012-2013: Consolidated Annual
Performance Evaluation Report,'' at 29 (2012), available at http://ci.antioch.ca.us/CitySvcs/CDBGdocs/CAPER%20FY%2012-13.pdf; City of
Lawrence, Mass., ``HUD Consolidated Plan 2010-2015,'' at 68 (2010),
available at http://www.cityoflawrence.com/Data/Sites/1/documents/cd/Lawrence_Consolidated_Plan_Final.pdf.
\44\ See U.S. Dep't of Housing and Urban Dev., ``Neighborhood
Stabilization Program Formula Methodology'' (2008), available at
https://www.huduser.gov/portal/datasets/NSP.html.
---------------------------------------------------------------------------
HMDA data have also been used by public officials, researchers, and
community groups to identify potentially discriminatory lending
patterns and to enforce antidiscrimination statutes. For example,
researchers, journalists, and public officials relied on HMDA data
along with other publicly available data to identify racial disparities
in mortgage lending between neighborhoods in Atlanta, Detroit, and
Boston.\45\ Since Congress amended HMDA to require reporting of the
race, gender, and income of individual applicants and borrowers,\46\
the expanded HMDA data have been used to identify potential
discriminatory lending practices.\47\ Community groups have used the
data to monitor fair lending within their communities and enter into
agreements with financial institutions to ensure that the local needs
were being served in a responsible manner.\48\ HMDA data also played an
important role in recent enforcement actions by the Illinois and New
York Attorneys General related to discriminatory mortgage lending.\49\
The Bureau and other regulators regularly rely on HMDA data in fair
lending analyses, including in identifying possible discriminatory
practices such as illegal redlining.\50\
---------------------------------------------------------------------------
\45\ Bill Dedman, ``The Color of Money,'' (parts 1-4), Atlanta
Journal-Const., May 1-4, 1988; David Everett et al., ``The Race for
Money,'' (parts 1-4), Detroit Free Press, July 24-27, 1988; Bill
Dedman, ``Blacks Turned Down for Home Loans from S&Ls Twice as Often
as Whites,'' Atlanta Journal-Const., Jan. 22, 1989; Katharine
Bradbury et al., ``Geographic Patterns of Mortgage Lending in
Boston, 1982-1987,'' New Eng. Econ. Rev., (1989). These reports and
studies helped motivate Congress to amend HMDA to improve publicly
available information about lending practices through the Financial
Institutions Reform, Recovery, and Enforcement Act of 1989.
\46\ Federal Institutions Reform, Recovery, and Enforcement Act,
Public Law 101-73, section 1211, Sec. 304, 103 Stat. 183, 524-26
(1989).
\47\ For example, researchers have found evidence that, in many
cases, an applicant's race alone influenced whether the applicant
was denied credit. See, e.g., Alicia H. Munnell et al., ``Mortgage
Lending in Boston: Interpreting the HMDA Data,'' at 22 (Am. Econ.
Rev., Fed. Reserve Bank of Boston Working Paper 92-7 (1992); James
H. Carr & Isaac F. Megbolugbe, ``The Federal Reserve Bank of Boston:
Study on Mortgage Lending Revisited,'' 4 J. of Hous. Res. 2, at 277
(1993).
\48\ See Adam Rust, ``A Principle-Based Redesign of HMDA and CRA
Data in Revisiting the Community Reinvestment Act: Perspectives on
the Future of the Community Reinvestment Act,'' at 179 (Fed. Reserve
Banks of Bos. and S.F. 2009).
\49\ Yana Kunichoff, ``Lisa Madigan credits Reporter with
initiating largest discriminatory lending settlements in U.S.
history,'' Chicago Rep. (June 14, 2013), available at http://www.chicagonow.com/chicago-muckrakers/2013/06/lisa-madigan-credits-reporter-with-initiating-largest-discriminatory-lending-settlements-in-u-s-history/; Press Release, N.Y. State Off. of the Att'y Gen.,
``Attorney General Cuomo Obtains Approximately $1 Million For
Victims Of Greenpoint's Discriminatory Lending Practices'' (July 16,
2008), available at http://www.ag.ny.gov/press-release/attorney-general-cuomo-obtains-approximately-1-million-victims-greenpoints.
\50\ Although certain regulators have access to the non-public
HMDA data, their analyses also rely heavily on data fields that are
publicly disclosed.
---------------------------------------------------------------------------
In enacting the Dodd-Frank Act in 2010, Congress expanded the data
financial institutions are required to collect, report, and disclose
under HMDA and authorized the Bureau to require additional information.
The Bureau's 2015 HMDA Final Rule amended Regulation C to implement the
Dodd-Frank Act amendments and address the informational shortcomings
exposed by the financial crisis to better meet the needs of the public,
public officials, and regulators. Although the 2015 HMDA Final Rule did
not address the specific data fields that would be disclosed to the
public in the loan-level HMDA data, the rule required the collection
and reporting of a number of data fields which, if publicly disclosed,
would improve the ability of HMDA data users to fulfill HMDA's
purposes.
For example, mandatory reporting of information about the reasons
for denial of a loan application, combined with data fields used to
make underwriting decisions, would improve the ability to understand
lenders' decision-making and to identify possible discriminatory
lending patterns in underwriting. Pricing information, such as rate
spread for additional types of loans, total loan costs, total discount
points, lender credits, and interest rate, would allow users to better
understand pricing decisions and the cost of credit to mortgage
borrowers. Information about manufactured housing and multifamily
financing would allow users to better understand important sources of
housing for low-income and potentially financially vulnerable
borrowers, which helps users determine whether financial institutions
are serving the housing needs of their communities and helps public
officials target public investment
[[Page 44592]]
to better attract private investment. Information about the ages of
applicants or borrowers and disaggregated racial and ethnic information
would assist in identifying potentially discriminatory lending patterns
and help determine whether financial institutions are serving the
housing needs of their communities. Data fields about occupancy status
and home-equity lines of credit provide information about potentially
speculative purchases of housing and the degrees of leverage borrowers
are undertaking. This information would better allow users to identify
trends in the mortgage market that may increase systemic risk to the
overall economy. Understanding these risks helps public officials
distribute public-sector investment and helps users determine whether
financial institutions are serving the housing needs of their
communities.
Today, HMDA data represent a public good that responds to the fact
that private lenders do not, in the ordinary course, make information
about their loans and lending decisions publicly available. HMDA
provides the only source of loan-level mortgage data with comprehensive
national coverage that is free and easily accessible to the public.
Other publicly available mortgage datasets lack information crucial for
HMDA's purposes that is found in the HMDA data, such as the race,
ethnicity, and sex of applicants and borrowers. Private data vendors
sell several large datasets that typically contain data collected from
the largest mortgage loan servicers or securitizers, but none of these
datasets match the coverage of the HMDA data. These private datasets
also typically lack information that identifies individual lenders and
therefore cannot be used to study whether specific lenders are meeting
community needs or may be making discriminatory credit decisions.
Additionally, the Bureau is aware of no private dataset that includes
information about applications that do not result in originated loans.
By including applications in addition to originated and purchased
loans, HMDA provides a near-census of the mortgage market that allows
users to draw a detailed picture of the supply and demand of mortgage
credit at various levels of geographic and lender aggregation. Finally,
unlike the HMDA data, private datasets are costly for subscribers,
creating a substantial hurdle for many community groups, government
agencies, and researchers that wish to access them.
HMDA data also benefit users by addressing the information
asymmetries present in credit markets. The degree of control that
lenders exercise over the mortgage lending process gives them a
significant information advantage over borrowers, researchers, and
other members of the public. This advantage can contribute to certain
types of lender behavior, such as discrimination or predatory lending,
that conflict with the best interests of borrowers and the housing
needs of communities. The relative difference in information may also
lead to herding behavior where both lenders and consumers pursue risky
mortgage loans based primarily on the popularity of these products,
creating substantial systemic risk to the mortgage market and the
financial system. Publicly available mortgage data increase
transparency in the mortgage market, narrowing the information gap
between lenders and borrowers, community groups, and public officials.
Greater information can enable these latter parties to advocate for
financial institutions to maintain fair practices and serve the housing
needs of their communities, and can increase the prospect of self-
correction by financial institutions. Additional information also helps
to reduce the herding behavior of both lenders and borrowers, reducing
systemic risk.
Risks to Applicant and Borrower Privacy Interests
The Bureau has considered the risks to applicant and borrower
privacy that may be created by the public disclosure of the HMDA data
that will be reported to the agencies under the 2015 HMDA Final Rule.
Based on its analysis to date, the Bureau believes that public
disclosure of the unmodified loan-level dataset, as a whole, would
create risks to applicant and borrower privacy interests under the HMDA
balancing test. As described in more detail below, this is due to the
presence in the dataset of individual data fields that the Bureau
believes would create re-identification risk and the presence of
individual data fields that the Bureau believes would create a risk of
harm or sensitivity. However, the Bureau believes that the
modifications to the loan-level HMDA dataset proposed in this Policy
Guidance would reduce these risks to applicant and borrower privacy and
appropriately balance them with the benefits of disclosure for HMDA's
purposes.
Re-Identification Risk
In evaluating the potential re-identification risk presented by the
disclosure of the unmodified loan-level HMDA data that will be reported
under the 2015 HMDA Final Rule, the Bureau has considered the data
fields contained in the dataset, the likely methods by which applicants
and borrowers could be identified in the dataset, the nature and
availability of additional datasets that may be useful to the re-
identification of HMDA data, and the incentives and capabilities of
persons interested in re-identification. The Bureau uses the term
``adversary'' when referring to such persons.\51\ The term is not
intended to indicate that the adversary's motives are necessarily
malicious or adverse to the interests of the individuals in the
dataset.
---------------------------------------------------------------------------
\51\ See, e.g., Nat'l Inst. of Standards & Tech., ``De-
Identification of Personal Information (2015),'' available at http://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf (using
``adversary'' to refer to an entity attempting to re-identify data).
---------------------------------------------------------------------------
In the HMDA context, the Bureau is concerned about two re-
identification scenarios. First, an adversary may use common data
fields to match a HMDA record to a record in another dataset that
contains the identity of the applicant or borrower. Second, an
individual may rely on pre-existing personal knowledge to recognize an
applicant or borrower's record in the unmodified HMDA data.
Under the first scenario, it may be possible to match a HMDA record
to a record from an identified dataset directly, or data fields from
additional datasets may need to be matched to the HMDA record to
complete the match to the identified record. However, successfully re-
identifying a HMDA record would require several steps and may present a
significant challenge. First, an adversary generally would have to
isolate a record that is unique within the HMDA data. A HMDA record is
unique when the values of the data fields associated with it are shared
by no other HMDA record. But a HMDA record's uniqueness alone would not
automatically result in its re-identification; an adversary would have
to find a record corresponding to the applicant or borrower in another
dataset that shares data fields with the unique HMDA record that permit
the records to be matched. Once a unique HMDA record has been matched
to a corresponding record, an adversary would possess any additional
fields found in the corresponding record but not found in the HMDA
record, such as the identity of the applicant or borrower.\52\ However,
even after accomplishing such a match, an adversary might not have
accurately re-identified the true applicant or borrower to whom the
HMDA record relates.\53\
---------------------------------------------------------------------------
\52\ If the corresponding record lacks the name of the applicant
or borrower, an adversary may be able to use data fields from the
corresponding record to match to a record in another identified
dataset.
\53\ For example, if the corresponding record is not the only
record in the other dataset that shares certain data fields with the
unique HMDA record, an adversary would have to make a probabilistic
determination as to which corresponding record belongs to the
applicant or borrower. Also, depending on the coverage of the other
dataset, a corresponding record may be unique in the other dataset
but not unique in the general population.
---------------------------------------------------------------------------
[[Page 44593]]
The HMDA data that will be reported under the 2015 HMDA Final Rule,
like the data reported under current Regulation C, contain data fields
that create re-identification risk. First, the HMDA data display a high
level of record uniqueness.\54\ As explained above, record uniqueness
alone does not mean that a record can be re-identified, but a unique
HMDA record could be matched to a corresponding record in another
dataset that is available to an adversary. In the HMDA context, the
Bureau believes that particularly relevant sources of identified data
for matching purposes are publicly available real estate transaction
records and property tax records. Although there is variance by
jurisdiction, such records are often available electronically and
typically identify a borrower through documents such as the mortgage or
deed of trust. These documents typically include the loan amount, the
financial institution, the unique identifier assigned to the mortgage
originator, the borrower's name, and the property address, and may
include other information. Because some of these data fields are also
present in the HMDA data, the Bureau believes that the release of loan-
level HMDA data without any modifications would create a risk that
these public records could be directly matched to a HMDA record to re-
identify an applicant \55\ or borrower.
---------------------------------------------------------------------------
\54\ In 2005, researchers at the Board found that ``[m]ore than
90 percent of the loan records in a given year's HMDA data are
unique--that is, an individual lender reported only one loan in a
given census tract for a specific loan amount.'' Robert B. Avery et
al., ``New Information Reported under HMDA and Its Application in
Fair Lending Enforcement,'' at 367 Fed. Reserve Bulletin (Summer
2005), available at http://www.federalreserve.gov/pubs/bulletin/2005/3-05hmda.pdf.
\55\ None of the public or private datasets discussed herein
include information about applications that do not result in
originated mortgage loans. The Bureau believes that the lack of
public information about applications would significantly reduce the
likelihood that an adversary could match the record of a HMDA loan
application that was not originated to an identified record in
another dataset. Therefore, the Bureau believes that the risk of re-
identification to applicants is significantly lower than the risk to
borrowers. However, some of the information contained in the
unmodified HMDA data for applicants may permit an adversary to re-
identify an applicant despite the lack of publicly available real
estate records reflecting the transaction. For example, if an
applicant withdraws an application and obtains a loan secured by the
same property from another institution, it may be possible to link
the HMDA data for the withdrawn application with the data for the
origination, as much of the property and borrower information will
be identical.
---------------------------------------------------------------------------
Other publicly available sources of data similar to those included
in the HMDA data that will be reported under the 2015 HMDA Final Rule
include loan-level performance datasets made available by the
Government-Sponsored Enterprises (GSEs) and mortgage-backed securities
datasets made available by the Securities and Exchange Commission
through the Electronic Data Gathering, Analysis, and Retrieval (EDGAR)
system.\56\ The loan-level performance datasets include data fields
similar to those that will be included in the unmodified HMDA data,
such as credit score, loan amount, interest rate, debt-to-income ratio,
combined loan-to-value ratio, and loan-to-value ratio. The mortgage-
backed securities dataset includes similar information, such as the
credit score, loan amount, lien status, property value, and debt-to-
income ratio. These datasets are available online with limited
restrictions on access. But these datasets do not include the name of
the borrower; as described above, this means that an adversary who is
able to match a record in one of these datasets to a record in HMDA
would need to make an additional match to an identified dataset to re-
identify a borrower. And some of these datasets contain restrictions on
use, such as a prohibition on attempting to re-identify individual
borrowers.\57\
---------------------------------------------------------------------------
\56\ SE.C., ``Electronic Data Gathering, Analysis, and Retrieval
(EDGAR),'' https://www.sec.gov/edgar.shtml (last visited January 26,
2017); Fannie Mae, ``Fannie Mae Single-Family Loan Performance
Dataset,'' http://www.fanniemae.com/portal/funding-the-market/data/loan-performance-data.html (last visited Jan. 26, 2017); Freddie
Mac, ``Single Family Loan-Level Dataset,''http://www.freddiemac.com/news/finance/sf_loanlevel_dataset.html (last visited Jan. 26, 2017);
Ginnie Mae, ``Data Dictionaries,'' http://www.ginniemae.gov/investors/disclosures_and_reports/Pages/Disclosure-Data-Dictionaries.aspx (last visited Jan. 26, 2017).
\57\ See, e.g., Freddie Mac, ``Terms for Single-Family Loan-
Level Dataset Registration and Login Pages,'' https://freddiemac.embs.com/FLoan/HistoricalDataTerms.html (last visited
Mar. 20, 2017).
---------------------------------------------------------------------------
Private datasets that could be matched to the HMDA data are also
available. For example, data brokers collect information about
consumers from a wide range of sources and sell it for a variety of
purposes, including marketing, identity verification, and fraud
detection.\58\ These datasets typically include data collected from
commercial, government, and other publicly available sources and may
contain data about mortgage loan borrowers, including age, income,
loan-to-value ratio, property value, loan amount, address, race,
ethnicity, and origination date. Other datasets specific to mortgage
loans are provided for purposes of evaluating mortgage-backed
securities, identifying marketing opportunities, or analyzing market
trends. These datasets may include loan amount, interest rate, credit
score, negative amortization features, and closing date. Some of these
datasets include the names of consumers, although others contain de-
identified loan-level mortgage data. However, these datasets may
contain contractual restrictions on use and re-disclosure, including
prohibiting their use for re-identification purposes, and may be cost-
prohibitive for many potential adversaries.
---------------------------------------------------------------------------
\58\ See generally Fed. Trade Comm'n, ``Data Brokers: A Call for
Transparency and Accountability,'' (May 2014), available at https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf (describing the types of products
offered and the data sources used by data brokers).
---------------------------------------------------------------------------
In addition to considering the steps an adversary would need to
complete to re-identify the HMDA data and the various data sources that
may be required to accomplish re-identification, including their
limitations, the Bureau also has considered the capacity, incentives,
and characteristics of potential adversaries, including those that may
attempt re-identification for harmful purposes. The Bureau believes
that some potential adversaries may be interested in re-identifying the
HMDA data for marketing or other commercial purposes. For example, the
unmodified HMDA data contain information about applicants and
borrowers, and features of the loans they obtained or applied for, that
the Bureau believes would have commercial appeal for marketing and
advertising. Although extensive data about identified consumers is
already available to marketers, the Bureau believes that at least some
of the HMDA data that may be useful to marketers are typically not
publicly available from any source for marketing purposes, are
available in limited circumstances,\59\ or may be less reliable or
precise than the HMDA data may be perceived to be.\60\ These potential
adversaries could possess the resources to use private
[[Page 44594]]
datasets in addition to publicly available records to re-identify the
HMDA data. However, the Bureau has considered the extent to which much
of the commercial benefit to be obtained by re-identifying the HMDA
data may be more readily available from private datasets to which these
potential adversaries already have access without the need for recourse
to the HMDA data. In many cases, information from other datasets may be
timelier than that found in the HMDA data, where the delay between
action taken on a loan and disclosure of the loan-level HMDA data
ranges from 3 to 15 months. Further, some of these potential
adversaries may refrain from re-identifying the HMDA data for
reputational reasons or because they have agreed to restrictions on
using data from the additional datasets described above for re-
identification purposes.
---------------------------------------------------------------------------
\59\ For example, a marketer currently may obtain from a
consumer reporting agency a ``prescreened'' list of consumers
meeting certain criteria, such as a minimum credit score, only for
the purpose of making a ``firm offer of credit or insurance.'' 15
U.S.C. 1681b(c), 1681a(l).
\60\ For example, private datasets may only contain an estimate
of the household income, while the HMDA data contains the gross
annual income relied on by the financial institution, which may be
more accurate.
---------------------------------------------------------------------------
Additionally, although most academics, researchers, and journalists
use HMDA data only for HMDA purposes or market monitoring, some may be
interested in re-identifying the HMDA data for purposes of research.
These persons may differ in their capacity to re-identify an applicant
or borrower in the HMDA data. The Bureau believes that those who lack
resources are likely to attempt to match a HMDA record to publicly
available datasets such as real estate transaction records, while those
with relatively greater resources may also rely on private datasets.
However, as mentioned above, some private datasets may have contractual
terms prohibiting their use for re-identification purposes. Further,
those academics or journalists with significant resources may be
affiliated with organizations that have reputational or institutional
interests that would not be served by re-identifying the HMDA data.
These factors may reduce the risk of re-identification by such persons.
The Bureau has considered whether parties intending to commit
identity theft or financial fraud may have the incentive and capacity
to re-identify the HMDA data. As discussed further below, the Bureau
believes that the HMDA data would be of minimal use for these purposes.
For example, the HMDA data will not include information typically
required to open new accounts in a consumer's name, such as Social
Security number, date of birth, place of birth, passport number, or
driver's license number, nor will they include information useful to
perpetrate existing account fraud, such as account numbers or
passwords. Further, these potential adversaries are not law abiding and
may have easier, albeit illegal, ways to secure data for these purposes
than attempting to re-identify loan-level HMDA data. The resources of
these potential adversaries likely vary, so some may be able to use
private datasets in addition to publicly available records to re-
identify the HMDA data were they to attempt to do so.
In addition to the possibility of re-identifying borrowers through
matching HMDA data to other datasets, some potential adversaries may be
able to re-identify a particular applicant or borrower in the HMDA data
by relying on personal knowledge about the applicant or borrower. As
noted above, the Bureau believes that the HMDA data display a high
level of record uniqueness, and the unmodified HMDA data include
location and demographic information, such as race, sex, ethnicity, and
age, that may be known to a potential adversary who is familiar with a
specific applicant or borrower. Therefore, such a potential adversary
may be able to re-identify a known applicant or borrower even if
traditionally identifying information is not disclosed and without
attempting to match a HMDA record to an identified record. This
potential adversary could include a neighbor or acquaintance of the
applicant or borrower, and the interest in re-identification may range
from mere curiosity to the desire to embarrass or otherwise harm the
applicant or borrower. Although these potential adversaries may lack
the sophistication or resources required to re-identify a HMDA record
by matching it to other datasets, they may possess a high level of
specific knowledge about the characteristics of a particular applicant
or borrower. Because the pre-existing personal knowledge possessed by
such a potential adversary is typically limited to information about a
single individual, or a small number of individuals, any re-
identification attempt by such a potential adversary would likely
target or impact a limited number of individuals. Although the Bureau
believes that location and demographic information may be more likely
to be known than other information in the HMDA data, it is impossible
to predict the exact content of any pre-existing personal knowledge
that such a potential adversary may possess. This uncertainty creates
challenges for evaluating the degree to which individual data fields
contribute to the risk of re-identification by such a potential
adversary.\61\
---------------------------------------------------------------------------
\61\ For example, although the Bureau is aware of no dataset
with detailed information on mortgage loan applicants, an adversary
with personal knowledge of an applicant could identify an applicant
in the HMDA data.
---------------------------------------------------------------------------
Risk of Harm or Sensitivity
The Bureau has considered whether, if a loan-level record in the
HMDA dataset were re-identified, HMDA data that will be reported under
the 2015 HMDA Final Rule would disclose information about the applicant
or borrower that is not otherwise public and may be harmful or
sensitive. To the extent a HMDA record could be associated with an
identified applicant or borrower and could also be successfully matched
to another de-identified dataset to re-identify such a dataset, harmful
or sensitive information in that dataset that is not otherwise public
may also be disclosed. The Bureau has considered whether the HMDA data
could be used for harmful purposes such as perpetrating fraud or
identity theft against an applicant or borrower or for targeted
marketing of products and services that may pose risks that are not
apparent. The Bureau has also considered whether certain HMDA data
fields may be viewed as sensitive if associated with a particular
applicant or borrower, even where the disclosure of the data field is
unlikely to lead to financial or other tangible harms. In evaluating
the potential sensitivity of a data field, the Bureau has also
considered whether disclosure of the data field could cause dignity or
reputational harm or embarrassment, or could be considered outside of
societal or cultural expectations with respect to what information is
available to the general public.
As noted above, today, significant amounts of identifiable data
concerning consumers is available to the general public, including in
public records. Identifiable consumer information is also available
from commercial data sources with varying barriers to access and
restrictions on use. In evaluating the risk of harm or sensitivity
created by the public disclosure of loan-level HMDA data, the Bureau's
analysis has considered the degree to which such disclosure would
increase these risks to applicant and borrower privacy compared to the
risks that already exist, absent the public availability of the data in
HMDA. Accordingly, the Bureau has considered whether the data that will
be reported under the 2015 HMDA Final Rule are typically publicly
available in an identifiable form and, if so, any barriers to accessing
the information or restrictions on its use. Depending on the nature and
extent of the public availability of a particular data field, the
Bureau generally considers public
[[Page 44595]]
availability to reduce any risk of harm or sensitivity that may be
created by the public disclosure of the data field in the loan-level
HMDA data. For example, although some borrowers may consider the amount
of their mortgage to be sensitive, the Bureau believes that this
information is often publicly available and considers such availability
to reduce the risk of harm or sensitivity that may be created by the
disclosure of this unmodified data field in the HMDA data. In other
words, if potentially harmful or sensitive information about an
applicant or borrower is already available to the general public,
disclosure of that information in the loan-level HMDA data creates less
risk of additional harm or sensitivity than if the data were otherwise
not publicly available about the applicant or borrower.
In evaluating the risk of harm or sensitivity created by the
disclosure of the loan-level HMDA data, the Bureau also has considered
the likelihood that the loan-level HMDA data would be re-identified and
used for harmful purposes or to embarrass or damage the reputation of
an applicant or borrower. As discussed above, the Bureau generally
believes that successful re-identification of loan-level HMDA data
would require several steps and may represent a significant challenge.
Even where an adversary is able to match a HMDA record to a record in
an identified dataset, the adversary still may not have accurately
identified the true applicant or borrower to whom the HMDA record
relates. To the extent that the risk that re-identification would be
accomplished is low, the risk of disclosing harmful or sensitive
information is reduced.
The Bureau believes that the unmodified loan-level HMDA data that
will be reported under the 2015 HMDA Final Rule would be of minimal use
for purposes of perpetrating identity theft or financial fraud against
applicants and borrowers. As noted above, the HMDA data will not
include information typically required to open new accounts in a
consumer's name, such as Social Security number, date of birth, place
of birth, passport number, or driver's license number, nor do they
include information useful to perpetrate existing account fraud, such
as account numbers or passwords.\62\ Although almost any information
relating to an individual could at least theoretically be used by an
adversary seeking to steal the identity of or commit fraud against the
individual, the Bureau does not believe that disclosure of the HMDA
data would be likely to increase information available for these
purposes. For example, the HMDA data will include the name of the
financial institution and other details about the loan terms that could
be used in a phishing attack against an applicant or borrower by a
perpetrator pretending to be the financial institution,\63\ but data
that could be used for this purpose are often already available in
publicly available real estate transaction records. The Bureau has also
considered whether the HMDA data could be used for knowledge-based
authentication purposes,\64\ but believes the data are unlikely to
increase information available that is typically used for such
purposes.
---------------------------------------------------------------------------
\62\ As noted above, however, to the extent a HMDA record could
be associated with an identified applicant or borrower and could
also successfully be matched to a de-identified dataset to re-
identify such a dataset, harmful or sensitive information in that
dataset that is not otherwise public may also be disclosed.
\63\ Phishing is an attempt by a perpetrator to obtain sensitive
information, such as account numbers or passwords, by masquerading
as a legitimate company. Phishing is typically conducted by
fraudulent email messages appearing to come from a legitimate
company that direct the recipient to a spoofed Web site or otherwise
get the recipient to divulge private information. The perpetrators
then use this private information to commit identity theft.
\64\ Knowledge-based authentication (KBA) is a method of
authentication which seeks to prove the identity of someone
accessing a service, such as an account at a financial institution.
KBA requires the knowledge of information about a particular
individual to prove that a person attempting to access a service is
the individual. ``Static'' KBA, also known as ``shared secrets,''
relies on information initially shared by the individual to the
provider of the service, such as an answer to a question, which is
later retrieved when an individual seeks to access the service.
``Dynamic'' KBA uses knowledge questions to verify identity but does
not require the individual to have provided the questions and
answers beforehand. Dynamic KBA questions are compiled from data
known to or obtained by the institution, such as transaction history
or data from credit reports.
---------------------------------------------------------------------------
The Bureau believes that some of the unmodified loan-level HMDA
data would provide information that is not already public and could be
used to target applicants and borrowers for marketing, including
marketing for products and services that may pose risks that are not
apparent. As noted above, the unmodified HMDA data would provide
information about an applicant's or borrower's financial condition and,
with respect to a borrower, details about the loan obtained. The Bureau
believes that, at least for a period of time after the loan-level HMDA
data are disclosed, this information may be useful to those looking to
offer financial products and services or otherwise improve market
segmentation. Although these data could be used to market products and
services that would be beneficial for applicants and borrowers, perhaps
increasing competition among lenders that could help consumers receive
the best loan terms possible, they could also be used to target
potentially vulnerable consumers with marketing for products and
services that may pose risks that are not apparent. For example,
certain information about a loan might be perceived to reveal
information about a borrower's sophistication as a consumer of
financial products and services, and information about a borrower's
financial condition may suggest vulnerability to scams relating to debt
relief or credit repair.
Finally, the Bureau believes that some of the unmodified loan-level
HMDA data that will be reported to the agencies under the 2015 HMDA
Final Rule would be considered sensitive by most consumers. In
assessing whether a data field creates a risk of sensitivity, the
Bureau has considered if its disclosure could lead to dignity or
reputational harm or embarrassment, or could be considered outside of
societal or cultural expectations with respect to what information is
available to the general public.
Balancing Risks and Benefits
In applying the balancing test, the Bureau has considered the risks
to applicant and borrower privacy interests that would be created by
the public disclosure of the unmodified loan-level HMDA data that will
be reported under the 2015 HMDA Final Rule and the benefits of such
disclosure in light of HMDA's purposes. As discussed above, assessing
risks to applicant and borrower privacy under the balancing test
requires an evaluation of the unmodified HMDA dataset as a whole and of
the individual data fields contained in the dataset. In developing this
proposal, the Bureau reviewed the contribution of each data field,
individually and in combination, toward the potential re-identification
of an applicant or borrower in the HMDA dataset. As described above,
for purposes of the HMDA balancing test, a significant re-
identification risk is created by uniqueness in the HMDA data among
data fields that are also found in other records that identify an
applicant or borrower. The Bureau has reviewed the availability of
public records in several jurisdictions and has also considered
qualitative factors such as the capacity, incentives, and
characteristics of potential adversaries that may be interested in re-
identification, the public availability of HMDA data fields in other
datasets, the barriers to obtaining these datasets, and
[[Page 44596]]
the degree to which the other datasets are identifiable. The Bureau has
also considered whether certain data fields may be more likely than
others to be known by a potential adversary with personal knowledge
about the applicant or borrower.
The Bureau also considered whether disclosure of the loan-level
HMDA data, if it were to be re-identified, would reveal information
about the applicant or borrower that is not otherwise public and may be
harmful or sensitive. As described above, this consideration involved
reviewing the potential for disclosure to cause financial fraud or
identity theft, harmful targeted marketing, or sensitivity concerns.
The Bureau considered the nature of potential harms that might result
from disclosure of each data field individually and in combination, and
the strength of the field's contribution to such harms. The Bureau also
considered whether each data field is typically publicly available in
identified records and, if so, any barriers to accessing the
information or restrictions on its use.
In addition, the Bureau evaluated the contribution of the data
fields, both individually and in combination, toward the purposes of
HMDA: Helping to determine whether financial institutions are serving
the housing needs of their communities; assisting public officials in
distributing public-sector investment so as to attract private
investment to areas where it is needed; and assisting in identifying
possible discriminatory lending patterns and enforcing
antidiscrimination statutes. Every HMDA data field provides benefits to
achieving the statutory purposes, but different data fields may provide
more value for certain statutory purposes or types of analyses. Data
fields were examined for both current and potential uses.
For data fields the public disclosure of which the Bureau
preliminarily believes would create risks to applicant and borrower
privacy interests, either because a field increases re-identification
risk or poses a risk of harm or sensitivity, the Bureau has weighed
these risks against the benefits of disclosure. Where the Bureau has
preliminarily determined that the disclosure of an individual data
field, alone or in combination with other fields, would create risks to
applicant and borrower privacy that are not justified by the benefits
of disclosure to HMDA's purposes, the Bureau has considered whether it
could appropriately balance the privacy risks and disclosure benefits
through strategies such as binning, rounding, and top- and bottom-
coding,\65\ or whether the public dataset should be modified by
excluding the field. The Bureau has also evaluated the risks and
benefits of disclosing a data field in light of the proposed
modifications considered for the other data fields. The Bureau is
mindful of the connection between the risk of re-identification and the
risk of harm or sensitivity. To the extent that the risk of re-
identification created by disclosure of the HMDA data is reduced, the
risk of disclosing harmful or sensitive information is also reduced.
Conversely, to the extent that the public loan-level HMDA data do not
disclose information that is harmful or sensitive, the consequences of
re-identification are reduced. Where the Bureau has preliminarily
determined that some modification of a data field is appropriate, the
Bureau's consideration of the available forms of modification for the
HMDA data is also informed by the operational challenges associated
with various forms of modification and the need to make financial
institutions' modified loan/application registers available to the
public by March 31 following the calendar year for which the data are
reported.\66\
---------------------------------------------------------------------------
\65\ Binning, sometimes known as recoding or interval recoding,
allows data to be shown clustered into ranges rather than as precise
values. Top- and bottom-coding masks the precise values of a data
field that appear above or below a certain threshold.
\66\ As discussed below in part IV.B, the Bureau will make a
modified loan/application register for each financial institution
available on its Web site by March 31 following the calendar year
for which the information was compiled. With respect to data
compiled in 2018 or later, this proposed Policy Guidance describes
the modifications the Bureau proposes to apply to each financial
institution's modified loan/application register, with the possible
exception of modifications to reflect whether the loan amount is
above the applicable dollar amount limitation on the original
principal obligation in effect at the time of application or
origination as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C.
1454(a)(2), which may be disclosed later than March 31. HMDA data is
reported by March 1 of the year following the calendar year for
which the information was compiled, leaving the Bureau as little as
30 days to prepare each financial institution's modified loan/
application register.
---------------------------------------------------------------------------
B. Application of the Balancing Test to Loan-Level HMDA Data
As described above, the Bureau has interpreted HMDA to require that
public HMDA data be modified when the release of the unmodified data
creates risks to applicant and borrower privacy interests that are not
justified by the benefits of such release to the public in light of
HMDA's purposes. Based on its analysis to date, the Bureau believes
that public disclosure of the unmodified loan-level data that will be
reported to the agencies under the 2015 HMDA Final Rule, as a whole,
would create risks to applicant and borrower privacy interests under
the HMDA balancing test. This is due to the presence in the data of
individual data fields that the Bureau believes would create re-
identification risk and the presence of individual data fields that the
Bureau believes would create a risk of harm or sensitivity. The Bureau
has applied the balancing test to determine whether and how to modify
the HMDA data that will be reported under the 2015 HMDA Final Rule
before it is disclosed to the public and is seeking comment on its
proposed modifications.
For the reasons discussed below, based on its application of the
balancing test, the Bureau proposes to exclude or otherwise modify the
following data fields in the loan-level HMDA data disclosed to the
public: Universal loan identifier (ULI), application date, loan amount,
action taken date, property address, age, credit score, debt-to-income
ratio, property value, the unique identifier assigned by the Nationwide
Mortgage Licensing System and Registry for the mortgage loan originator
(NMLS ID); and automated underwriting system (AUS) result. The Bureau
also proposes to exclude the content of free-form text fields used in
certain instances to report the following data: Race, ethnicity, name
and version of credit score model, reason for denial, and AUS system
name. The Bureau proposes to publicly disclose without modification the
remaining data reported to the agencies under the 2015 HMDA Final Rule.
As discussed above, HMDA and Regulation C require the FFIEC to make
available to the public certain aggregated data. The Bureau, in
consultation with the other agencies, intends to evaluate options for
providing the HMDA data, including the modified data, to the public in
aggregated form, including through the aggregated data products the
FFIEC is required to make available and other vehicles.\67\
---------------------------------------------------------------------------
\67\ See part IV.C, below.
---------------------------------------------------------------------------
The Bureau acknowledges that the proposed modifications would not
completely eliminate risks to applicant and borrower privacy that would
likely be created by the disclosure of loan-level HMDA data, but the
Bureau believes that these modifications would reduce such risks to the
extent necessary to appropriately balance them with the benefits of
disclosure for HMDA's purposes. The Bureau believes that, to the extent
that the public disclosure of the loan-level HMDA data, modified as
proposed, would create risks to applicant and borrower privacy, such
risks would be justified by the benefits of such release to the public
in light of HMDA's purposes.
[[Page 44597]]
The Bureau has considered whether, in light of what it believes to
be a reduced risk of re-identification for HMDA records reflecting an
application where no loan was originated, more data could be disclosed
without modification for those records. As discussed above, the Bureau
believes that the lack of publicly available information about
applications would make it significantly more difficult for an
adversary to re-identify an applicant by matching a HMDA record to a
record from an identified dataset. However, the Bureau believes that
some risk of re-identification by matching may remain in some
circumstances,\68\ and notes that an adversary's personal knowledge may
also permit re-identification of an application record. Further, the
possibility that transactions could be reported as applications in
error and be subsequently corrected in a resubmission would create risk
that the previously-applied modifications would no longer be
appropriate; the previously-disclosed HMDA data would have revealed
information creating risks to applicant and borrower privacy that would
not be justified by the benefits of disclosure. Finally, an approach
requiring that different types of records in the dataset are subject to
different modifications would be operationally challenging and costly
to implement. In light of these privacy and operational concerns, the
Bureau is not proposing this approach at this time, but invites comment
on it.
---------------------------------------------------------------------------
\68\ See supra note 53.
---------------------------------------------------------------------------
The Bureau seeks comment on all aspects of its analysis and the
modifications it proposes to apply to the public loan-level HMDA
dataset under the balancing test. The Bureau notes that, even after it
finalizes this Policy Guidance, it intends to continue to monitor
developments affecting the application of the balancing test to the
HMDA data. The privacy landscape is constantly evolving, and risks to
applicant and borrower privacy created by the disclosure of loan-level
HMDA data may change as the result of technological advances and other
external developments. For example, a new source of publicly available
records may become available, increasing or decreasing privacy risks
under the balancing test, or the Bureau may discover evidence
suggesting that individuals are using the HMDA data in unforeseen,
potentially harmful ways. Potential uses of the loan-level HMDA data in
furtherance of the statute's purposes may also evolve, such that the
benefits associated with the disclosure of certain data may increase to
an extent that justifies providing more information to the public. For
example, a new loan program may emerge with debt-to-income ratio
requirements that increase the benefits of releasing more precise
information about the debt-to-income ratios of applicants or borrowers
than the Bureau proposes herein to release. Such developments and other
changed circumstances may require that, even after this proposed Policy
Guidance is finalized, the Bureau revisit the conclusions previously
reached based on the application of the balancing test in order to
ensure the appropriate protection of applicant and borrower privacy in
light of HMDA's purposes.
The Bureau is proposing this Policy Guidance to provide
transparency, obtain public feedback, and improve the Bureau's
decisionmaking. This proposed Policy Guidance and any final Policy
Guidance concerning the public disclosure of loan-level HMDA data are
non-binding in part because flexibility to revise the modifications
proposed to apply to the public loan-level HMDA data is necessary to
maintain a proper balancing of the privacy risks and benefits of
disclosure, especially in the event the Bureau becomes aware of new
facts and circumstances that might contribute to privacy risks.
However, except where not practical, unnecessary, or where public
interest requires otherwise, the Bureau intends to seek public input on
any future revisions to modifications to the public loan-level HMDA it
might consider.
Data To Be Disclosed in the Loan-Level HMDA Data Without Modification
As discussed above, the 2015 HMDA Final Rule requires financial
institutions to report information about originations and purchases of
mortgage loans, as well as mortgage loan applications that do not
result in originations. The Bureau proposes to disclose the following
data fields to the public as reported, without modification:\69\
---------------------------------------------------------------------------
\69\ As mentioned above and discussed further below, the Bureau
proposes not to disclose free-form text fields used in certain
instances to report the following data: The name and version of the
credit scoring model, race, ethnicity, reasons for denial, and AUS
name.
---------------------------------------------------------------------------
The following information about applicants, borrowers, and
the underwriting process: Income, sex, race, ethnicity, name and
version of the credit scoring model, reasons for denial, and AUS name.
The following information about the property securing the
loan: Census tract, State, county, occupancy type, construction method,
manufactured housing secured property type, manufactured housing land
property interest, and total units.
The following information about the application or loan:
Loan term, loan type, loan purpose, application channel, whether the
loan was initially payable to the financial institution, whether a
preapproval was requested, action taken, type of purchaser, lien
status, prepayment penalty term, introductory rate period, interest
rate, rate spread, total loan costs or total points and fees,
origination charges, total discount points, lender credits, HOEPA
status, balloon payment, interest-only payment, negative amortization,
other non-amortizing features, combined loan-to-value ratio, open-end
line of credit flag, business or commercial flag, and reverse mortgage
flag.
The following information about the lender: Legal Entity
Identifier (LEI), and financial institution name.\70\
---------------------------------------------------------------------------
\70\ See 12 CFR 1003.4(a)(2)-(7), (a)(8)(i), a(9)(ii),
(a)(10)(i), (a)(10)(iii), (a)(11)-(14), (a)(15)(i) (name of scoring
model), (a)(16)-(22), (a)(24)-(27), (a)(29)-(33), (a)(35)(i) (name
of system), (a)(36)-(38) (effective Jan. 1, 2018).
---------------------------------------------------------------------------
Many of these data fields were adopted in the 2015 HMDA Final Rule,
while several are already required to be reported under current
Regulation C. All of the data fields required by current Regulation C
listed above are currently disclosed as reported without modification
in the modified loan/application register that each financial
institution makes available to the public and in the agencies' loan-
level release.\71\ For the reasons discussed below, the Bureau proposes
to publicly disclose the data fields listed above without modification
in the loan-level HMDA data and requests comment on its proposal.
---------------------------------------------------------------------------
\71\ The only data fields excluded from the public loan-level
HMDA data under current Regulation C are the identifying number for
the loan or loan application, the application date, and the action
taken date.
---------------------------------------------------------------------------
With the exception of LEI, financial institution name, census
tract, income, action taken (where the loan is denied), and reasons for
denial, which are discussed further below, the Bureau believes that
disclosure of the data fields listed above would likely present low
risk to applicant and borrower privacy. First, the Bureau believes
that, if the HMDA data were re-identified, disclosure of most of these
data fields would likely create minimal, if any, risk of harm or
sensitivity to applicants or borrowers. These fields include basic
information about the features of the loan or the property securing the
loan--such as the application channel, loan term, and lien status--
rather than information about personal
[[Page 44598]]
characteristics or financial condition of the applicant or borrower,
and the Bureau believes that applicants and borrowers are unlikely to
consider the disclosure of this information to be sensitive. Further,
the Bureau is aware of no clear advantage provided by most of these
data fields for targeted marketing of products and services that may
pose risks that are not apparent. The Bureau believes that certain
fields about the loan, such as the pricing data fields, and certain
fields about the borrower, such as ethnicity and race, may create
relatively more risk of harm or sensitivity, but that these fields
still present low privacy risk. Second, the Bureau believes that
disclosure of most of these data fields would likely create minimal, if
any, risk of substantially facilitating the re-identification of
applicants and borrowers in the HMDA data. Most of these data fields
are not found in publicly available sources of records that contain the
identity of an applicant or borrower; without such an identified
publicly available record, an adversary would experience substantial
difficulty attempting to re-identify an applicant or borrower by
matching a HMDA record using these data fields. Certain data fields may
create relatively more risk of re-identification because they contain
values that are not widely shared among applicants or borrowers, such
as an ethnic and racial category, but the Bureau believes these fields
still present low re-identification risk.\72\ As described above,
public disclosure of these low-risk data fields benefits users in
determining whether financial institutions are serving the housing
needs of their communities; in distributing public-sector investment so
as to attract private investment to areas where it is needed; and in
identifying possible discriminatory lending patterns and enforcing
antidiscrimination statutes. To the extent that disclosure of these
fields would create risk to applicant and borrower privacy, the Bureau
believes the risks would be justified by the benefits of disclosure.
---------------------------------------------------------------------------
\72\ Although the Bureau believes that ethnic and racial
categories are not found in publicly available sources of identified
records, comparing the ethnicity and race found in the HMDA record
to the surname found in an identified public record may help an
adversary narrow the range of public records against which to match
a HMDA record. Information on surnames, in other contexts, has
proven useful to proxy for ethnicity or race. The Bureau also
believes that ethnicity and racial category may be more likely to be
known by adversaries with personal knowledge of the applicant or
borrower than other fields listed above. The Bureau seeks comment in
particular on whether this risk is heightened with respect to
disaggregated ethnicity and race and whether these disaggregated
fields should be treated differently than aggregated ethnicity and
race.
---------------------------------------------------------------------------
The Bureau believes that disclosure of the following data fields
listed above would likely substantially facilitate the re-
identification of applicants or borrowers: LEI, financial institution
name, and census tract. The Bureau believes that publicly available
real estate transaction records such as mortgages and deeds of trust
typically contain the identity of the borrower, the name of the
financial institution, and the property address, from which an
adversary may derive the census tract. Although the uniqueness of a
HMDA record will vary by census tract, the Bureau believes that these
data fields could be used by an adversary to match a HMDA record to an
identified public record.
The Bureau also believes that, if the HMDA data were re-identified,
disclosure of the following data fields listed above would likely
create a risk of harm or sensitivity: Income, action taken (where the
loan is denied), and reasons for denial. These data fields are not
otherwise available to the general public in an identified form without
barriers to access or use restrictions.\73\ The Bureau believes that
these data fields would likely be considered sensitive by many if not
most consumers. Many consumers avoid sharing their incomes, even with
personal acquaintances.\74\ The fact that a financial institution
denied an application and some of the reasons for denial, such as
employment history, credit history, debt-to-income ratio, or
insufficient cash, could reveal negative details about a consumer's
personal financial situation.\75\ The Bureau also believes that these
data fields could be used for harmful purposes, such as targeted
marketing of products and services that may pose risks that are not
apparent.
---------------------------------------------------------------------------
\73\ The Bureau believes that, although estimates of income may
be available in private datasets, reliable income information
typically is not available to the general public without barriers to
access or use restrictions. The HMDA data will include the gross
annual income relied on in making the credit decision, which may be
more accurate.
\74\ The Bureau believes that consumers may still consider
income information to be sensitive even though it is rounded to the
nearest thousand when reported by financial institutions.
\75\ The Bureau notes that the fact that a loan was denied and
the reasons for denial are reported only for applications that have
been denied. As discussed above, the Bureau believes that the risk
of re-identification of applicants where a loan is not originated is
significantly lower than the risk to borrowers. Because these data
fields are difficult to associate with an identified applicant or
borrower, the Bureau believes that the risk of harm or sensitivity
created by their disclosure is reduced.
---------------------------------------------------------------------------
The Bureau nonetheless believes that these risks to applicant and
borrower privacy are justified by the benefits of disclosure in light
of HMDA's purposes. For years, these data fields have proven critical
for furthering HMDA's purposes.\76\ For example, the ability to
identify the financial institution by name is critical for users to
evaluate the lending practices of a financial institution.\77\ The
census tract is essential for users to determine the availability of
credit in certain communities and to identify potentially
discriminatory lending patterns at the community level. Information
about income ensures that users who are evaluating potential
disparities in underwriting or pricing are comparing applicants or
borrowers with similar incomes, thereby controlling for a factor that
might provide a legitimate explanation for such disparities. Income
data can also allow users to determine the availability of credit to
consumers and communities of various income levels. Finally, action
taken and reasons for denial, combined with underwriting information,
help users compare the outcomes received by applicants and borrowers to
identify potential disparities between similarly qualified applicants.
The reasons for denial also help users understand why a particular loan
application was denied and identify potential barriers in access to
credit.
---------------------------------------------------------------------------
\76\ Several data fields adopted in the 2015 HMDA Final Rule are
closely related to, or extensions of, data fields reported under
current Regulation C. Specifically, the LEI will replace the current
reporter's ID, and reasons for denial may currently be reported at
the option of the financial institution. However, financial
institutions supervised by the OCC and the FDIC currently are
required by those agencies to report denial reasons. 12 CFR
27.3(a)(1)(i), 128.6, 390.147.
\77\ The LEI would enhance identification by allowing users to
link the reporting financial institution to its corporate family. If
the financial institution name is publicly disclosed, the LEI
creates minimal, if any, additional privacy risk.
---------------------------------------------------------------------------
The Bureau believes that, under the balancing test, the benefits of
public disclosure of these data fields to HMDA's purposes would justify
the risks to applicant and borrower privacy such disclosure would
likely create. In forming its proposal to publicly disclose these data
fields without modification, the Bureau considered modifications that
would reduce the risks to applicant and borrower privacy while
preserving the benefits of disclosure. However, with the exception of
income and census tract, which have for years proven critical for
furthering HMDA's purposes, no modifications other than exclusion from
the public loan-level HMDA data are reasonably available for these data
fields. Therefore, modification in these circumstances
[[Page 44599]]
would eliminate public utility of these data fields entirely. The
Bureau seeks comment on its proposal to publicly disclose these fields
without modification in the loan-level HMDA data.
Data To Be Excluded or Otherwise Modified in the Loan Level HMDA Data
Universal Loan Identifier
The 2015 HMDA Final Rule requires financial institutions to report
a universal loan identifier (ULI) for each covered loan or application
that can be used to identify and retrieve the application file.\78\ The
2015 HMDA Final Rule sets forth detailed requirements concerning the
ULI to be assigned and reported.\79\ A ULI must begin with the
financial institution's LEI, followed by up to 23 additional characters
to identify the covered loan or application, and then end with a two-
character check digit calculated according to the methodology
prescribed in appendix C of the 2015 HMDA Final Rule.\80\ In addition,
a ULI must be unique within the institution and must not contain any
information that could be used to directly identify the application or
borrower.\81\ Institutions reporting a loan for which a ULI was
previously assigned and reported must report the ULI that was
previously assigned and reported for the loan. The ULI will be
submitted as an alphanumeric field.\82\ The requirement to report a ULI
replaces the requirement under current Regulation C that a financial
institution report an identifying number for the loan or loan
application.\83\ The loan or loan application number is currently
excluded from both the modified loan/application register that each
financial institution makes available to the public and the agencies'
loan-level release. The Bureau added the requirement to report a ULI to
implement the Dodd-Frank Act's amendment to HMDA providing for the
collection and reporting of, ``as the Bureau may determine to be
appropriate, a universal loan identifier.'' \84\
---------------------------------------------------------------------------
\78\ 12 CFR 1003.4(a)(1)(i) (effective January 1, 2018).
\79\ Id.
\80\ 12 CFR 1003.4(a)(1)(i)(A) through (C).
\81\ 12 CFR 1003.4(a)(1)(i)(B)(3).
\82\ Bureau of Consumer Fin. Prot., ``Filing instructions guide
for HMDA data collected in 2018--OMB Control #3170-0008,'' at 14, 48
(Jan. 2017), available at http://www.consumerfinance.gov/data-research/hmda/static/for-filers/2018/2018-HMDA-FIG.pdf.
\83\ See 12 CFR 1003.4(a)(1).
\84\ 12 U.S.C. 2803(b)(6)(G).
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that, depending on
how financial institutions will use ULIs once they are adopted for HMDA
purposes, disclosing the ULI in the loan-level HMDA data could
substantially facilitate the re-identification of an applicant or
borrower and that this risk would not be justified by the benefits of
the disclosure. Therefore, until information is available concerning
how financial institutions use ULIs other than for HMDA purposes, the
Bureau proposes to modify the loan-level HMDA dataset made available to
the public by excluding the ULI.
A ULI would allow users to track over time a loan reported in HMDA
data by different financial institutions. Using a ULI, a user could
identify a loan originated by a HMDA reporter that is later purchased
by another HMDA reporter, then sold and purchased again by yet another
HMDA reporter. Understanding a loan's history would assist in
identifying whether financial institutions are serving the housing
needs of their communities. Widespread adoption of ULIs to identify
mortgage loans in other datasets also could allow users to track a loan
from ``cradle to grave,'' i.e., to link information disclosed in the
public HMDA data with information found in other datasets, such as
datasets reflecting loan performance.
The Bureau believes that, depending on how financial institutions
use ULIs other than for HMDA purposes, public disclosure of a ULI in
the loan-level HMDA data could create a significant risk of re-
identification. If financial institutions include ULIs on loan
documents that are made publicly available, the Bureau believes that
disclosure of the ULI in the public loan-level HMDA data would
substantially facilitate the re-identification of HMDA records. As
discussed above, many jurisdictions publicly disclose real estate
transaction records in an identified form, such as mortgages and deeds
of trust, and the Bureau believes that many financial institutions
include loan numbers on these publicly-recorded documents.\85\ The
Bureau believes that financial institutions may replace the loan
numbers currently assigned to mortgage loans with ULIs \86\ and that,
if they do, the ULI likely will be included on publicly-recorded loan
documents. Especially in light of the uniqueness of a ULI, a ULI on a
publicly-recorded loan document could be used to match a HMDA record to
an identified public record directly and reliably.
---------------------------------------------------------------------------
\85\ For example, in response to concerns about implications
under the Gramm-Leach-Bliley Act (GLBA) of the ``longstanding common
practice for a mortgage lender to place the borrower's account
number on a mortgage loan document to enable the document to be
tracked and place in the proper file once the document is recorded
and returned from the recording office,'' Federal regulators issued
guidance in 2001 opining that such practice does not violate the
GLBA. See Letter from Fed. Reserve Board, Fed. Dep. Ins. Corp.,
Nat'l Credit Union Admin., Off. of the Comptroller of the Currency,
Off. of Thrift Supervision, and Fed. Trade Comm'n (Sept. 4, 2001).
\86\ In response to comments, the Bureau noted in the
supplementary information to the 2015 HMDA Final Rule that a
financial institution may use a ULI for both HMDA purposes and the
loan identification number prescribed by Regulation Z Sec.
1026.37(a)(12). 80 FR 66128, 66177 (Oct. 28, 2015).
---------------------------------------------------------------------------
The Bureau notes that the FFIEC excluded identifying numbers for
loans and applications from the agencies' loan-level HMDA data release
because the data field could be used to identify an applicant or
borrower in the data.\87\ Similarly, Congress later identified
applicant ``identification number'' as a field that the Board should
consider deleting from the modified loan/application register in order
to protect the privacy of applicants and borrowers.\88\ In implementing
this amendment to HMDA, the Board required that financial institutions
remove ``application or loan number'' from the modified loan/
application register before making it available to the public.\89\
---------------------------------------------------------------------------
\87\ The FFIEC noted that ``[a]n unedited form of the data would
contain information that could be used to identify individual loan
applicants'' and that the data would be edited prior to public
release to remove the application identification number, the date of
application, and the date of final action. 55 FR 27886, 27888 (July
6, 1990).
\88\ HMDA section 304(j), added by the Housing and Community
Development Act, section 932(a), 106 Stat. 3672, 3889 (1992).
\89\ 12 CFR 1003.5(c).
---------------------------------------------------------------------------
The Bureau believes that a ULI would disclose minimal, if any,
information about an applicant or borrower that may be harmful or
sensitive. A ULI is associated with a particular application or loan.
As noted above, the 2015 HMDA Final Rule prohibits a financial
institution from including in a ULI assigned to an application or loan
information about the applicant or borrower that could be used to
directly identify the applicant or borrower. Commentary to this
provision clarifies that ``information that could be used to directly
identify the applicant or borrower includes but is not limited to the
applicant's or borrower's name, date of birth, Social Security number,
official government-issued driver's license or identification number,
alien registration number, government passport number, or employer or
taxpayer identification number.'' \90\ Although the Bureau
[[Page 44600]]
believes that financial institutions may include information within a
ULI that is pertinent to the institution's operations, as some do now
with respect to loan numbers, it does not believe that such information
would be considered sensitive or could be used for harmful purposes.
---------------------------------------------------------------------------
\90\ Comment 4(a)(1)(i)-2 (effective Jan. 1, 2018).
---------------------------------------------------------------------------
The Bureau has considered whether a modification to the public
loan-level HMDA dataset other than exclusion of the ULI would
appropriately reduce the privacy risks created by the disclosure of the
ULI in the loan-level data while maintaining some utility for HMDA's
purposes. For example, the Bureau has considered whether it could, in
the loan-level HMDA data disclosed to the public, replace the reported
ULI with a different unique number, such as a hashed value.\91\ The
Bureau also has considered whether it might use some other means to
link HMDA records sharing the same ULI without revealing the ULI
itself. The Bureau is unable to identify a feasible modification at
this time, however. The Bureau believes at this time that, under the
balancing test, excluding the ULI is a modification to the public loan-
level HMDA data that appropriately balances the risks to applicant and
borrower privacy and the benefits of disclosure. The Bureau seeks
comment on this proposal.
---------------------------------------------------------------------------
\91\ A hashed value would be based on the ULI and created by a
secure hash algorithm. A hash algorithm is designed to be non-
invertible, meaning that the original value, in this case the actual
ULI, could not be derived from the hashed value. The hashed value
would only appear in the HMDA data; as it would not appear in public
records, it could not be used to re-identify the HMDA record.
---------------------------------------------------------------------------
Application Date
The 2015 HMDA Final Rule requires financial institutions to report,
except for purchased covered loans, the date the application was
received or the date shown on the application form.\92\ This date will
be submitted by financial institutions as the exact year, month, and
day, in the format of YYYYMMDD.\93\ Financial institutions are required
to report this data field under current Regulation C. The Board amended
Regulation C in 1989 to require reporting of the date the application
was received as part of its implementation of the Financial
Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA),
which expanded HMDA to include data on applications, as well as data on
the race, gender, and income of individual applicants and
borrowers.\94\ The application date is currently excluded from both the
modified loan/application register that each financial institution
makes available to the public and the agencies' loan-level release.\95\
---------------------------------------------------------------------------
\92\ 12 CFR 1003.4(a)(1)(ii) (effective Jan. 1, 2018).
\93\ Supra note 83 at 49.
\94\ Financial Institutions Reform, Recovery, and Enforcement
Act, Public Law 101-73, section 1211, 103 Stat. 183, 524-26 (1989);
54 FR 51356 (Dec. 15, 1989).
\95\ See 12 U.S.C. 2803(j)(2)(B)(i); 12 CFR 1003.5(c).
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that disclosing
the application date in the loan-level HMDA data released to the public
would likely substantially facilitate the re-identification of an
applicant or borrower and that this risk would not be justified by the
benefits of the disclosure. Therefore, the Bureau proposes to modify
the loan-level HMDA data made available to the public by excluding the
date the application was received.
The application date may be useful for identifying possible
discriminatory lending patterns and enforcing antidiscrimination
statutes. In enacting the FIRREA amendments to HMDA, Congress sought to
improve the ability of HMDA users to identify possible discriminatory
lending patterns by expanding HMDA to allow for comparison of accepted
and rejected applications.\96\ The date of application furthered the
purposes underlying this expansion. The application date helps ensure
that users are comparing applicants or borrowers who applied for loans
during similar dates, thereby controlling for factors that might
provide a legitimate explanation for disparities, such as different
market interest rates over different time periods. Users of HMDA data
may also use the application date, in combination with the action taken
date, to screen for delays between application and action dates that
appear to exist on prohibited bases.
---------------------------------------------------------------------------
\96\ H. Rept. 101-209, at 463-65 (1989).
---------------------------------------------------------------------------
The Bureau believes that public disclosure of application date
would likely substantially facilitate the re-identification of an
applicant or borrower in the HMDA data. Disclosing the date of
application would increase the ability of an adversary to associate a
HMDA record with an applicant or borrower by matching it to an
identified publicly available record. As discussed above, many
jurisdictions publicly disclose real estate transaction records in an
identified form, such as mortgages or deeds of trust. These records
contain the date that the lender and borrower entered into or executed
the agreement. This date is correlated with the application date data
field, which reflects either the date the application was received or
the date shown on the application form. Therefore, an adversary could
use the date of application, combined with other data fields, to narrow
the range of identified public records against which to compare the
HMDA data, increasing the likelihood of matching records.
The Bureau notes that the FFIEC excluded the application date from
the agencies' loan-level HMDA data release because the data field could
be used to re-identify a particular applicant or borrower in the
data.\97\ Similarly, when Congress directed that the Board require
deletions from the loan-level HMDA data financial institutions must
make available to the public to protect the privacy of applicants and
borrowers, it identified the application date in particular as one
field to be considered for deletion.\98\
---------------------------------------------------------------------------
\97\ The FFIEC noted that ``[a]n unedited form of the data would
contain information that could be used to identify individual loan
applicants'' and that the data would be edited prior to public
release to remove the application identification number, the date of
application, and the date of final action. 55 FR 27886, 27888 (July
6, 1990).
\98\ Housing and Community Development Act, Public Law 102-550,
section 932(a), 106 Stat. 3672, 3889 (1992).
---------------------------------------------------------------------------
If the HMDA data were re-identified, the Bureau believes that
application date would likely disclose minimal, if any, information
about an applicant or borrower that may be harmful or sensitive.
Application date is not an inherently sensitive data field. Unlike
other dates, such as date of birth, the date of application contains no
intrinsic connection to an individual. Instead, the information is
associated with an applicant or borrower for only a single transaction
in the context of mortgage lending. Further, the Bureau believes that
the date of application would be unlikely to be used for targeted
marketing of products and services that may pose risks that are not
apparent.
HMDA data is disclosed annually based on the calendar year in which
action is taken on an application. Although the Bureau proposes not to
disclose the application date, the year of the loan-level HMDA data
will often correspond to the year in which the application was
received. The Bureau considered binning the values reported for the
application date into quarterly or semi-annual intervals. However, the
Bureau believes that quarterly intervals would fail to reduce re-
identification risk adequately and that, compared to not disclosing
application date, the gains in data utility that semi-annual intervals
might allow do not justify the increase in privacy risk. Disclosing the
date of application in quarterly intervals would provide an individual
with a
[[Page 44601]]
narrower range of identified public records against which to compare
the HMDA data.\99\ And although disclosing application dates in semi-
annual intervals would reduce re-identification risk as compared to
quarterly intervals, the Bureau believes it would only marginally
increase the utility over the current, annual intervals while still
increasing privacy risk. Users would need a narrower range to help
ensure that they were comparing applicants who applied under similar
market conditions. The Bureau believes at this time that, under the
balancing test, excluding the application date is a modification to the
public loan-level HMDA data that appropriately balances the risks to
applicant and borrower privacy and the benefits of disclosure. The
Bureau seeks comment on this proposal.
---------------------------------------------------------------------------
\99\ The Bureau previously identified quarterly release of the
loan-level HMDA data as a potential privacy concern. 80 FR 66128,
66243 (Oct. 28, 2015).
---------------------------------------------------------------------------
Loan Amount
The 2015 HMDA Final Rule requires financial institutions to report
the amount of the covered loan or the amount applied for.\100\ For
closed-end mortgage loans, open-end lines of credit, and reverse
mortgages, this amount is the amount to be repaid as disclosed on the
legal obligation, the amount of credit available to the borrower, and
the initial principal limit, respectively. The loan amount will be
submitted by financial institutions in numeric form reflecting the
exact dollar amount of the loan.\101\ Financial institutions are
required to report this data field under current Regulation C rounded
to the nearest thousand.\102\ Although HMDA has always required
financial institutions to report information about the dollar amount of
a financial institution's mortgage lending activity,\103\ the Board
amended Regulation C in 1989 to require reporting of the loan amount on
a loan-level basis as part of its implementation of FIRREA.\104\
---------------------------------------------------------------------------
\100\ 12 CFR 1003.4(a)(7) (effective Jan. 1, 2018).
\101\ Supra note 83, at 51.
\102\ 12 CFR 1003, Appendix A, I.A.20.
\103\ 12 U.S.C. 2803
\104\ 12 U.S.C. 2803
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that disclosing
the loan amount in the loan-level HMDA data released to the public
would likely substantially facilitate the re-identification of an
applicant or borrower and that this risk would not be justified by the
benefits of the disclosure. Therefore, the Bureau proposes to modify
the loan-level HMDA dataset disclosed to the public by disclosing the
midpoint for the $10,000 interval into which the reported loan amount
falls and by indicating whether the loan amount exceeds the applicable
dollar amount limitation on the original principal obligation in effect
at the time of application or origination as provided under 12 U.S.C.
1717(b)(2) and 12 U.S.C. 1454(a)(2) (``GSE conforming loan
limit'').\105\ For example, for a reported loan amount of $117,834, the
Bureau would disclose $115,000 as the midpoint between values equal to
$110,000 and less than $120,000.
---------------------------------------------------------------------------
\105\ The dollar amount limitation on the original principal
obligation as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C.
1454(a)(2) refers to the annual maximum principal loan balance for a
mortgage acquired by Fannie Mae and Freddie Mac (the ``GSEs''). The
Federal Housing Finance Agency is responsible for determining the
maximum conforming loan limits for mortgages acquired by the GSEs.
See Press Release, Fed. Hous. Fin. Agency, ``FHFA Announces Increase
in Maximum Conforming Loan Limits for Fannie Mae and Freddie Mac in
2017'' (Nov. 23, 2016) https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Announces-Increase-in-Maximum-Conforming-Loan-Limits-for-Fannie-Mae-and-Freddie-Mac-in-2017.aspx.
---------------------------------------------------------------------------
The loan amount is useful for determining whether financial
institutions are serving the housing needs of their communities. By
examining loan amount, users can better understand the amount of credit
that financial institutions have made available to consumers in certain
communities and the extent to which such institutions are providing
credit in varying amounts. Loan amount is also beneficial for
identifying possible discriminatory lending patterns and enforcing
antidiscrimination statutes. For example, the loan amount allows users
to divide the population of applicants or borrowers into segments that
may be subject to different underwriting or pricing policies, such as
those applying for non-conforming mortgage loans. Combined with the
property value, the loan amount would also allow users to calculate a
loan-to-value ratio, an important variable in underwriting. The loan
amount and loan-to-value ratio would help ensure that users who are
evaluating potential disparities in underwriting outcomes, pricing, or
other terms and conditions are comparing applicants or borrowers who
applied for or obtained loans with similar loan amount and loan-to-
value ratios, thereby controlling for factors that might provide a
legitimate explanation for disparities.
The Bureau believes that disclosing the exact loan amount would
likely substantially facilitate the re-identification of an applicant
or borrower. The loan amount is a numeric data field that will often
consist of at least six digits, which increases its contribution to the
uniqueness of a particular HMDA record. As discussed above, this
information is also found in identified real estate transaction records
such as mortgages and deeds of trust that are publicly disclosed by
many jurisdictions. Therefore, in many cases, an adversary could use
the exact loan amount, combined with other fields, to match a HMDA
record to an identified publicly available record.
If the HMDA data were re-identified, the Bureau believes that loan
amount would likely disclose minimal, if any, information about an
applicant or borrower that may be harmful or sensitive. In some cases,
high loan amounts, combined with other information, may be considered
sensitive or may indicate financial vulnerability that could form the
basis for targeted marketing of products and services that may pose
risks that are not apparent. The loan amount may also at least
theoretically be used for phishing attacks. However, the Bureau
believes that loan amount is often already included in identified
publicly available documents, such as the mortgage or deed of trust.
The Bureau believes that this existing public availability decreases
any potential sensitivity and harmfulness of disclosing loan amount in
the HMDA data.
The Bureau believes that the loan-level HMDA data may be modified
to appropriately reduce the privacy risks created by the public
disclosure of the loan amount while preserving much of the benefits of
the data field. The Bureau believes that disclosing the midpoint for
the $10,000 interval into which the reported loan amount falls, and
indicating whether the loan amount exceeds the applicable GSE
conforming loan limit, provides enough precision to allow users to rely
on loan amount to achieve HMDA's purposes. For example, $10,000
intervals will allow users to segment applicants and borrowers that may
be subject to different underwriting or pricing policies. In fact, for
intervals that include the applicable GSE conforming loan limit, an
indication of whether the loan amount is above the applicable limit may
provide greater precision than is provided by the loan-level HMDA data
currently disclosed to the public, in which certain loan amounts above
and below the applicable limit will round to the same thousand. $10,000
intervals will not allow users to calculate an exact loan-to-value
ratio, although users may still derive an estimated loan-to-value
ratio. However, the Bureau believes that releasing the combined
[[Page 44602]]
loan-to-value ratio, as it proposes to do, will be more beneficial for
fair lending purposes than the loan-to-value ratio that users would
have calculated from the exact loan amount and property value.
Disclosing loan amount in $10,000 intervals also decreases the ability
of adversaries to match HMDA data to identified public records by
reducing the uniqueness of a data field common to both datasets.
Because the Bureau is also proposing to modify reported property value
similarly, adversaries will be unable to use the combined loan-to-value
ratio to reduce the effectiveness of the proposed modification by
deriving the reported loan amount. Although the proposed modifications
do not entirely eliminate the risk of re-identification that the Bureau
believes would likely be created by the disclosure of loan amount
information, the Bureau believes that the remaining risk would be
justified by the benefits of disclosing loan amount with the proposed
modifications.
Therefore, the Bureau believes at this time that, under the
balancing test, modifying loan amount as described above appropriately
balances the privacy risks and disclosure benefits. The Bureau seeks
comment on this proposal, including the proposed $10,000 intervals to
be used for binning, the proposal to disclose the midpoint for each
interval, and the proposal to indicate whether the reported loan amount
exceeds the applicable GSE conforming loan limit. Additionally, the
Bureau seeks comment on whether to indicate that a reported loan amount
exceeds the applicable limit for loans eligible for insurance by the
Federal Housing Administration (FHA conforming loan limit).\106\
Factors not reflected in the HMDA data may affect the accuracy of any
such indicator, such as whether the loan amount has been increased by
the amount of any one-time or up-front mortgage insurance premium that
will be financed as part of the loan, in which case the loan may be
eligible for insurance despite appearing in the HMDA data to exceed the
applicable FHA conforming loan limit.\107\ The Bureau seeks comment on
the value of indicating whether the reported loan amount exceeds the
FHA conforming loan limit in light of these limitations.
---------------------------------------------------------------------------
\106\ See 24 CFR 203.18.
\107\ 24 CFR 203.18c.
---------------------------------------------------------------------------
Action Taken Date
The 2015 HMDA Final Rule requires financial institutions to report
the date of action taken by the financial institution on a covered loan
or application.\108\ For originated loans, this date is generally the
date of closing or account opening.\109\ Regulation C provides some
flexibility in reporting the date for other types of actions taken,
such as applications denied, withdrawn, or approved by the institution
but not accepted by the applicant. For example, for applications
approved but not accepted, a financial institution may report ``any
reasonable date, such as the approval date, the deadline for accepting
the offer, or the date the file was closed,'' provided it adopts a
generally consistent approach.\110\ This date is submitted by financial
institutions as the exact year, month, and day, in the format of
YYYYMMDD.\111\ Financial institutions are required to report this data
field under current Regulation C. As with the application date, the
Board added the requirement to report the action taken date as part of
the amendments to Regulation C that implemented FIRREA.\112\ The action
taken date is also currently excluded from both the modified loan/
application register that each financial institution makes available to
the public and the agencies' loan-level release.\113\
---------------------------------------------------------------------------
\108\ 12 CFR 1003.4(a)(8)(ii) (effective Jan. 1, 2018).
\109\ Comment 4(a)(8)(ii)-5 (effective Jan. 1, 2018).
\110\ Comment 4(a)(8)(ii)-4 (effective Jan. 1, 2018).
\111\ Supra note 83, at 52.
\112\ 54 FR 51356 (Dec. 15, 1989).
\113\ See 12 U.S.C. 2803(j)(2)(B)(i); 12 CFR 1003.5(c).
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that disclosing
the action taken date in the loan-level HMDA data released to the
public would likely substantially facilitate the identification of an
applicant or borrower and that this risk would not be justified by the
benefits of the disclosure. Therefore, the Bureau proposes to modify
the loan-level HMDA dataset made available to the public by excluding
the date of action taken by the financial institution.
The action taken date may be useful for identifying possible
discriminatory lending patterns and enforcing antidiscrimination
statutes. The fair lending benefits provided by the date of action
taken are similar to those provided by the date of application,
described above. The action taken date helps ensure that users who are
evaluating potential disparities in pricing or other terms and
conditions are comparing applicants or borrowers who obtained loans on
similar dates, thereby controlling for factors that might provide a
legitimate explanation for such disparities, such as different market
interest rates or different institutional practices over different time
periods. Users of HMDA data may also use the date of action taken, in
combination with application date, to screen for delays between
application and action dates that appear to exist on prohibited bases.
The Bureau believes that disclosing the action taken date would
likely substantially facilitate the re-identification of an applicant
or borrower in the HMDA data. Disclosing the action taken date would
increase the ability of an adversary to associate a HMDA record with an
individual by matching it to an identified publicly available record.
As explained above, many jurisdictions publicly disclose real estate
transaction records in an identified form, such as mortgages or deeds
of trust. These records contain the date that the lender and borrower
entered into or executed the agreement, which, like the application
date, is closely correlated with the action taken date. Indeed, because
the action taken date for originated loans is generally the date of
closing or account opening, in most cases these dates will be
identical. Therefore, in many cases, an adversary could use the action
taken date, combined with other data fields, to match a HMDA record to
an identified public record.
The Bureau notes that, as with the application date, the FFIEC
excluded the action taken date from the agencies' loan-level HMDA data
release because the data field could be used to re-identify a
particular applicant or borrower in the data.\114\ Similarly, Congress
later identified the action taken date as one field that the Board
should consider deleting from the modified loan/application register to
protect the privacy of applicants and borrowers.\115\
---------------------------------------------------------------------------
\114\ The FFIEC noted that ``[a]n unedited form of the data
would contain information that could be used to identify individual
loan applicants'' and that the data would be edited prior to public
release to remove the application identification number, the date of
application, and the date of final action. 55 FR 27886, 27888 (July
6, 1990).
\115\ Housing and Community Development Act, Public Law 102-550,
section 932(a), 106 Stat. 3672, 3889 (1992).
---------------------------------------------------------------------------
If the HMDA data were re-identified, the Bureau believes that,
similar to the application date, the action taken date would likely
disclose minimal, if any, information about an applicant or borrower
that may be harmful or sensitive. As with the application date, the
action taken date is not an inherently sensitive data field; it is
associated with an applicant or borrower for only a single transaction
in the context of mortgage lending and
[[Page 44603]]
does not reflect an intrinsic connection to an individual. Further, the
Bureau believes that the action taken date would be unlikely to be used
for targeted marketing of products and services that pose risks that
may not be apparent.
Although the Bureau proposes not to disclose the action taken date,
the loan-level data will disclose the year in which final action was
taken. As with application date, the Bureau considered binning the
values reported for action taken date into quarterly or semi-annual
intervals. However, the Bureau believes that quarterly intervals would
fail to reduce re-identification risk adequately and that, compared to
not disclosing action taken date, the gains in data utility that semi-
annual intervals might allow do not justify the increase in privacy
risk. Disclosing the action taken date in quarterly intervals would
still provide an individual with a narrow range of identified public
records against which to compare the HMDA data. And although disclosing
action taken dates in semi-annual intervals would reduce re-
identification risk as compared to quarterly intervals, it would only
marginally increase the utility over the current, annual intervals,
while still increasing privacy risk. Users would need a narrower range
to help ensure that they were comparing borrowers who obtained loans
under similar market conditions. The Bureau believes at this time that,
under the balancing test, excluding action taken date is a modification
to the public loan-level HMDA data that appropriately balances the
risks to applicant and borrower privacy and the benefits of
disclosure.\116\ The Bureau seeks comment on this proposal.
---------------------------------------------------------------------------
\116\ However, as described above, the year of the loan-level
HMDA data will disclose the year in which the action was taken. With
respect to quarterly release of the HMDA data, the Bureau stated in
the 2015 HMDA Final Rule that, based on its analysis to date,
``disclosure of loan-level data with more granular date information
than year of final action would create risks to applicant and
borrower privacy that are not outweighed by the benefits of such
disclosure.'' 80 FR 66128, 66243 n.389 (Oct. 28, 2015).
---------------------------------------------------------------------------
Property Address
The 2015 HMDA Final Rule requires financial institutions to report
the address of the property securing the loan or, in the case of an
application, proposed to secure the loan.\117\ This address corresponds
to the property identified on the legal obligation related to the
covered loan.\118\ The format of the property address submitted by
financial institutions will include, as applicable, the street address,
city name, State name, and zip code.\119\ Financial institutions are
not required to report this data field under current Regulation C. The
Bureau added the requirement to report property address in the 2015
HMDA Final Rule to implement the Dodd-Frank Act's amendment to HMDA
providing for the collection and reporting of, ``as the Bureau may
determine to be appropriate, the parcel number that corresponds to the
real property pledged or proposed to be pledged as collateral.'' \120\
---------------------------------------------------------------------------
\117\ 12 CFR 1003.4(a)(9)(i) (effective Jan. 1, 2018).
\118\ Comment 4(a)(9)(i)-1 (effective Jan. 1, 2018). For
applications ``the address should correspond to the location of the
property proposed to secure the loan as identified by the
applicant.''
\119\ Comment 4(a)(9)(i)-2 (effective Jan. 1, 2018).
\120\ 12 U.S.C. 2803(b)(6)(H).
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that disclosing
the property address in the loan-level HMDA data released to the public
would substantially facilitate the re-identification of an applicant or
borrower and that this risk would not be justified by the benefits of
the disclosure. Therefore, the Bureau proposes to modify the loan-level
HMDA dataset made available to the public by excluding the property
address.
The address of the property securing the loan would be useful for
identifying possible discriminatory lending patterns. With the exact
property address, users could examine these patterns at a finer level
of detail than that permitted by the census tract or other geographic
boundaries. More precise geographic identification would also better
allow public officials to target geographic areas that might benefit
from public or private sector investment. Users could also better
determine whether financial institutions are serving the housing needs
of their communities with information that would enable identification
of specific neighborhoods and communities smaller than census tracts.
Finally, the property address would allow users to understand better
the amount of equity retained in that property over time by tracking
multiple liens associated with the same dwelling. This information
would help identify communities with overleveraged properties.
The Bureau believes that disclosure of the property address itself
would likely present minimal, if any, risk of harm or sensitivity.
Property owners' addresses are generally widely publicly
available.\121\ As explained above, the Bureau considers this public
availability to reduce the risk of harm and sensitivity from the
release of this data field. However, the Bureau believes that the
widespread availability of property addresses creates a significant
risk of re-identification. The Bureau believes that adversaries could
easily match the property address contained in the HMDA data to
identified publicly available property address information. Property
addresses are publicly available through a number of sources, including
real estate transaction records, property tax records, reverse phone
directories, online real estate databases, and online ``people search''
Web sites. Because the address disclosed under Regulation C typically
would be identical to the address contained in these publicly available
records, an adversary would know that any match was likely to be
accurate. Therefore, disclosing the property address in the loan-level
HMDA data would substantially facilitate the re-identification of an
applicant or borrower. Further, even if disclosing the property address
would not permit matching, the Bureau believes that the disclosure of
the property address alone could be used in harmful ways. For example,
disclosure of property address would allow an applicant or borrower to
be targeted with marketing for products and services that may pose
risks that are not apparent.
---------------------------------------------------------------------------
\121\ The Bureau understands that some jurisdictions may allow
borrowers to prevent their identities from being disclosed in public
records, and some applicants or borrowers, such as victims of
domestic violence, may hide their addresses to prevent certain
individuals from locating them in person or to prevent other
unwanted intrusions upon the sanctuary or seclusion of their homes.
---------------------------------------------------------------------------
As an alternative to excluding the property address data field from
the loan-level HMDA data released to the public, the Bureau considered
releasing property address in a less granular form. For example, the
Bureau could release geographic information that identifies the
property securing the loan with less specificity. However, for most
reportable transactions, Regulation C already requires reporting of
three additional, less-precise geographic identifiers: (1) State; (2)
county; and (3) census tract. As discussed above, the Bureau proposes
to release these data fields without modification. Further, as
discussed below in part IV.A, the Bureau proposes to identify in the
public loan-level HMDA data the MSA or MD for each reported record.
Other geographic identifiers exist with a level of precision between
census tract and property address to which property addresses could be
mapped, such as census block and census block group. However, the
Bureau believes that these identifiers present similar re-
identification risk to property address because they are sufficiently
precise to
[[Page 44604]]
enable an adversary to match them to publicly available property
address information. The Bureau believes at this time that, under the
balancing test, excluding property address is a modification to the
public loan-level HMDA data that appropriately balances the risks to
applicant and borrower privacy and the benefits of disclosure. The
Bureau seeks comment on this proposal.
Age
The 2015 HMDA Final Rule requires financial institutions to report
the age of an applicant or borrower.\122\ A financial institution
complies with this requirement by reporting age, as of the application
date reported, as the number of whole years derived from the date of
birth as shown on the application form.\123\ The Bureau added the
requirement in the 2015 HMDA Final Rule to report age to implement the
Dodd-Frank Act's amendment to HMDA providing for the collection and
reporting of age.\124\
---------------------------------------------------------------------------
\122\ 12 CFR 1003.4(a)(10)(ii) (effective Jan. 1, 2018).
\123\ Comment 4(a)(1)(ii)-1 (effective Jan. 1, 2018).
\124\ 12 U.S.C. 2803(b)(4).
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that disclosing
the applicant or borrower age in the loan-level HMDA data released to
the public would likely disclose information about the applicant or
borrower that is not otherwise public and may be harmful or sensitive
and that this risk would not be justified by the benefits of the
disclosure. Therefore, the Bureau proposes to modify the loan-level
HMDA dataset disclosed to the public by binning and top- and bottom-
coding age and by indicating whether the reported value is 62 or
higher.
Applicant or borrower age would assist users in identifying
possible discriminatory lending patterns and enforcing
antidiscrimination statutes. Age would be useful to evaluate potential
age discrimination in lending.\125\ Disclosure of applicant or borrower
age also would assist in identifying whether financial institutions are
serving the housing needs of their communities, including the needs of
various age cohorts.
---------------------------------------------------------------------------
\125\ For example, ECOA and Regulation B generally prohibit
creditors from discriminating against applicants in credit
transactions on the basis of age. 12 U.S.C. 1691(b)(1); 12 CFR
1002.4(a).
---------------------------------------------------------------------------
The Bureau believes that, if the HMDA data were re-identified,
disclosure of applicant or borrower age would likely reveal information
about the applicant or borrower that is not otherwise public and may be
harmful or sensitive. The Bureau believes that, although information
about an individual's age may be available for purchase under some
circumstances, birth and similarly reliable records reflecting age
typically are not available to the general public without barriers to
access or use restrictions. The Bureau believes that age likely would
be considered sensitive by many if not most consumers and that
disclosure of an identified applicant's or borrower's age could lead to
dignity harm or embarrassment. The Bureau believes that many consumers
would consider the disclosure of identified age to the general public
to be outside of societal and cultural expectations. The Bureau also
believes that identified age could be used to target marketing to
applicants and borrowers, including marketing for products and services
that may pose risks that are not apparent, and that the inclusion of
this data field in the public loan-level HMDA data would increase the
risk of such uses compared to today. The Bureau notes that in section
304(h)(3)(A), added by the Dodd-Frank Act, Congress specifically
identified age as a data field to which a modification under section
304(h)(1)(E) should apply if the Bureau determines it to be necessary
to protect the privacy interests of applicants or borrowers.\126\
---------------------------------------------------------------------------
\126\ 12 U.S.C. 2803(h)(3)(A)(ii).
---------------------------------------------------------------------------
The Bureau believes that public disclosure in the loan-level HMDA
dataset of unmodified applicant or borrower age may create some risk of
facilitating the re-identification of applicants and borrowers in the
HMDA data, but that this field likely would not substantially
facilitate re-identification. For example, though information about an
individual's age may be available for purchase under some
circumstances, the Bureau believes that an adversary typically would
face difficulty attempting to re-identify an applicant or borrower in
the HMDA data by using age to match HMDA records to other identified
records. An applicant's or borrower's age may be more likely to be
known than other HMDA data by a person with pre-existing knowledge of a
specific applicant or borrower, however, and may help such an adversary
to re-identify a particular applicant or borrower.
The Bureau believes that the loan-level HMDA data may be modified
to appropriately reduce the privacy risks created by the public
disclosure of age while preserving much of the benefits of the data
field. The Bureau proposes to disclose age binned into the following
ranges, as applicable: 25 to 34; 35 to 44; 45 to 54; 55 to 64; and 65
to 74. For example, a reported age of 52 would be shown in the public
loan-level HMDA data as between 45 and 54. The Bureau also proposes to
bottom-code age under 25 and to top-code age over 74. For example, a
reported age of 22 would be shown in the public loan-level HMDA data as
24 or under. The Bureau proposes the particular intervals described
above to allow HMDA data users to analyze HMDA data in combination with
data found in other public data sources, such as U.S. Census Bureau
data.\127\ Finally, the Bureau proposes to indicate whether a reported
age is 62 or higher to enhance the utility of the data for identifying
the particular fair lending risks that may be posed with regard to
elderly populations. The Bureau recognizes that an effect of this
indicator would be to divide the 55 to 64 bin into two bins, 55 to 61
and 62 to 64. The Bureau seeks comment on whether privacy risks created
by such increased precision are justified by the benefits of disclosure
in the proposed ranges. Specifically, the Bureau seeks comment on
whether, instead of binning as proposed and indicating whether a
reported age is 62 or higher, the Bureau should structure the bins to
disclose reported ages of 55 to 74 in ranges of 55 to 61 and 62 to 74.
The Bureau believes at this time that, under the balancing test, the
proposed modifications to the public loan-level HMDA dataset would
appropriately balance the risks to applicant and borrower privacy and
the benefits of disclosure. The Bureau seeks comment on this proposal,
including the proposal to bin age and the proposed intervals to be used
for binning.
---------------------------------------------------------------------------
\127\ See, e.g., U.S. Census Bureau, ``Age and Sex Composition:
2010,'' at tbl. 2, available at https://www.census.gov/prod/cen2010/briefs/c2010br-03.pdf (disclosing age in five-year intervals, i.e.,
25 to 29, 30 to 34, 35 to 40, etc.).
---------------------------------------------------------------------------
Credit Score
The 2015 HMDA Final Rule requires financial institutions to report,
except for purchased covered loans, the credit score or scores relied
on in making the credit decision and the name and version of the
scoring model used to generate each credit score.\128\ It also provides
that, for purposes of this requirement, ``credit score'' has the
meaning set forth in section 609(f)(2)(A) of the Fair Credit Reporting
Act (FCRA).\129\ The credit score or scores relied on in making the
credit decision will be submitted as a numeric field, e.g., 650.\130\ A
financial institution will submit a code from a specified list to
indicate the name and version of the
[[Page 44605]]
scoring model used to generate each credit score reported.\131\ The
Bureau added the requirement in the 2015 HMDA Final Rule to report
information about the credit score or scores relied on to implement the
Dodd-Frank Act's amendment to HMDA providing for the collection and
reporting of ``the credit score of mortgage applicants and mortgagors,
in such form as the Bureau may prescribe.'' \132\
---------------------------------------------------------------------------
\128\ 12 CFR 1003.4(a)(15)(i) (effective Jan. 1, 2018).
\129\ 15 U.S.C. 1681g(f)(2)(A).
\130\ Supra note 83, at 62-63.
\131\ Supra note 83, at 63-64.
\132\ 12 U.S.C. 2803(b)(6)(I).
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that disclosing
the credit score or scores relied on in making the credit decision in
the loan-level HMDA data released to the public would likely disclose
information about the applicant or borrower that is not otherwise
public and may be harmful or sensitive and that this risk would not be
justified by the benefits of the disclosure. Therefore, the Bureau
proposes to modify the public loan-level HMDA dataset by excluding the
credit score or scores relied on in making the credit decision.\133\
---------------------------------------------------------------------------
\133\ As noted above, the Bureau proposes to disclose without
modification the reported name and version of the credit score model
used.
---------------------------------------------------------------------------
The credit score or scores relied on in making the credit decision
would assist users in identifying possible discriminatory lending
patterns and enforcing antidiscrimination statutes. Applicants' credit
scores generally are considered to be important indicators of
creditworthiness and are used in mortgage underwriting and pricing
decisions. Disclosure of the credit score in the public loan-level HMDA
data would help ensure that users are comparing applicants and
borrowers with similar credit profiles, thereby controlling for factors
that might provide a legitimate explanation for disparities in credit
and pricing decisions. Credit scores would also assist in identifying
whether financial institutions are serving the housing needs of their
communities. For example, in order to serve the housing needs of
particular communities, a financial institution may offer different
types of loan products in communities with high numbers of borrowers
with high credit scores than in communities with high numbers of
borrowers with low credit scores.
The Bureau believes that, if the HMDA data were re-identified,
disclosure of the credit score relied on in making the credit decision
would likely disclose information about the applicant or borrower that
is not otherwise public and may be harmful or sensitive. A credit score
is a numerical summary of a consumer's apparent creditworthiness, based
on the consumer's credit report, and reflects the likelihood relative
to other consumers that the consumer will default on a credit
obligation. Identified consumer credit scores and the consumer reports
upon which they are based are not available to the general public. To
the extent credit scores based on consumer reports are available for
commercial purposes, they may be obtained under limited circumstances
and are subject to restrictions on their use.\134\ The Bureau believes
that most consumers consider their credit score to be very sensitive
information. The Bureau believes that public disclosure of an
applicant's or borrower's identified credit score could lead to dignity
or reputational harm or embarrassment, and that many consumers would
consider the disclosure of identified credit scores to the general
public to be outside of societal and cultural expectations. The Bureau
also believes that an identified credit score could be used to target
marketing to applicants and borrowers, including marketing for products
and services that may pose risks that are not apparent, and that the
inclusion of this data field in the public loan-level HMDA data would
increase the risk of such uses compared to today.\135\ The Bureau notes
that in section 304(h)(3)(A), added by the Dodd-Frank Act, Congress
specifically identified credit score as a data field to which a
modification under section 304(h)(1)(E) should apply if the Bureau
determines it to be necessary to protect the privacy interests of
applicants or borrowers.\136\
---------------------------------------------------------------------------
\134\ Credit scores based on consumer credit reports are
consumer reports for purposes of the Fair Credit Reporting Act
(FCRA). Accordingly, for example, they may be obtained from a
consumer reporting agency only for a permissible purpose under the
statute, such as in connection with an application for credit. See
12 U.S.C. 1681b(a).
\135\ For example, a marketer currently may obtain from a
consumer reporting agency a ``prescreened'' list of consumers
meeting certain criteria, such as a minimum credit score, only for
the purpose of making a ``firm offer of credit or insurance.'' 15
U.S.C. 1681b(c), 1681a(l).
\136\ 12 U.S.C. 2803(h)(3)(A)(i).
---------------------------------------------------------------------------
The Bureau has considered the extent to which the age of the loan-
level HMDA data at the time it is disclosed may reduce the risk of harm
or sensitivity created by the public disclosure of credit score were
the HMDA data to be re-identified. For example, as noted above, timely
data are essential for most marketing or advertising efforts, and the
delay between the date a reported credit score is obtained by the
financial institutions and public disclosure of the loan-level HMDA
data on the modified loan/application register ranges from to 3 to 15
months. An applicant's or borrower's credit score may change enough
over these time periods to reduce the usefulness of a score disclosed
in the public HMDA data for marketing purposes. However, the Bureau
does not believe that the passage of these time periods would reduce
the risk of sensitivity created by the disclosure of credit score. For
example, the Bureau does not believe that a borrower would consider the
disclosure of her identified six-month-old credit score to be much less
sensitive than disclosure of her current credit score; the potential
for dignity or reputational harm or embarrassment from a neighbor or
other acquaintance learning the information remains significant.
The Bureau believes that disclosure in the loan-level HMDA data of
the credit score or scores relied on in making the credit decision
creates minimal risk, if any, of substantially facilitating the re-
identification of applicants and borrowers in the HMDA data. As
discussed above, credit scores are not included in identified records
available to the general public. A creditor or marketer may possess
identified credit score information obtained in connection with, for
example, an application for credit or a request for a prescreened list,
but the Bureau does not believe that such information would be useful
for purposes of re-identifying an applicant or borrower in the loan-
level HMDA data. The variation in credit scoring models and versions,
along with the likely difference in the dates that a credit score in
the HMDA data and the credit score information in possession of a
creditor or marketer were created, would make matching the credit score
in loan-level HMDA data to such privately held information challenging
and unreliable. The Bureau believes an adversary would face substantial
difficulty attempting to re-identify an applicant or borrower by using
credit score or scores relied on to match HMDA records to other
identified records.
The Bureau considered whether modifications to the public loan-
level HMDA dataset other than excluding credit score, such as binning
or rounding of credit score, would appropriately reduce the privacy
risks created by the disclosure of credit score in the loan-level data
while maintaining some utility for HMDA's purposes. However, the Bureau
believes that these strategies would not appropriately reduce the risk
of harm or sensitivity and that the gains in data utility that these
strategies might allow would not
[[Page 44606]]
justify the privacy risk created by the disclosure of the modified
field. For example, the Bureau believes that, even if it were to
disclose in the loan-level HMDA data the credit score for a particular
record as being in one of two or three large bins, this information
would still create a significant sensitivity risk if the record were
re-identified. The Bureau believes that the utility to HMDA's purposes
of such binned credit score information would not justify these risks.
The Bureau believes at this time that, under the balancing test,
excluding credit score is a modification to the public loan-level HMDA
data that appropriately balances the risks to applicant and borrower
privacy and the benefits of disclosure. The Bureau seeks comment on
this proposal.
Debt-to-Income Ratio
The 2015 HMDA Final Rule requires financial institutions to report,
except for purchased covered loans, the ratio of the applicant's or
borrower's total monthly debt to the total monthly income relied on in
making the credit decision (debt-to-income ratio).\137\ The debt-to-
income ratio relied on in making the credit decision will be submitted
as a percentage.\138\ The Bureau added the requirement in the 2015 HMDA
Final Rule to report information about the debt-to-income ratio relied
on using its discretionary authority to require the reporting of ``such
other information as the Bureau may require'' provided by the Dodd-
Frank Act's amendment to HMDA.\139\
---------------------------------------------------------------------------
\137\ 12 CFR 1003.4(a)(23) (effective Jan. 1, 2018).
\138\ Supra note 83, at 36, 38.
\139\ HMDA section 304(b)(6).
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that disclosing
the debt-to-income ratio relied on in making the credit decision in the
loan-level HMDA data released to the public would likely disclose
information about the applicant or borrower that is not otherwise
public and may be harmful or sensitive and that, for certain debt-to-
income ratio values, this risk would not be justified by the benefits
of the disclosure. Therefore, the Bureau proposes to modify the loan-
level HMDA dataset by binning and top- and bottom-coding certain debt-
to-income ratio values.
The debt-to-income ratio relied on in making the credit decision
would assist users in identifying possible discriminatory lending
patterns and enforcing antidiscrimination statutes. Applicants' debt-
to-income ratios generally are considered to be important indicators of
ability to repay and are used in mortgage underwriting decisions and
some pricing decisions. Disclosure of debt-to-income ratio in the
public loan-level HMDA data would help ensure that users are comparing
applicants and borrowers with similar profiles, thereby controlling for
factors that might provide a legitimate explanation for disparities in
credit and pricing decisions. Debt-to-income ratio values that are at
or close to regulatory or program benchmarks are especially critical to
identifying possible discriminatory lending patterns. These benchmarks
include, for example, the 43 percent debt-to-income limit for a
qualified mortgage under Regulation Z \140\ and the debt-to-income
ratio limits imposed by guarantors and investors.\141\ Disclosure of
debt-to-income ratio also would assist in identifying whether financial
institutions are serving the housing needs of their communities. For
example, in order to serve the housing needs of particular communities,
financial institutions may offer different types of loan products in
communities with high numbers of borrowers with high debt-to-income
ratios than in communities with high numbers of borrowers with low
debt-to-income ratios.
---------------------------------------------------------------------------
\140\ 12 CFR 1026.43(e)(2)(vi).
\141\ See, e.g., Fannie Mae, ``B3-6-02: Debt to Income Ratios,''
(Aug. 30, 2016), available at https://www.fanniemae.com/content/guide/selling/b3/6/02.html.
---------------------------------------------------------------------------
The Bureau believes that, if the HMDA data were re-identified,
disclosure of an applicant's or borrower's debt-to-income ratio relied
on in making the credit decision would likely disclose information
about the applicant or borrower that is not otherwise public and may be
harmful or sensitive. The debt-to-income ratio generally reflects the
amount of an applicant's or borrower's monthly debt, including the
payment for the mortgage loan sought or originated, relative to his or
her monthly income. In addition, when combined with other information
that the Bureau proposes to publicly disclose in the loan-level HMDA
data, such as information about the mortgage loan sought or originated
and applicant or borrower income relied on in making the credit
decision, disclosure of debt-to-income ratio may permit a user to
approximate the amount of the applicant's or borrower's monthly debt
excluding mortgage debt. Information about a consumer's debt is not
available to the general public without barriers to access and
restrictions on use. The Bureau believes that most consumers consider
information about their debt to be sensitive information and that the
public disclosure of an identified applicant's or borrower's debt-to-
income ratio, especially at higher ratios, could lead to dignity or
reputational harm or embarrassment. The Bureau also believes that,
especially with respect to higher or lower debt-to-income ratios,
identified information about an identified applicant's or borrower's
debt could be used to target marketing to the applicant or borrower,
including marketing for products and services that may pose risks that
are not apparent.
The Bureau believes that disclosure in the loan-level HMDA data of
the debt-to-income ratio relied on in making the credit decision
creates minimal risk, if any, of substantially facilitating the re-
identification of applicants and borrowers in the HMDA data. As
mentioned above, information about a consumer's debts is not included
in identified records available to the general public and, to the
extent such information is available for commercial purposes, it
generally may be obtained under limited circumstances and is subject to
restrictions on its use. To the extent that a creditor possessed
information about an applicant or borrower's debt or debt-to-income
ratio, the Bureau does not believe that such information would be
useful for purposes of re-identifying an applicant or borrower in the
loan-level HMDA data. The variation in methods of calculating debt-to-
income ratio along with changes in the ratio or the amount of debt over
time would make using debt-to-income ratio in the public loan-level
HMDA data to match to any privately held debt or debt-to-income ratio
information challenging and unreliable. The Bureau believes an
adversary would face substantial difficulty attempting to re-identify
an applicant or borrower by using debt-to-income ratio or debt amount
to match HMDA records to other identified records.
The Bureau believes that disclosing unmodified debt-to-income ratio
values in the loan-level HMDA data released to the public would create
risks to applicant and borrower privacy but that, with respect to debt-
to-income values greater than or equal to 40 percent and less than 50
percent, these risks would be justified by the benefits of disclosure
to HMDA's purposes. Debt-to-income ratio values in this range are
generally at or close to regulatory and guarantor and investor program
benchmarks and are especially critical to identifying possible
discriminatory lending patterns because they may reveal non-
discriminatory explanations for differential treatment. Accordingly,
the Bureau proposes to release reported debt-to-income values of
greater than or
[[Page 44607]]
equal to 40 percent and less than 50 percent without modification.
With respect to all other debt-to-income ratio values, the Bureau
believes that the risks to applicant and borrower privacy that would be
created by the disclosure of the unmodified field likely would not be
justified by the benefits of the disclosure, but that the loan-level
HMDA data may be modified to appropriately reduce the privacy risks
while preserving some of the benefits of the data field. The Bureau
proposes to bin reported debt-to-income ratio values into the following
ranges, as applicable: 20 percent to less than 30 percent; 30 percent
to less than 40 percent; and 50 percent to less than 60 percent. For
example, a reported debt-to-income ratio of 35 percent would be shown
in the loan-level HMDA data disclosed to the public as a debt-to-income
ratio of between 30 percent and less than 40 percent. The Bureau also
proposes to bottom-code reported debt-to-income ratio values under 20
percent and to top-code reported debt-to-income ratios of 60 percent or
higher. For example, a reported debt-to-income ratio of 63 percent
would be shown in the public loan-level HMDA data as 61 percent or
higher. The Bureau believes at this time that, under the balancing
test, these modifications to the public loan-level HMDA data would
appropriately balance the risks to applicant and borrower privacy and
the benefits of disclosure.
The Bureau has considered whether it should disclose debt-to-income
ratio at or close to 36 percent without modification.\142\ It is the
Bureau's understanding that, for many financial institutions, debt-to-
income ratio of 36 percent serves as an internal underwriting
benchmark, so that the ability to identify whether an applicant's debt-
to-income ratio is above or below this value would help users seeking
to identify possible discriminatory lending patterns to control for
factors that might provide a legitimate explanation for disparities in
credit or pricing decisions. The Bureau seeks comment on whether the
benefits of disclosing more granular information concerning debt-to-
income ratio values at or around 36 percent would justify the risks to
applicant and borrower privacy such disclosure would likely create and
how such information should be disclosed.
---------------------------------------------------------------------------
\142\ For example, debt-to-income values of between 35 percent
and 40 percent could be disclosed without modification, or the
Bureau could indicate in the loan-level HMDA data disclosed to the
public whether the reported debt-to-income ratio is 36 percent or
higher.
---------------------------------------------------------------------------
The Bureau seeks comment on this proposal, including both the
proposal to bin and top- and bottom-code certain debt-to-income values
and the proposed intervals to be used for binning.
Property Value
The 2015 HMDA Final Rule requires financial institutions to report
the value of the property securing the covered loan or, in the case of
an application, proposed to secure the covered loan.\143\ Financial
institutions will report the value relied on in making the credit
decision, such as an appraisal value or the purchase price of the
property.\144\ The property value will be reported in numeric form
reflecting the exact dollar amount of the value relied on.\145\ The
Bureau added the requirement to report the property value relied on in
the 2015 HMDA Final Rule to implement the Dodd-Frank Act's amendment to
HMDA providing for the collection and reporting of the value of the
real property pledged or proposed to be pledged as collateral.\146\
---------------------------------------------------------------------------
\143\ 12 CFR 1003.4(a)(28) (effective Jan. 1, 2018).
\144\ Id.
\145\ Supra note 83, at 71.
\146\ Dodd-Frank Act section 1094(3)(A)(iv), 12 U.S.C.
2803(b)(6)(A).
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that disclosing
the property value in the loan-level HMDA data released to the public
would likely substantially facilitate the re-identification of an
applicant or borrower and that this risk would not be justified by the
benefits of the disclosure. Therefore, the Bureau proposes to modify
the loan-level HMDA data by disclosing the midpoint for the $10,000
interval into which the reported property value falls. For example, for
a property value of $117,834, the Bureau would disclose $115,000 as the
midpoint between values equal to $110,000 and less than $120,000.
The property value data field would be useful for determining
whether financial institutions are serving the housing needs of their
communities. Users could better understand the values of properties for
which financial institutions are (and are not) providing financing to
consumers in certain communities. The property value, combined with the
loan amount and combined loan-to-value ratio, can also be used to
determine whether the property is subject to a second lien. Property
value would also be beneficial for identifying possible discriminatory
lending patterns and enforcing antidiscrimination statutes. Combined
with the loan amount, the property value would allow users to calculate
a loan-to-value ratio, an important variable in underwriting. The loan-
to-value ratio would help ensure that users who are evaluating
potential disparities in underwriting outcomes, pricing, or other terms
and conditions are comparing applicants or borrowers who obtained or
applied for loans with similar loan-to-value ratios, thereby
controlling for factors that might provide a legitimate explanation for
disparities.
The Bureau believes that disclosing the exact property value would
likely substantially facilitate the re-identification of an applicant
or borrower. As with loan amount, property value is a numeric data
field that will often consist of at least six digits, which increases
its contribution to the uniqueness of a particular HMDA record. As
discussed above, many jurisdictions publicly disclose property tax
records or real estate transaction records in an identified form, such
as mortgages or deeds of trust. These records contain estimates of
property value or information that is closely related to property
value. Although the value of the property reflected in these public
records generally will not be identical to the property value relied on
by the financial institution in making the credit decision, the Bureau
believes that it may be close enough to permit matching. Therefore, in
many cases, an adversary could use the exact property value, combined
with other fields, to match a HMDA record to an identified publicly
available record.
If the HMDA data were re-identified, the Bureau believes that the
property value would likely disclose minimal, if any, information about
an applicant or borrower that may be harmful or sensitive. In some
cases, the property value may be combined with other information to
identify borrowers with high levels of equity, which information could
be used to target borrowers with predatory lending offers. For most
consumers, however, the Bureau believes that property value would be
unlikely to be used for targeted marketing of products and services
that pose risks that may not be apparent. Indeed, the Bureau believes
that information about borrower equity is already available to many
marketers and may be calculated or estimated from publicly available
property tax or real estate transaction records that include loan
amounts and property values, such as mortgages and real estate sales
records. Estimates of property value are also available through online
real estate databases.
[[Page 44608]]
The Bureau believes that the loan-level HMDA data may be modified
to appropriately reduce the privacy risks created by the public
disclosure of the property value while preserving much of the benefits
of the data field. The Bureau believes that disclosing the midpoint for
the $10,000 interval into which the reported property value falls
provides enough precision to allow users to rely on property value to
achieve HMDA's purposes. For example, $10,000 intervals will provide
general information about values of properties for which financial
institutions are providing financing. Such intervals will not allow
users to calculate an exact loan-to-value ratio, although users may
still derive an estimated loan-to-value ratio. However, the Bureau
believes that releasing the combined loan-to-value ratio, as it
proposes to do, will be more beneficial for fair lending purposes than
the loan-to-value ratio that users would have calculated from the exact
loan amount and property value. Disclosing the midpoint for the $10,000
interval into which the reported property value falls also decreases
the ability of adversaries to match HMDA data to identified public
records by reducing the uniqueness of a data field common to both
datasets. Because the Bureau is also proposing to bin loan amount
similarly, adversaries will be unable to use the combined loan-to-value
ratio to reduce the effectiveness of the proposed modification by
deriving the reported property value. Although such modifications do
not entirely eliminate the risk of re-identification, the Bureau
believes that the remaining risk would be justified by the benefits of
disclosing the property value in $10,000 intervals. Therefore, the
Bureau believes at this time that, under the balancing test, modifying
property value as described above appropriately balances the privacy
risks and disclosure benefits. The Bureau seeks comment on this
proposal, including both the proposed $10,000 intervals to be used for
binning and the proposal to disclose the midpoint for each interval.
Nationwide Mortgage Licensing System and Registry Identifier
The 2015 HMDA Final Rule requires financial institutions to report
``the unique identifier assigned by the Nationwide Mortgage Licensing
System and Registry [NMLSR ID] for the mortgage loan originator, as
defined in Regulation G, 12 CFR 1007.102, or Regulation H, 12 CFR
1008.23, as applicable.'' \147\ The NMLSR ID will be submitted by
financial institutions in numeric form, such as 123450.\148\ The Bureau
added the requirement to report the NMLSR ID in the 2015 HMDA Final
Rule to implement the Dodd-Frank Act's requirement that financial
institutions report, ``as the Bureau may determine to be appropriate, a
unique identifier that identifies the loan originator as set forth in
section 1503 of the [Secure and Fair Enforcement for] Mortgage
Licensing Act of 2008.'' \149\
---------------------------------------------------------------------------
\147\ 12 CFR 1003.4(a)(34) (effective Jan. 1, 2018).
\148\ Supra note 83, at 75.
\149\ [thinsp]Dodd-Frank Act section 1094(3)(A)(iv), 12 U.S.C.
2803(b)(6)(F).
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that disclosing
the NMLSR ID in the loan-level HMDA data released to the public would
likely substantially facilitate the re-identification of an applicant
or borrower and that this risk would not be justified by the benefits
of the disclosure. Therefore, the Bureau proposes to modify the loan-
level HMDA data by excluding the NMLSR ID.
The NMLSR ID would be useful for identifying possible
discriminatory lending patterns and enforcing antidiscrimination
statutes. The NMLSR ID would allow users to identify individual
mortgage loan originators with primary responsibility over
applications, originations, and purchased loans. This information would
help public officials and members of the public to identify loan
originators that are engaged in problematic business practices, which
would provide a greater level of precision for understanding and
correcting possible discriminatory lending patterns.
The Bureau believes that disclosing the NMLSR ID would likely
substantially facilitate the re-identification of an applicant or
borrower in the HMDA data. The NMLSR ID is required to appear on
various documents associated with the loan, including the security
instrument.\150\ As explained above, many jurisdictions publicly
disclose these real estate transaction records in an identified form.
Although the NMLSR ID is not unique to an individual HMDA record, it is
unique to the mortgage loan originator who is unlikely to be associated
with many loans for which the other HMDA data fields are identical.
Therefore, in many cases, an adversary could use the NMLSR ID, combined
with other data fields, to match a HMDA record to an identified public
record.
---------------------------------------------------------------------------
\150\ 12 CFR 1026.36(g).
---------------------------------------------------------------------------
If the HMDA data were re-identified, the Bureau believes that the
NMLSR ID would likely disclose minimal, if any, information about an
applicant or borrower that may be harmful or sensitive. The Bureau
understands that the NMLSR ID may allow users to determine information
that loan originators may consider sensitive. However, as explained in
the 2015 HMDA Final Rule, because the Dodd-Frank Act explicitly amended
HMDA to add a loan originator identifier, while at the same time
directing the Bureau to modify or require modification of itemized
information ``for the purpose of protecting the privacy interests of
the mortgage applicants or mortgagors,'' the Bureau believes it is
reasonable to interpret HMDA as not requiring modifications of itemized
information to protect the privacy interests of mortgage loan
originators, and that that interpretation best effectuates the purposes
of HMDA.\151\ Rather, under the balancing test, the Bureau evaluates
the risks to applicant and borrower privacy interests and the benefits
of public disclosure in light of the statutory purposes. Because the
NMLSR ID conveys no sensitive information about applicants or
borrowers, the Bureau believes that disclosure of this data field would
create minimal, if any, risk of harm or sensitivity under the balancing
test. However, because the Bureau believes that disclosing the NMLSR ID
in the loan-level HMDA data released to the public would likely
substantially facilitate the re-identification of an applicant or
borrower and that this risk would not be justified by the benefits of
the disclosure, the Bureau proposes not to disclose in the loan-level
HMDA data the NMLSR ID.
---------------------------------------------------------------------------
\151\ 80 FR 66128, 66232 (Oct. 28, 2015).
---------------------------------------------------------------------------
The Bureau has considered whether a modification to the public
loan-level HMDA dataset other than exclusion of the NMLSR ID would
appropriately reduce the privacy risks created by disclosure while
maintaining some utility for HMDA's purposes. For example, as with the
ULI, the Bureau has considered whether it could, in the loan-level HMDA
data disclosed to the public, replace the NMLSR ID reported to the
regulators with a different unique number, such as a hashed value. The
Bureau is unable to identify a feasible modification at this time,
however. The Bureau believes at this time that, under the balancing
test, excluding the NMLSR ID is a modification to the public loan-level
HMDA data that appropriately balances the risks to applicant and
borrower privacy and the
[[Page 44609]]
benefits of disclosure. The Bureau seeks comment on this proposal.
Automated Underwriting System Result
The 2015 HMDA Final Rule requires that, except for purchased
covered loans, financial institutions report ``the name of the
automated underwriting system used by the financial institution to
evaluate the application and the result generated by that automated
underwriting system.'' \152\ The 2015 HMDA Final Rule defines
``automated underwriting system'' for the purposes of this requirement
as ``an electronic tool developed by a securitizer, Federal government
insurer, or Federal government guarantor that provides a result
regarding the credit risk of the applicant and whether the covered loan
is eligible to be originated, purchased, insured, or guaranteed by that
securitizer, Federal government insurer, or Federal government
guarantor.'' \153\ A financial institution will submit a code from a
specified list to indicate the result or results generated by the AUS
or AUSs used.\154\ Up to five AUS names and five AUS results may be
reported.\155\ The Bureau added these requirements in the 2015 HMDA
Final Rule using its discretionary authority to require the reporting
of ``such other information as the Bureau may require'' provided by the
Dodd-Frank Act's amendment to HMDA.\156\
---------------------------------------------------------------------------
\152\ 12 CFR 1003.4(a)(35)(i) (effective Jan. 1, 2018).
\153\ 12 CFR 1003.4(a)(35)(ii) (effective Jan. 1, 2018).
\154\ Supra note 8, at 74-75. AUS result will be reported using
the following codes: Code 1--Approve/Eligible; Code 2--Approve/
Ineligible; Code 3--Refer/Eligible; Code 4--Refer/Ineligible; Code
5--Refer with Caution; Code 6--Out of Scope; Code 7--Error; Code 8--
Accept; Code 9--Caution; Code 10--Ineligible; Code 11--Incomplete;
Code 12--Invalid; Code 13--Refer; Code 14--Eligible; Code 15--Unable
to Determine; Code 16--Other; Code 17--Not applicable. If the AUS
result is not listed, the financial institution will submit code 16
for ``other'' and will report in a free-form text field the name and
version of the scoring model used.
\155\ Comment 4(a)(35)-3 (concerning reporting of multiple AUS
results); supra note 83, at 37-39, 73.
\156\ HMDA section 304(b)(6).
---------------------------------------------------------------------------
For the reasons given below, the Bureau believes that disclosing in
the loan-level HMDA data released to the public the AUS result field
would likely disclose information about the applicant or borrower that
is not otherwise public and may be harmful or sensitive and that this
risk would not be justified by the benefits of the disclosure.
Therefore, the Bureau proposes to modify the public loan-level HMDA
dataset by excluding the AUS result field.\157\
---------------------------------------------------------------------------
\157\ As discussed above, the Bureau proposes to disclose AUS
name.
---------------------------------------------------------------------------
The AUS result would assist users in identifying possible
discriminatory lending patterns and enforcing antidiscrimination
statutes. The AUS result would assist in understanding a financial
institution's underwriting decision-making and would help ensure that
users are comparing applicants and borrowers with similar profiles,
thereby controlling for factors that might provide a legitimate
explanation for disparities in credit and pricing decisions.
The Bureau believes that, if the HMDA data were re-identified,
disclosure of AUS result would likely disclose information about the
applicant or borrower that is not otherwise public and may be harmful
or sensitive. Applicants' AUS results are not available to the general
public. An AUS result is based on a complex set of factors used to
evaluate the credit risk associated with a loan. The traditional
underwriting process often uses, among other things, loan-to-value
ratio to evaluate collateral, credit score to evaluate creditworthiness
and willingness to pay, and debt-to-income ratio to evaluate ability to
pay. The result from an AUS reflects in a single indicator these and
other factors used to evaluate the risk of the borrower and the
eligibility of the loan to be purchased, insured, or guaranteed. The
Bureau believes that, if a HMDA record were associated with an
identifiable applicant or borrower, disclosure of a ``negative'' AUS
result \158\ would reveal information that would likely be perceived as
reflecting negatively on the applicant or borrower's willingness or
ability to pay. The Bureau believes that most consumers would consider
such information sensitive and that disclosure of this information
could lead to dignity harm or embarrassment. The Bureau believes that
this field also could be used to target marketing to applicants or
borrowers, including marketing of products and services that may pose
risks that are not apparent.
---------------------------------------------------------------------------
\158\ For example, a ``refer with caution'' result would
indicate that the loan would need to be manually underwritten.
---------------------------------------------------------------------------
The Bureau believes that disclosure in the loan-level HMDA data of
AUS result would create minimal, if any, risk of facilitating the re-
identification of applicants and borrowers in the HMDA data. The Bureau
believes that AUS results are not included in any public records or
found in other datasets available to the public and that an adversary
would face substantial difficulty attempting to re-identify an
applicant or borrower by using AUS result to match HMDA records to
other identified records.
The Bureau has considered whether modifications to the public loan-
level HMDA data other than the exclusion of AUS result would
appropriately reduce the privacy risks created by the disclosure of the
AUS result while maintaining some utility for HMDA's purposes. However,
the Bureau does not believe that AUS result can be modified in a manner
that appropriately protects privacy and that also preserves utility.
AUS result is a categorical field, as opposed to a numerical one, and
thus cannot be binned or rounded. The Bureau believes at this time
that, under the balancing test, excluding AUS result is a modification
to the public loan-level HMDA data that appropriately balances the
risks to applicant and borrower privacy and the benefits of disclosure.
The Bureau seeks comment on this proposal.
Free-Form Text Fields
The 2015 HMDA Final Rule requires financial institutions to use
free-form text fields to report certain data. For example, the 2015
HMDA Final Rule requires financial institutions to report, except for
purchased covered loans, the credit score or scores relied on in making
the credit decision and the name and version of the scoring model used
to generate each credit score.\159\ A financial institution will submit
a code from a specified list to indicate the name and version of the
scoring model used to generate each credit score reported.\160\ If the
name and version of the scoring model used to generate a credit score
is not listed, the financial institution will submit the code for
``other credit scoring model'' and will report in a free-form text
field the name and version of the scoring model used.\161\ Free-form
text fields may also be used to report race,\162\ ethnicity,\163\
reason for denial,\164\ and AUS system name.\165\ The maximum number of
characters for the AUS system name free-form text field and for the
reason for denial free-form text field, including spaces, is 255; the
maximum number of characters including spaces for all other free-form
text fields is 100. Free-form text fields used to report race and
ethnicity will be completed by
[[Page 44610]]
applicants; \166\ all other free-form text fields will be completed by
the financial institution.
---------------------------------------------------------------------------
\159\ 12 CFR 1003.4(a)(15)(i) (effective Jan. 1, 2018).
\160\ Supra note 83, at 33-34, 63-64.
\161\ Id.
\162\ 12 CFR 1003.4(a)(10)(i); supra note 83, at 21-31.
\163\ 12 CFR 1003.4(a)(10)(i); supra note 83, at 17-20.
\164\ 12 CFR 1003.4(a)(16); supra note 83, at 35-36.
\165\ 12 CFR 1003.4(a)(35)(i); supra note 83, at 38-40.
\166\ Appendix B, paragraph 8 (effective Jan. 1, 2018).
---------------------------------------------------------------------------
Free-form text fields will allow the reporting of any information,
including information that creates risks to applicant and borrower
privacy. Given the volume of HMDA data reported each year, it will not
be feasible for the Bureau to review the contents of each free-form
text field submitted before disclosing the loan-level HMDA data to the
public. The Bureau believes at this time that, under the balancing
test, excluding free-form text fields is a modification to the public
loan-level HMDA data that appropriately balances the risks to applicant
and borrower privacy and the benefits of disclosure. The Bureau seeks
comment on this proposal.
IV. Other Considerations Related to Disclosure
A. Additional Data
Current Regulation C requires financial institutions to report the
location of the property to which the loan or application relates, by
MSA or by Metropolitan Division, by State, by county, and by census
tract, if the institution has a home or branch office in that MSA or
Metropolitan Division.\167\ To reduce burden on financial institutions,
the 2015 HMDA Final Rule eliminates from this provision the requirement
to report the MSA or Metropolitan Division in which the property is
located.\168\ The Bureau proposes to identify for each loan and
application subject to this provision the MSA or Metropolitan Division
in which the property securing or proposed to secure the loan is
located and to include this information in the loan-level HMDA data
disclosed to the public so that the utility of these currently
disclosed data fields are preserved. The Bureau seeks comment on this
proposal.
---------------------------------------------------------------------------
\167\ 12 CFR 1003.4(a)(9).
\168\ 12 CFR 1003.4(a)(9)(ii) (effective Jan. 1, 2018); 80 FR
66128, 66187 (Oct. 28, 2015).
---------------------------------------------------------------------------
The FFIEC currently includes with the agencies' loan-level release
the following census and income data: Population (total population in
tract); Minority Population Percent (percentage of minority population
to total population for tract, carried to two decimal places); FFIEC
Median Family Income (FFIEC Median family income in dollars for the
MSA/MD in which the tract is located (adjusted annually by FFIEC));
Tract to MSA/MD Median Family Income Percentage (percentage of tract
median family income compared to MSA/MD median family income, carried
to two decimal places); Number of Owner Occupied Units (number of
dwellings, including individual condominiums, that are lived in by the
owner); and Number of 1- to 4-Family units (dwellings that are built to
house fewer than five families).\169\ These data are intended to
provide additional context to the reported HMDA data. The Bureau
proposes to continue to include these data in the loan-level HMDA data
disclosed to the public. The Bureau seeks comment on this proposal.
---------------------------------------------------------------------------
\169\ For more information concerning these data, including the
sources of these data, see Federal Financial Institutions
Examination Council, ``FFIEC Census and Demographic Data,'' https://www.ffiec.gov/censusproducts.htm (last visited Mar. 20, 2017).
---------------------------------------------------------------------------
The FFIEC also currently includes with the agencies' loan-level
release an application date indicator reflecting whether the
application date was before January 1, 2004, on or after January 1,
2004, or not available. The Bureau believes that this indicator is no
longer useful to analysis of the HMDA data and proposes to no longer
include the application date indicator in the loan-level HMDA data
disclosed to the public. The Bureau seeks comment on this proposal.
B. The Modified LAR and the Agencies' Loan-Level Release
As discussed above, HMDA requires that financial institutions make
available to the public, upon request, ``loan application register
information'' as defined by the Bureau and in the form required under
regulations prescribed by the Bureau.\170\ This information must be
made available as early as March 31 following the calendar year for
which the information was compiled.\171\ In addition to the loan-level
data made available by each financial institution on its modified loan/
application register, the FFIEC currently makes available in September
of each year the agencies' loan-level release, which is a loan-level
dataset containing all reported HMDA data for the preceding calendar
year.
---------------------------------------------------------------------------
\170\ HMDA section 304(j)(1). This requirement is implemented in
12 CFR 1003.5(c), which requires that each financial institution
make available to the public its modified loan/application register,
sometimes referred to as a ``modified LAR.''
\171\ HMDA section 304(j)(5).
---------------------------------------------------------------------------
Under the 2015 HMDA Final Rule, financial institutions will no
longer be required to provide their modified loan/application registers
directly to the public and will be required instead to provide a notice
advising members of the public seeking their data that it may be
obtained on the Bureau's Web site.\172\ By March 31 following the
calendar year for which the data was compiled, the Bureau will make
available on the Bureau's Web site a modified loan/application register
for each financial institution that timely submits its HMDA data.\173\
With respect to data compiled in 2018 or later, this proposed Policy
Guidance describes the modifications the Bureau proposes to apply to
each financial institution's modified loan/application register as well
as to the agencies' loan-level release, with the possible exception of
modifications to reflect whether the loan amount is above the
applicable GSE conforming loan limit, which may be released later than
March 31.\174\
---------------------------------------------------------------------------
\172\ 12 CFR 1003.5(c) (effective Jan. 1, 2018).
\173\ With respect to data that is submitted late, the Bureau
intends to make available a modified loan/application register by
March 31 whenever possible, or as soon thereafter as is feasible.
\174\ As noted above, HMDA data is reported by March 1 of the
year following the calendar year for which the information was
compiled, leaving the Bureau as little as 30 days to prepare each
financial institution's modified loan/application register. The
Bureau is exploring how best to provide the public with information
concerning whether a loan is above the applicable GSE conforming
loan limit.
---------------------------------------------------------------------------
C. Aggregate and Disclosure Reports
HMDA and Regulation C require the FFIEC to make available a
disclosure statement for each financial institution each year.\175\ The
statute and regulation also require the FFIEC to compile aggregate data
by census tract for all financial institutions reporting under HMDA and
to produce tables indicating aggregate lending patterns for various
categories of census tracts grouped according to location, age of
housing stock, income level, and racial characteristics.\176\ The FFIEC
currently makes these aggregate data products available in September of
each year reflecting HMDA data reported for the preceding calendar
year.
---------------------------------------------------------------------------
\175\ 12 U.S.C. 2803(k); 12 CFR 1003.5(b)(1) (effective Jan. 1,
2018).
\176\ 12 U.S.C. 2809(a); 12 CFR 1003.5(f) (effective Jan. 1,
2018).
---------------------------------------------------------------------------
The FFIEC, the Bureau, and the other agencies continue to evaluate
options for making available the disclosure statements and aggregate
data required by HMDA and the 2015 HMDA Final Rule. The Bureau may also
consider making available other data products to enhance understanding
of the HMDA data and otherwise further the goals of the statute.
D. Restricted Access Program
As indicated in the supplementary information to the 2014 HMDA
Proposed Rule and the 2015 HMDA Final Rule, the Bureau believes that
HMDA's public disclosure purposes may be furthered by allowing
academics
[[Page 44611]]
and industry and community researchers to access the unmodified HMDA
dataset through a restricted access program, for research purposes. The
Bureau continues to evaluate whether access to unmodified HMDA data
should be permitted through such a program, the options for such a
program, and the risks and costs that may be associated with such a
program.
V. Regulatory Requirements
The Bureau concludes that the proposed Policy Guidance on
Disclosure of Loan-Level HMDA Data is a non-binding general statement
of policy and/or a rule of agency organization, procedure, or practice
exempt from notice and comment rulemaking requirements under the
Administrative Procedure Act pursuant to 5 U.S.C. 553(b).
Notwithstanding this conclusion, the Bureau invites public comment on
the proposed Policy Guidance. Because no notice of proposed rulemaking
is required, the Regulatory Flexibility Act does not require an initial
or final regulatory flexibility analysis.\177\ The existing information
collections contained in Regulation C have been approved by the Office
of Management and Budget (OMB) and assigned OMB control number 3170-
0008. The Bureau has determined that this proposed Policy Guidance does
not impose any new or revise any existing recordkeeping, reporting, or
disclosure requirements on covered entities or members of the public
that would be collections of information requiring OMB approval under
the Paperwork Reduction Act, 44 U.S.C. 3501, et seq. The Bureau has a
continuing interest in the public's opinions regarding this
determination. At any time, comments regarding this determination may
be sent to the Consumer Financial Protection Bureau (Attention: PRA
Office), 1700 G Street NW., Washington, DC 20552, or by email to
[email protected].
---------------------------------------------------------------------------
\177\ 5 U.S.C. 603(a), 604(a).
---------------------------------------------------------------------------
VI. Proposed Policy Guidance on Disclosure of Loan-Level HMDA Data
The text of the proposed Policy Guidance is as follows:
Policy Guidance on Disclosure of Loan-Level HMDA Data
A. Background
The Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et seq.,
requires certain financial institutions to collect, report, and
disclose data about their mortgage lending activity. HMDA is
implemented by Regulation C, 12 CFR part 1003. HMDA identifies its
purposes as providing the public and public officials with sufficient
information to enable them to determine whether financial institutions
are serving the housing needs of the communities in which they are
located, and to assist public officials in their determination of the
distribution of public sector investments in a manner designed to
improve the private investment environment.\178\ In 1989, the Board of
Governors of the Federal Reserve System (Board) recognized a third HMDA
purpose of identifying possible discriminatory lending patterns and
enforcing antidiscrimination statutes, which now appears with HMDA's
other purposes in Regulation C.\179\
---------------------------------------------------------------------------
\178\ 12 U.S.C. 2801(b).
\179\ 54 FR 51356, 51357 (Dec. 15, 1989) (codified at 12 CFR
1003.1(b)(1)) (Bureau's post-Dodd-Frank Act Regulation C).
---------------------------------------------------------------------------
In 2010, Congress enacted the Dodd-Frank Wall Street Reform and
Consumer Protection Act (Dodd-Frank Act).\180\ Among other changes, the
Dodd-Frank Act expanded the scope of information relating to mortgage
applications and loans that must be collected, reported, and disclosed
under HMDA and authorized the Bureau to require financial institutions
to collect, report, and disclose additional information. The Dodd-Frank
Act amendments to HMDA also added new section 304(h)(1)(E), which
directs the Bureau to develop regulations, in consultation with the
agencies identified in section 304(h)(2),\181\ that ``modify or require
modification of itemized information, for the purpose of protecting the
privacy interests of the mortgage applicants or mortgagors, that is or
will be available to the public.'' Section 304(h)(3)(B), also added by
the Dodd-Frank Act, directs the Bureau to ``prescribe standards for any
modification under paragraph (1)(E) to effectuate the purposes of
[HMDA], in light of the privacy interests of mortgage applicants or
mortgagors. Where necessary to protect the privacy interests of
mortgage applicants or mortgagors, the Bureau shall provide for the
disclosure of information . . . in aggregate or other reasonably
modified form, in order to effectuate the purposes of [HMDA].'' \182\
---------------------------------------------------------------------------
\180\ Dodd-Frank Wall Street Reform and Consumer Protection Act,
Public Law 111-203, 124 Stat. 1376, 1980, 2035-38, 2097-101 (2010).
\181\ These agencies are the prudential regulators--the Board of
Governors of the Federal Reserve System, the Federal Deposit
Insurance Corporation, the National Credit Union Administration, and
the Office of the Comptroller of the Currency--and the Department of
Housing and Urban Development. Together with the Bureau, these
agencies are referred to herein as ``the agencies.''
\182\ Section 304(h)(3)(A) provides that a modification under
section 304(h)(1)(E) shall apply to information concerning ``(i)
credit score data . . . in a manner that is consistent with the
purpose described in paragraph (1)(E); and (ii) age or any other
category of data described in paragraph (5) or (6) of subsection
(b), as the Bureau determines to be necessary to satisfy the purpose
described in paragraph (1)(E), and in a manner consistent with that
purpose.''
---------------------------------------------------------------------------
On October 28, 2015, the Bureau published a final rule amending
Regulation C (2015 HMDA Final Rule) to implement the Dodd-Frank Act
amendments and make other changes.\183\ Most provisions of the 2015
HMDA Final Rule go into effect on January 1, 2018,\184\ and apply to
data financial institutions will collect beginning in 2018 and will
report beginning in 2019.
---------------------------------------------------------------------------
\183\ 80 FR 66128 (Oct. 28, 2015); see also 80 FR 69567 (Nov.
10, 2015) (making technical corrections).
\184\ Certain amendments to the definition of financial
institution went into effect on January 1, 2017. See 12 CFR 1003.2
(effective Jan. 1, 2017); 80 FR 66128, 66308 (Oct. 28, 2015).
---------------------------------------------------------------------------
B. The Balancing Test
In the 2015 HMDA Final Rule, in consultation with the agencies and
after notice and comment, the Bureau interpreted HMDA, as amended by
the Dodd-Frank Act, to require that the Bureau use a balancing test to
determine whether and how HMDA data should be modified prior to its
disclosure to the public in order to protect applicant and borrower
privacy while also fulfilling HMDA's public disclosure purposes. The
Bureau interpreted HMDA to require that public HMDA data be modified
when the release of the unmodified data creates risks to applicant and
borrower privacy interests that are not justified by the benefits of
such release to the public in light of the statutory purposes. In such
circumstances, the need to protect the privacy interests of mortgage
applicants or mortgagors requires that the itemized information be
modified. This binding interpretation implemented HMDA sections
304(h)(1)(E) and 304(h)(3)(B) because it prescribed standards for
requiring modification of itemized information, for the purpose of
protecting the privacy interests of mortgage applicants and borrowers,
that is or will be available to the public.\185\
---------------------------------------------------------------------------
\185\ 80 FR 66128, 66134 (Oct. 28, 2015).
---------------------------------------------------------------------------
The Bureau has applied the balancing test to determine whether and
how to modify the HMDA data reported under the 2015 HMDA Final Rule
before it is disclosed on the loan level to the public. This Policy
Guidance describes the loan-level HMDA data that the Bureau intends to
make available to the public beginning in 2019, with respect to data
compiled by financial institutions in or after 2018, including
modifications that
[[Page 44612]]
the Bureau intends to apply to the data. The Bureau intends to continue
to monitor developments affecting the application of the balancing test
to the HMDA data and may reconsider whether and how to modify the HMDA
data, based on the application of the balancing test, in order to
ensure the appropriate protection of applicant and borrower privacy in
light of HMDA's purposes. This Policy Guidance is non-binding in part
because flexibility to revise the modifications to be applied to the
public loan-level HMDA data is necessary to maintain a proper balancing
of the privacy risks and benefits of disclosure.
C. Loan-Level HMDA Data To Be Disclosed to the Public
The Bureau intends to publicly disclose loan-level HMDA data
reported pursuant to the 2015 HMDA Rule as follows:
1. Except as provided in paragraphs 2 through 6 below, the Bureau
intends to disclose all data as reported, without modification.
2. The Bureau intends to exclude the following from the public
loan-level HMDA data:
a. Universal loan identifier, collected pursuant to 12 CFR
1003.4(a)(1)(i);
b. The date the application was received or the date shown on the
application form, collected pursuant to 12 CFR 1003.4(a)(1)(ii);
c. The date of action taken by the financial institution on a
covered loan or application, collected pursuant to 12 CFR
1003.4(a)(8)(ii);
d. The address of the property securing the loan or, in the case of
an application, proposed to secure the loan, collected pursuant to 12
CFR 1003.4(a)(9)(i);
e. The credit score or scores relied on in making the credit
decision, collected pursuant to 12 CFR 1003.4(a)(15)(i);
f. The unique identifier assigned by the Nationwide Mortgage
Licensing System and Registry for the mortgage loan originator, as
defined in Regulation G, 12 CFR 1007.102, or Regulation H, 12 CFR
1008.23, as applicable, collected pursuant to 12 CFR 1003.4(a)(34);
g. The result generated by the automated underwriting system used
by the financial institution to evaluate the application, collected
pursuant to 12 CFR 1003.4(a)(35)(i); and
h. Free-form text fields used to report the following data:
Applicant or borrower race, collected pursuant to 12 CFR
1003.4(a)(10)(i); applicant or borrower ethnicity, collected pursuant
to 12 CFR 1003.4(a)(10)(i); name and version of the credit scoring
model used to generate each credit score or credit scores relied on in
making the credit decision, collected pursuant to 12 CFR
1003.4(a)(15)(i); the principal reason or reasons the financial
institution denied the application, if applicable, collected pursuant
to 12 CFR 1003.4(a)(16); and automated underwriting system name,
collected pursuant to 12 CFR 1003.4(a)(35)(i).
3. With respect to the amount of the covered loan or the amount
applied for, collected pursuant to 12 CFR 1003.4(a)(7), the Bureau
intends to:
a. Disclose the midpoint for the $10,000 interval into which the
reported value falls, e.g., for a reported value of $117,834, disclose
$115,000 as the midpoint between values equal to $110,000 and less than
$120,000; and
b. Indicate whether the reported value exceeds the applicable
dollar amount limitation on the original principal obligation in effect
at the time of application or origination as provided under 12 U.S.C.
1717(b)(2) and 12 U.S.C. 1454(a)(2).
4. With respect to the age of an applicant or borrower, collected
pursuant to 12 CFR 1003.4(a)(10)(ii), the Bureau intends to:
a. Bin reported values into the following ranges, as applicable: 25
to 34; 35 to 44; 45 to 54; 55 to 64; and 65 to 74;
b. Bottom-code reported values under 25;
c. Top-code reported values over 74; and
d. Indicate whether the reported value is 62 or higher.
5. With respect to the ratio of the applicant's or borrower's total
monthly debt to the total monthly income relied on in making the credit
decision, collected pursuant to 12 CFR 1003.4(a)(23), the Bureau
intends to:
a. Bin reported values into the following ranges, as applicable: 20
percent to less than 30 percent; 30 percent to less than 40 percent;
and 50 percent to less than 60 percent;
b. Bottom-code reported values under 20 percent;
c. Top-code reported values of 60 percent or higher; and
d. Disclose, without modification, reported values greater than or
equal to 40 percent and less than 50 percent.
6. With respect to the value of the property securing the covered
loan or, in the case of an application, proposed to secure the covered
loan, collected pursuant to 12 CFR 1003.4(a)(28), the Bureau intends to
disclose the midpoint for the $10,000 interval into which the reported
value falls, e.g., for a reported value of $117,834, disclose $115,000
as the midpoint between values equal to $110,000 and less than
$120,000.
Dated: September 8, 2017.
Richard Cordray,
Director, Bureau of Consumer Financial Protection.
[FR Doc. 2017-20409 Filed 9-22-17; 8:45 am]
BILLING CODE 4810-AM-P