| Page Range | 44586-44612 | |
| FR Document | 2017-20409 |
[Federal Register Volume 82, Number 184 (Monday, September 25, 2017)] [Notices] [Pages 44586-44612] From the Federal Register Online [www.thefederalregister.org] [FR Doc No: 2017-20409] ======================================================================= ----------------------------------------------------------------------- BUREAU OF CONSUMER FINANCIAL PROTECTION [Docket No. CFPB-2017-0025] Disclosure of Loan-Level HMDA Data AGENCY: Bureau of Consumer Financial Protection. ACTION: Notice of proposed policy guidance with request for public comment. ----------------------------------------------------------------------- SUMMARY: The Bureau of Consumer Financial Protection (Bureau) is proposing policy guidance that would describe modifications that the Bureau intends to apply to the loan-level HMDA data that financial institutions will report under the Home Mortgage Disclosure (Regulation C) before the data is disclosed to the public. The proposed policy guidance applies to HMDA data to be reported under Regulation C effective January 1, 2018. The Bureau will make this data available to the public beginning in 2019. DATES: Comments must be received on or before November 24, 2017. ADDRESSES: You may submit comments, identified by Docket No. CFPB-2017- 0025, by any of the following methods:Email: [email protected]. Include Docket No. CFPB-2017-0025 in the subject line of the email. Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments. Mail: Monica Jackson, Office of the Executive Secretary, Consumer Financial Protection Bureau, 1700 G Street NW., Washington, DC 20552. Hand Delivery/Courier: Monica Jackson, Office of the Executive Secretary, Consumer Financial Protection Bureau, 1700 G Street NW., Washington, DC 20552. Instructions: All submissions should include the agency name and docket number or Regulatory Information Number (RIN). Because paper mail in the Washington, DC area and at the Bureau is subject to delay, commenters are encouraged to submit comments electronically. In general, all comments received will be posted without change to http://www.regulations.gov. In addition, comments will be available for public inspection and copying at 1700 G Street NW., Washington, DC 20552, on official business days between the hours of 10 a.m. and 5:00 p.m. Eastern Time. You can make an appointment to inspect the documents by telephoning 202-435-7275. All comments, including attachments and other supporting materials, will become part of the public record and subject to public disclosure. Sensitive personal information, such as account numbers or Social Security numbers, should not be included. Comments will not be edited to remove any identifying or contact information. FOR FURTHER INFORMATION CONTACT: David Jacobs, Counsel, or Laura Stack, Senior Counsel, Office of Regulations, at 202-435-7700 or https://reginquiries.consumerfinance.gov/. SUPPLEMENTARY INFORMATION: I. Summary The Home Mortgage Disclosure Act (HMDA) requires certain financial institutions to collect, report, and disclose data about their mortgage lending activity on an ongoing basis to both Federal regulators and the general public. The home mortgage market is the country's single largest market for consumer financial products and services, with $10 trillion outstanding.\1\ It is a critical source of wealth-building for both individual families and communities, and has a substantial impact on the nation's economy as evidenced by its role in triggering in 2008, the worst financial crisis since the Great Depression. As of 2015, 48 million consumers had a mortgage, representing 65 percent of all owner- occupied homes.\2\ --------------------------------------------------------------------------- \1\ Federal Reserve Bank of St. Louis, Board of Governors of the Federal Reserve System (US), ``Mortgage Debt Outstanding by Type of Property: One- to Four-Family Residences (MDOTP1T4FR),'' https://fred.stlouisfed.org/series/MDOTP1T4FR (last updated June 9, 2017). \2\ U.S. Census Bureau, ``Selected Housing Characteristics: 2011-2015 American Community Survey 5-Year Characteristics,'' https://factfinder.census.gov/faces/tableservices/jsf/pages/productview.xhtml?src=bkmk (last visited Aug. 31, 2017). --------------------------------------------------------------------------- HMDA is implemented by Regulation C, which describes its purposes as helping to determine whether financial institutions are serving the housing needs of their communities; assisting public officials in distributing public-sector investment so as to attract private investment to areas where it is needed; and assisting in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. As described further below, public disclosure of HMDA data is central to [[Page 44587]] the achievement of the statutory goals established by Congress. In 2010, Congress enacted the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), which amended HMDA to require collection of additional mortgage market data and transferred HMDA rulemaking authority and other functions from the Board of Governors of the Federal Reserve System (Board) to the Bureau. On October 28, 2015, the Bureau published a final rule amending Regulation C (2015 HMDA Final Rule) to implement the Dodd-Frank Act amendments. In the 2015 HMDA Final Rule, the Bureau interpreted HMDA, as amended by the Dodd- Frank Act, to require that the Bureau use a balancing test to determine whether and how HMDA data should be modified prior to its disclosure to the public in order to protect applicant and borrower privacy while also fulfilling HMDA's public disclosure purposes. The Bureau interpreted HMDA to require that public HMDA data be modified when the release of the unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such release to the public in light of the statutory purposes. This proposed Policy Guidance describes the Bureau's application of the balancing test to date and the loan-level HMDA data that it proposes to make available to the public beginning in 2019, with respect to data compiled by financial institutions in or after 2018, including modifications that the Bureau intends to apply to the data. In developing this guidance, the Bureau has consulted with the prudential regulators--Board, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency--the Department of Housing and Urban Development, and the Federal Housing Finance Agency. The Bureau proposes to publicly disclose the loan-level HMDA data reported under the 2015 HMDA Final Rule with the following modifications. First, the Bureau proposes to modify the public loan-level HMDA data to exclude: The universal loan identifier; the date the application was received or the date shown on the application form; the date of action taken by the financial institution on a covered loan or application; the address of the property securing the loan or, in the case of an application, proposed to secure the loan; the credit score or scores relied on in making the credit decision; the unique identifier assigned by the Nationwide Mortgage Licensing System and Registry for the mortgage loan originator; and the result generated by the automated underwriting system used by the financial institution to evaluate the application. The Bureau also intends to exclude free-form text fields used to report the following data: Applicant or borrower race; applicant or borrower ethnicity; the name and version of the credit scoring model used to generate each credit score or credit scores relied on in making the credit decision; the principal reason or reasons the financial institution denied the application, if applicable; and the automated underwriting system name. Second, the Bureau proposes to modify the public loan-level HMDA data to reduce the precision of most of the values reported for the following data fields. With respect to the amount of the covered loan or the amount applied for, the Bureau proposes to disclose the midpoint for the $10,000 interval into which the reported value falls. The Bureau also proposes to indicate whether the reported value exceeds the applicable dollar amount limitation on the original principal obligation in effect at the time of application or origination as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2). With respect to the age of an applicant or borrower, the Bureau proposes to bin reported values into the following ranges, as applicable: 25 to 34, 35 to 44, 45 to 54, 55 to 64, and 65 to 74; bottom-code reported values under 25; top-code reported values over 74; and indicate whether the reported value is 62 or higher. With respect to the ratio of the applicant's or borrower's total monthly debt to the total monthly income relied on in making the credit decision, the Bureau proposes to disclose without modification reported values greater than or equal to 40 percent and less than 50 percent; bin reported values into the following ranges, as applicable: 20 percent to less than 30 percent; 30 percent to less than 40 percent; and 50 percent to less than 60 percent; bottom-code reported values under 20 percent; and top-code reported values of 60 percent or higher. With respect to the value of the property securing the covered loan or, in the case of an application, proposed to secure the covered loan, the Bureau proposes to disclose the midpoint for the $10,000 interval into which the reported value falls. This proposed Policy Guidance is exempt from notice and comment rulemaking requirements under the Administrative Procedure Act pursuant to 5 U.S.C. 553(b). It is non-binding in part to preserve flexibility to revise the modifications to be applied to the public loan-level HMDA data as necessary to maintain a proper balancing of the privacy risks and benefits of disclosure, especially in the event the Bureau becomes aware of new facts and circumstances that might contribute to privacy risks. However, the Bureau invites public comment on the proposed Policy Guidance to provide transparency, obtain public feedback on its application of the balancing test, and improve the Bureau's decisionmaking. This proposal does not re-open any portion of the 2015 HMDA Final Rule, and the Bureau does not intend in this proposal to revisit any decisions made in that rulemaking. II. Background A. HMDA's Purposes and the Public Disclosure of HMDA Data The Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et seq., requires certain financial institutions to collect, report, and disclose data about their mortgage lending activity on an ongoing basis to both Federal regulators and the general public. HMDA is implemented by Regulation C, 12 CFR part 1003. HMDA identifies its purposes as providing the public and public officials with sufficient information to enable them to determine whether financial institutions are serving the housing needs of the communities in which they are located, and to assist public officials in their determination of the distribution of public sector investments in a manner designed to improve the private investment environment.\3\ In 1989, Congress expanded HMDA to require, among other things, financial institutions to report racial characteristics, gender, and income information on applicants and borrowers.\4\ In light of these amendments, the Board subsequently recognized a third HMDA purpose of identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes, which now appears with HMDA's other purposes in Regulation C.\5\ --------------------------------------------------------------------------- \3\ 12 U.S.C. 2801(b). \4\ Financial Institutions Reform, Recovery, and Enforcement Act, Public Law 101-73, section 1211, 103 Stat. 183, 524-26 (1989). \5\ 54 FR 51356, 51357 (Dec. 15, 1989) (codified at 12 CFR 1003.1(b)(1)) (Bureau's post-Dodd-Frank Act Regulation C). --------------------------------------------------------------------------- Public disclosure of HMDA data is central to the achievement of HMDA's goals. Since HMDA's enactment in 1975, the data financial institutions are required to disclose under HMDA and Regulation C have been expanded, public access to HMDA data has increased, and the formats in which [[Page 44588]] HMDA data have been disclosed to the public have evolved to provide more useful information to the public and public officials. Amendments to the statute and Regulation C over time illustrate the importance of public access to HMDA data to fulfill the statute's purposes. As originally promulgated, HMDA and Regulation C required a covered financial institution to make available to the public at its home and branch offices a ``disclosure statement'' reflecting aggregates of certain mortgage loan data.\6\ In 1980, Congress amended HMDA to increase the public's access to and the utility of the aggregated HMDA data. First, Congress amended HMDA section 304 to require that the Federal Financial Institutions Examination Council (FFIEC) implement a system to facilitate public access to the data required to be disclosed under the statute, and provided that such system must include arrangements for a ``central depository of data'' in each standard metropolitan statistical area (MSA).\7\ In amending Regulation C to implement this requirement, the Board noted that ``the principal benefit of the central repository system is that users of HMDA data will be able to obtain all of the various institutions' disclosure statements at one location. The current system requires users to contact the institutions on an individual basis to obtain the disclosure data.\8\ Second, the 1980 HMDA amendments required that the FFIEC compile annually for each MSA aggregate data by census tract for all financial institutions required to disclose data under HMDA, and produce tables indicating, for each MSA, aggregate lending patterns for various categories of census tracts grouped according to location, age of housing stock, income level, and racial characteristics.\9\ A principal benefit cited to support these requirements was that the utility of individual institutions' disclosure statements ``would be enhanced if they could be compared to aggregate [MSA] lending patterns.'' \10\ --------------------------------------------------------------------------- \6\ 12 CFR part 203. \7\ Housing and Community Development Act, Public Law 96-399, section 340, 94 Stat. 1614 (1980). \8\ 46 FR 11780, 11786 (Feb. 10, 1981). \9\ Housing and Community Development Act, Public Law 96-399, section 34010, Sec. 340, 94 Stat. 1614 (1980). \10\ 46 FR 11780, 11786 (Feb. 10, 1981). --------------------------------------------------------------------------- In 1989, as noted above, Congress amended HMDA to expand the data financial institutions were required to disclose to the public.\11\ In addition to requiring that financial institutions disclose data concerning the race, sex, and income of applicants and borrowers, the 1989 amendments required that institutions disclose data on loan applications in addition to originations and purchases. In implementing these amendments in Regulation C, the Board required financial institutions to report HMDA data to their supervisory agencies on a loan-by-loan and application-by-application basis using the ``loan/ application register'' format.\12\ Commenters on the Board's proposal to amend Regulation C to implement the 1989 amendments urged the Board to require that financial institutions make their loan/application registers available to the public to provide for more meaningful analysis of the data than that permitted by the required aggregate disclosures.\13\ The Board declined to require that financial institutions make available to the public their loan/application registers, but in 1990 the FFIEC announced that it believed public disclosure of the reported loan-level HMDA data to be ``consistent with the congressional intent to maximize the utilization of lending data'' and that it would make all reported HMDA data available to the public in a loan-level format, after deleting three fields to protect applicant and borrower privacy.\14\ The FFIEC first disclosed the reported loan-level HMDA data to the public in October 1991. --------------------------------------------------------------------------- \11\ Financial Institutions Reform, Recovery and Enforcement Act, Public Law 101-73, section 1211, 103 Stat. 183 (1989). \12\ 12 CFR 203.4, 203.5; see also 54 FR 51356, 51359-60 (Dec. 15, 1989). \13\ 54 FR 51356, 51360-61 (Dec. 15, 1989). \14\ 55 FR 27886, 27888 (July 6, 1990). In announcing that the loan-level data submitted to the supervisory agencies on the loan/ application register would be made available to the public, the FFIEC noted that ``[a]n unedited form of the data would contain information that could be used to identify individual loan applicants'' and that the data would be edited prior to public release to remove the application identification number, the date of application, and the date of final action. --------------------------------------------------------------------------- The following year, Congress amended HMDA to require that each financial institution make available to the public its ``loan application register information'' for each year as early as March 31 of the succeeding year, as required under regulations prescribed by the Board.\15\ New section 304(j) directed the Board to require such deletions from the loan application register information made available to the public as the Board determined to be appropriate to protect any privacy interest of any applicant, and identified as appropriate for deletion the same three fields the FFIEC had determined should be deleted from the loan-level HMDA data it disclosed to the public.\16\ A House Report characterizes the 1992 amendment to HMDA as making ``changes . . . to ensure that the public receives useful and timely information regarding the lending records of financial institutions.'' \17\ The Board implemented this amendment by requiring that financial institutions make their ``modified'' loan/application registers available to the public after deleting the same fields deleted from the loan-level HMDA data disclosed by the FFIEC.\18\ --------------------------------------------------------------------------- \15\ Housing and Community Development Act, Public Law 102-550, section 932, 106 Stat. 3672 (1992). \16\ HMDA section 304(j) identifies as appropriate for deletion ``the applicant's name and identification number, the date of the application, and the date of any determination by the institution with respect to such application.'' \17\ H. Rept. 102-760 (1992). \18\ See 12 CFR 1003.5(c) (Bureau's successor Regulation C, which restates the Board's predecessor Regulation C). Section 1003.5(c) requires that, before making its loan/application register available to the public, a financial institution must delete three fields to protect applicant and borrower privacy: Application or loan number, the date that the application was received, and the date action was taken. --------------------------------------------------------------------------- Today, HMDA data are the preeminent data source that regulators, researchers, economists, industry, and advocates use to achieve HMDA's purposes and to analyze the mortgage market. HMDA and current Regulation C \19\ continue to require that data be made available to the public in both aggregate and loan-level formats. Each financial institution is required to make its modified loan/application register available to the public, with three fields deleted to protect applicant and borrower privacy,\20\ and also make available to the public a disclosure statement prepared by the FFIEC that shows the financial institution's HMDA data in aggregate form.\21\ In addition, the FFIEC makes available to the public disclosure statements for each financial institution,\22\ aggregate reports for each MSA and metropolitan division (MD) showing lending patterns by certain property and applicant characteristics,\23\ and the loan-level dataset containing all reported HMDA data for the preceding calendar year, modified to protect [[Page 44589]] applicant and borrower privacy (the agencies' loan-level release).\24\ --------------------------------------------------------------------------- \19\ Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et seq., as implemented by Regulation C, 12 CFR part 1003. ``Current Regulation C'' as used herein refers to Regulation C in effect as of the date of publication of this proposed Policy Guidance. \20\ HMDA section 304(j)(2)(B); 12 CFR 1003.5(c). \21\ HMDA section 304(k); 12 CFR 1003.5(b). \22\ HMDA section 304(f); 12 CFR 1003.5(f). \23\ HMDA section 310; 12 CFR 1003.5(f). \24\ 55 FR 27886 (July 6, 1990) (announcing that the loan-level HMDA data submitted on the loan/application register would be made available to the public after deletion of three fields to protect applicant and borrower privacy). --------------------------------------------------------------------------- B. The Dodd-Frank Act and Amendments to HMDA and Regulation C In 2010, the Dodd-Frank Act, which amended HMDA and also transferred HMDA rulemaking authority and other functions from the Board to the Bureau, was enacted into law.\25\ Among other changes, the Dodd-Frank Act again expanded the scope of information relating to mortgage applications and loans that must be collected, reported, and disclosed under HMDA and authorized the Bureau to require financial institutions to collect, report, and disclose additional information. The Dodd-Frank Act amendments to HMDA also added new section 304(h)(1)(E), which directs the Bureau to develop regulations, in consultation with the agencies identified in section 304(h)(2),\26\ that ``modify or require modification of itemized information, for the purpose of protecting the privacy interests of the mortgage applicants or mortgagors, that is or will be available to the public.'' Section 304(h)(3)(B), also added by the Dodd-Frank Act, directs the Bureau to ``prescribe standards for any modification under paragraph (1)(E) to effectuate the purposes of [HMDA], in light of the privacy interests of mortgage applicants or mortgagors. Where necessary to protect the privacy interests of mortgage applicants or mortgagors, the Bureau shall provide for the disclosure of information . . . in aggregate or other reasonably modified form, in order to effectuate the purposes of [HMDA].'' \27\ --------------------------------------------------------------------------- \25\ Dodd Frank Wall Street Reform and Consumer Protection Act, Public Law 111-203, 124 Stat. 1376, 1980, 2035-38, 2097-101 (2010). \26\ These agencies are the prudential regulators--the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency--and the Department of Housing and Urban Development. Together with the Bureau, these agencies are referred to herein as ``the agencies.'' \27\ Section 304(h)(3)(A) provides that a modification under section 304(h)(1)(E) shall apply to information concerning ``(i) credit score data . . . in a manner that is consistent with the purpose described in paragraph (1)(E); and (ii) age or any other category of data described in paragraph (5) or (6) of subsection (b), as the Bureau determines to be necessary to satisfy the purpose described in paragraph (1)(E), and in a manner consistent with that purpose.'' --------------------------------------------------------------------------- On August 29, 2014, the Bureau published proposed amendments to Regulation C (2014 HMDA Proposed Rule) to implement the Dodd-Frank Act amendments and to make additional changes.\28\ After careful consideration of comments received on its proposal, the Bureau published a final rule on October 28, 2015 (2015 HMDA Final Rule) amending Regulation C.\29\ The 2015 HMDA Final Rule implements the Dodd-Frank Act amendments and makes other changes to Regulation C. Most provisions of the 2015 HMDA Final Rule go into effect on January 1, 2018 \30\ and apply to data financial institutions will collect beginning in 2018 and will report beginning in 2019.\31\ --------------------------------------------------------------------------- \28\ 79 FR 51732 (Aug. 29, 2014). \29\ Home Mortgage Disclosure (Regulation C), 80 FR 66128 (Oct. 28, 2015); see also 80 FR 69567 (Nov. 10, 2015) (making technical corrections). \30\ Certain amendments to the definition of financial institution went into effect on January 1, 2017. See 12 CFR 1003.2; 80 FR 66128, 66308 (Oct. 28, 2015). \31\ Beginning in 2018, with respect to data compiled in 2017 and later, financial institutions will file their HMDA data with the Bureau. The Bureau will collect and process HMDA data on behalf of the FFIEC and the agencies. --------------------------------------------------------------------------- The 2015 HMDA Final Rule addressed the public disclosure of HMDA data in two ways. First, the 2015 HMDA Final Rule made changes to financial institutions' public disclosure obligations under Regulation C. Under the 2015 HMDA Final Rule, the public disclosure of HMDA data is shifted entirely to the agencies. Effective with respect to HMDA data compiled in 2017 and later, financial institutions will no longer be required to provide their modified loan/application registers and disclosure statements directly to the public and will be required instead to provide only a notice advising members of the public seeking their data that it may be obtained on the Bureau's Web site. In addition to reducing burden on financial institutions associated with their disclosure of HMDA data, the 2015 HMDA Final Rule eliminates risks to financial institutions associated with errors in preparing their modified loan/application registers that could result in the unintended disclosure of data. Further, the 2015 HMDA Final Rule allows decisions with respect to what to include on the modified loan/ application register to be made in conjunction with decisions regarding the agencies' loan-level data release, providing flexibility and allowing for consistency with respect to both releases. This shift of responsibility also permits the Bureau to consider modifications to protect applicant and borrower privacy that preserve data utility but that may be burdensome for financial institutions to implement. Finally, shifting the disclosure of HMDA data to the agencies will allow for easier adjustment of privacy protections applied to disclosures of loan-level HMDA data as privacy risks and potential uses of HMDA data evolve. Also in the 2015 HMDA Final Rule, in consultation with the agencies and after notice and comment, the Bureau interpreted HMDA, as amended by the Dodd-Frank Act, to require that the Bureau use a balancing test to determine whether and how HMDA data should be modified prior to its disclosure to the public in order to protect applicant and borrower privacy while also fulfilling HMDA's public disclosure purposes. The Bureau interpreted HMDA to require that public HMDA data be modified when the release of the unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such release to the public in light of the statutory purposes.\32\ In such circumstances, the need to protect the privacy interests of mortgage applicants or mortgagors requires that the itemized information be modified. This binding interpretation implemented HMDA sections 304(h)(1)(E) and 304(h)(3)(B) because it prescribed standards for requiring modification of itemized information, for the purpose of protecting the privacy interests of mortgage applicants and borrowers, that is or will be available to the public.\33\ The 2015 HMDA Final Rule's interpretation of HMDA section 304(h)(1)(E) and 304(h)(3)(B) to require a balancing test is a regulation that limits the Bureau's discretion with respect to public release of HMDA data. The standards impose binding obligations on the Bureau to evaluate the HMDA data, individually and in combination, to assess whether and how HMDA data should be modified prior to its disclosure to the public in order to protect applicant and borrower privacy while also fulfilling HMDA's public disclosure purposes. The standards for modification of itemized information that is or will be available to the public apply to all data reported under the 2015 HMDA Final Rule.\34\ --------------------------------------------------------------------------- \32\ 80 FR 66128, 66134 (Oct. 28, 2015). \33\ Id. \34\ Id. at 66133, 66252 (noting that the Bureau's application of the balancing test would include data fields currently disclosed on the modified loan/application register and in the agencies' loan- level release). --------------------------------------------------------------------------- Part III of this proposed Policy Guidance describes the Bureau's application of the balancing test to date and its proposals concerning the public disclosure of the loan-level HMDA data that will be reported to the agencies pursuant to Regulation C as amended by [[Page 44590]] the 2015 HMDA Final Rule.\35\ Part IV of this proposed Policy Guidance addresses other considerations related to the disclosure of HMDA data, including the disclosure of aggregate HMDA data.\36\ --------------------------------------------------------------------------- \35\ The Bureau received some comments on the 2014 HMDA Proposed Rule suggesting that disclosure of certain HMDA data fields could reveal confidential business information and that such data fields should not be disclosed to the public in order to protect such information. The Bureau notes that HMDA requires modification of the HMDA data to protect the privacy interests of applicants and borrowers without mentioning the protection of confidential business information. Although the balancing test adopted in the 2015 HMDA Final Rule addresses risks to applicant and borrower privacy created by the disclosure of HMDA data, the modifications resulting from its application may mitigate some of the confidentiality concerns raised by commenters. \36\ As discussed above and also below in part IV.C, HMDA and Regulation C require the FFIEC to make available to the public certain aggregated data. The FFIEC, the Bureau, and the other agencies continue to evaluate options for disclosure of the required aggregates of data that will be reported under the 2015 HMDA Final Rule. --------------------------------------------------------------------------- III. Application of the Balancing Test A. The Balancing Test As noted above, in the 2015 HMDA Final Rule, the Bureau interpreted HMDA to require that public HMDA data be modified when the disclosure of the unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such disclosure to the public in light of the statutory purposes. Considering the public disclosure of the loan-level HMDA dataset as a whole, risks to applicant and borrower privacy interests arise under the balancing test only where the disclosure of the unmodified loan-level HMDA dataset may both substantially facilitate the identification of an applicant or borrower in the data and disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive.\37\ Thus, under the balancing test, risks to applicant and borrower privacy interests would not arise if a loan-level dataset substantially facilitated the identification of applicants and borrowers in the data but revealed no information about applicants and borrowers that was harmful or sensitive and not otherwise public. Alternatively, risks to applicant and borrower privacy interests would not arise under the balancing test if a loan-level dataset contained harmful or sensitive information about applicants and borrowers that was not otherwise public but it was not possible to identify an applicant or borrower in the dataset. --------------------------------------------------------------------------- \37\ 80 FR 66128, 66134 (Oct. 28, 2015). --------------------------------------------------------------------------- Accordingly, under the balancing test, the disclosure of the loan- level HMDA dataset creates risks to applicant and borrower privacy interests only where at least one data field or a combination of data fields in the dataset substantially facilitates the identification of an applicant or borrower, and at least one data field or combination of data fields discloses information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. At the individual data field level, a field may create ``re-identification risk'' by substantially facilitating the identification of an applicant or borrower in the HMDA data (for example, as discussed below, because it may be used to match a HMDA record to an identified record), or may create ``risk of harm or sensitivity'' by disclosing information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. Assessing the risks to applicant and borrower privacy under the balancing test requires an evaluation of the unmodified HMDA dataset as a whole and of the individual data fields contained in the dataset. Where the public disclosure of the unmodified loan-level HMDA dataset would create risks to applicant and borrower privacy, the balancing test requires that the Bureau consider the benefits of disclosure to HMDA's purposes and, where these benefits do not justify the privacy risks the disclosure would create, modify the dataset to appropriately balance the privacy risks and disclosure benefits. An individual data field is a candidate for potential modification under the balancing test if its disclosure in unmodified form would create a risk of re-identification or a risk of harm or sensitivity. As discussed further below, with respect to the HMDA data that will be reported to the agencies under the 2015 HMDA Final Rule and based on its analysis to date, the Bureau believes that public disclosure of the unmodified loan-level dataset, as a whole, would create risks to applicant and borrower privacy interests under the HMDA balancing test. This is due to the presence in the dataset of individual data fields that the Bureau believes would create re-identification risk and the presence of individual data fields that the Bureau believes are not currently public and would create a risk of harm or sensitivity. The Bureau thus has applied the balancing test to determine whether and how it should modify the HMDA data that will be reported under the 2015 HMDA Final Rule before it is disclosed to the public. Based on its analysis, the Bureau believes that the balancing test requires the loan-level HMDA dataset to be modified before it is disclosed to the public to reduce risks to applicant and borrower privacy created by disclosure and appropriately balance them with the benefits of disclosure for HMDA's purposes. The Bureau proposes to modify the public loan-level dataset as described in this proposed Policy Guidance.\38\ The Bureau believes that the modifications to the loan- level HMDA dataset proposed in this Policy Guidance would reduce risks to applicant and borrower privacy and appropriately balance them with the benefits of disclosure for HMDA's purposes. The Bureau seeks comment on all aspects of this proposed Policy Guidance, including its analysis of risks to applicant and borrower privacy, its application of the balancing test, and its proposed modifications. --------------------------------------------------------------------------- \38\ With respect to data compiled in 2018 or later, this proposed Policy Guidance describes the modifications the Bureau proposes to apply to the agencies' loan-level release and to each financial institution's modified loan/application register. The terms ``loan-level dataset'' and ``loan-level data'' used herein refer to HMDA data disclosed on the loan level, whether the data are those submitted by an individual financial institution or by all reporting financial institutions. --------------------------------------------------------------------------- This part III.A describes the benefits of public disclosure of the data that will be reported under the 2015 HMDA Final Rule, the risks to applicant and borrower privacy that may be created by the public disclosure of the unmodified HMDA data that the Bureau has considered, and the Bureau's approach to balancing these benefits and risks. Part III.B describes the application of the balancing test to the data that will be reported under the 2015 HMDA Final Rule and the Bureau's proposed modifications to the loan-level HMDA data that will be disclosed to the public. Disclosure Benefits Under the balancing test, the Bureau considers the benefits of disclosure of the loan-level HMDA data to the public. As described above, HMDA has a long history of providing the public with information about mortgage lending activity, and Congress has repeatedly amended the statute to increase the scope and utility of the data disclosed to the public. Users of HMDA data have relied on this information to help achieve HMDA's purposes: Helping to determine whether financial institutions are serving the housing needs of their communities; assisting public officials in distributing public-sector investment so as to attract private investment to areas where it is needed; and assisting in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Today, [[Page 44591]] HMDA data are the preeminent data source that regulators, researchers, economists, industry, and advocates rely on to achieve HMDA's purposes and to analyze the mortgage market.\39\ --------------------------------------------------------------------------- \39\ For more information about the history and benefits of HMDA, see the supplementary information to the Bureau's 2014 HMDA Proposed Rule, 79 FR 51732, 51735-36 (Aug. 29, 2014), and the Bureau's 2015 HMDA Final Rule, 80 FR 66128, 66129-31 (Oct. 28, 2015). --------------------------------------------------------------------------- Community groups, researchers, and public officials have used HMDA data to help determine whether financial institutions are serving the housing needs of their communities. For example, HMDA data have enabled community groups to understand the magnitude of disinvestment within minority neighborhoods.\40\ Public officials have relied on HMDA data to compare the lending activity of financial institutions to the credit needs of communities and to examine whether minority communities were disproportionately affected by foreclosures following the financial crisis.\41\ Further, community groups relied on HMDA data to document the rise in subprime lending among minority communities in the years before the financial crisis.\42\ --------------------------------------------------------------------------- \40\ See John Goering and Ron Wienk, ``Mortgage Lending, Racial Discrimination and Federal Policy,'' at 10 (Urban Inst. Press 1996). \41\ Robert B. Avery & Thomas M. Buynak, ``Economic Review-- Mortgage Redlining: Some New Evidence,'' at 18-32 (Fed. Reserve Bank of Cleveland, Working Paper No. 0013-0281, 1981), available at https://fraser.stlouisfed.org/scribd/?item_id=4183&filepath=/files/docs/publications/frbclevreview/rev_frbclev_198102.pdf; Carolina Reid and Elizabeth Laderman, ``The Untold Costs of Subprime Lending: Examining the Links Among Higher-Priced Lending, Foreclosures and Race in California'' (Fed. Reserve Bank of S.F., Working Paper No. 2009-09, 2009), available at https://iasp.brandeis.edu/pdfs/Author/reid-carolina/The%20Untold%20Costs%20of%20Subprime%20Lending%203.pdf. \42\ ``Home Mortgage Disclosure Act: Newly Collected Data and What It Means,'' Hearing on the 2004 Home Mortgage Disclosure Act before the Subcomm. on Fin. Servs. and Consumer Credit of the H. Comm. on Fin. Servs., 109th Cong. 4 (2006) (written testimony of Calvin Bradford, President, Calvin Bradford Assocs., Ltd., on behalf of the Nat'l Fair Hous. Alliance). --------------------------------------------------------------------------- Public officials also have used HMDA data to develop and allocate housing and community development investments. For example, local governments have used HMDA data to characterize neighborhoods for purposes of determining the most effective use of housing grants, to select financial institutions for contracts and participation in local programs, and to identify a need for homebuyer counseling and education.\43\ Similarly, the Department of Housing and Urban Development used HMDA data to develop the formula by which funding would be provided to communities suffering from foreclosures and abandonment under the Neighborhood Stabilization Program.\44\ --------------------------------------------------------------------------- \43\ See City of Albuquerque, Dep't of Family and Comty. Hous., ``Five Year Consolidated Housing Plan and Workforce Housing Plan (2008-2012),'' at 100 (2008), available at http://www.cabq.gov/family/documents/ConsolidatedWorkforceHousingPlan20082012final.pdf; City of Antioch, Cal., ``Fiscal Year 2012-2013: Consolidated Annual Performance Evaluation Report,'' at 29 (2012), available at http://ci.antioch.ca.us/CitySvcs/CDBGdocs/CAPER%20FY%2012-13.pdf; City of Lawrence, Mass., ``HUD Consolidated Plan 2010-2015,'' at 68 (2010), available at http://www.cityoflawrence.com/Data/Sites/1/documents/cd/Lawrence_Consolidated_Plan_Final.pdf. \44\ See U.S. Dep't of Housing and Urban Dev., ``Neighborhood Stabilization Program Formula Methodology'' (2008), available at https://www.huduser.gov/portal/datasets/NSP.html. --------------------------------------------------------------------------- HMDA data have also been used by public officials, researchers, and community groups to identify potentially discriminatory lending patterns and to enforce antidiscrimination statutes. For example, researchers, journalists, and public officials relied on HMDA data along with other publicly available data to identify racial disparities in mortgage lending between neighborhoods in Atlanta, Detroit, and Boston.\45\ Since Congress amended HMDA to require reporting of the race, gender, and income of individual applicants and borrowers,\46\ the expanded HMDA data have been used to identify potential discriminatory lending practices.\47\ Community groups have used the data to monitor fair lending within their communities and enter into agreements with financial institutions to ensure that the local needs were being served in a responsible manner.\48\ HMDA data also played an important role in recent enforcement actions by the Illinois and New York Attorneys General related to discriminatory mortgage lending.\49\ The Bureau and other regulators regularly rely on HMDA data in fair lending analyses, including in identifying possible discriminatory practices such as illegal redlining.\50\ --------------------------------------------------------------------------- \45\ Bill Dedman, ``The Color of Money,'' (parts 1-4), Atlanta Journal-Const., May 1-4, 1988; David Everett et al., ``The Race for Money,'' (parts 1-4), Detroit Free Press, July 24-27, 1988; Bill Dedman, ``Blacks Turned Down for Home Loans from S&Ls Twice as Often as Whites,'' Atlanta Journal-Const., Jan. 22, 1989; Katharine Bradbury et al., ``Geographic Patterns of Mortgage Lending in Boston, 1982-1987,'' New Eng. Econ. Rev., (1989). These reports and studies helped motivate Congress to amend HMDA to improve publicly available information about lending practices through the Financial Institutions Reform, Recovery, and Enforcement Act of 1989. \46\ Federal Institutions Reform, Recovery, and Enforcement Act, Public Law 101-73, section 1211, Sec. 304, 103 Stat. 183, 524-26 (1989). \47\ For example, researchers have found evidence that, in many cases, an applicant's race alone influenced whether the applicant was denied credit. See, e.g., Alicia H. Munnell et al., ``Mortgage Lending in Boston: Interpreting the HMDA Data,'' at 22 (Am. Econ. Rev., Fed. Reserve Bank of Boston Working Paper 92-7 (1992); James H. Carr & Isaac F. Megbolugbe, ``The Federal Reserve Bank of Boston: Study on Mortgage Lending Revisited,'' 4 J. of Hous. Res. 2, at 277 (1993). \48\ See Adam Rust, ``A Principle-Based Redesign of HMDA and CRA Data in Revisiting the Community Reinvestment Act: Perspectives on the Future of the Community Reinvestment Act,'' at 179 (Fed. Reserve Banks of Bos. and S.F. 2009). \49\ Yana Kunichoff, ``Lisa Madigan credits Reporter with initiating largest discriminatory lending settlements in U.S. history,'' Chicago Rep. (June 14, 2013), available at http://www.chicagonow.com/chicago-muckrakers/2013/06/lisa-madigan-credits-reporter-with-initiating-largest-discriminatory-lending-settlements-in-u-s-history/; Press Release, N.Y. State Off. of the Att'y Gen., ``Attorney General Cuomo Obtains Approximately $1 Million For Victims Of Greenpoint's Discriminatory Lending Practices'' (July 16, 2008), available at http://www.ag.ny.gov/press-release/attorney-general-cuomo-obtains-approximately-1-million-victims-greenpoints. \50\ Although certain regulators have access to the non-public HMDA data, their analyses also rely heavily on data fields that are publicly disclosed. --------------------------------------------------------------------------- In enacting the Dodd-Frank Act in 2010, Congress expanded the data financial institutions are required to collect, report, and disclose under HMDA and authorized the Bureau to require additional information. The Bureau's 2015 HMDA Final Rule amended Regulation C to implement the Dodd-Frank Act amendments and address the informational shortcomings exposed by the financial crisis to better meet the needs of the public, public officials, and regulators. Although the 2015 HMDA Final Rule did not address the specific data fields that would be disclosed to the public in the loan-level HMDA data, the rule required the collection and reporting of a number of data fields which, if publicly disclosed, would improve the ability of HMDA data users to fulfill HMDA's purposes. For example, mandatory reporting of information about the reasons for denial of a loan application, combined with data fields used to make underwriting decisions, would improve the ability to understand lenders' decision-making and to identify possible discriminatory lending patterns in underwriting. Pricing information, such as rate spread for additional types of loans, total loan costs, total discount points, lender credits, and interest rate, would allow users to better understand pricing decisions and the cost of credit to mortgage borrowers. Information about manufactured housing and multifamily financing would allow users to better understand important sources of housing for low-income and potentially financially vulnerable borrowers, which helps users determine whether financial institutions are serving the housing needs of their communities and helps public officials target public investment [[Page 44592]] to better attract private investment. Information about the ages of applicants or borrowers and disaggregated racial and ethnic information would assist in identifying potentially discriminatory lending patterns and help determine whether financial institutions are serving the housing needs of their communities. Data fields about occupancy status and home-equity lines of credit provide information about potentially speculative purchases of housing and the degrees of leverage borrowers are undertaking. This information would better allow users to identify trends in the mortgage market that may increase systemic risk to the overall economy. Understanding these risks helps public officials distribute public-sector investment and helps users determine whether financial institutions are serving the housing needs of their communities. Today, HMDA data represent a public good that responds to the fact that private lenders do not, in the ordinary course, make information about their loans and lending decisions publicly available. HMDA provides the only source of loan-level mortgage data with comprehensive national coverage that is free and easily accessible to the public. Other publicly available mortgage datasets lack information crucial for HMDA's purposes that is found in the HMDA data, such as the race, ethnicity, and sex of applicants and borrowers. Private data vendors sell several large datasets that typically contain data collected from the largest mortgage loan servicers or securitizers, but none of these datasets match the coverage of the HMDA data. These private datasets also typically lack information that identifies individual lenders and therefore cannot be used to study whether specific lenders are meeting community needs or may be making discriminatory credit decisions. Additionally, the Bureau is aware of no private dataset that includes information about applications that do not result in originated loans. By including applications in addition to originated and purchased loans, HMDA provides a near-census of the mortgage market that allows users to draw a detailed picture of the supply and demand of mortgage credit at various levels of geographic and lender aggregation. Finally, unlike the HMDA data, private datasets are costly for subscribers, creating a substantial hurdle for many community groups, government agencies, and researchers that wish to access them. HMDA data also benefit users by addressing the information asymmetries present in credit markets. The degree of control that lenders exercise over the mortgage lending process gives them a significant information advantage over borrowers, researchers, and other members of the public. This advantage can contribute to certain types of lender behavior, such as discrimination or predatory lending, that conflict with the best interests of borrowers and the housing needs of communities. The relative difference in information may also lead to herding behavior where both lenders and consumers pursue risky mortgage loans based primarily on the popularity of these products, creating substantial systemic risk to the mortgage market and the financial system. Publicly available mortgage data increase transparency in the mortgage market, narrowing the information gap between lenders and borrowers, community groups, and public officials. Greater information can enable these latter parties to advocate for financial institutions to maintain fair practices and serve the housing needs of their communities, and can increase the prospect of self- correction by financial institutions. Additional information also helps to reduce the herding behavior of both lenders and borrowers, reducing systemic risk. Risks to Applicant and Borrower Privacy Interests The Bureau has considered the risks to applicant and borrower privacy that may be created by the public disclosure of the HMDA data that will be reported to the agencies under the 2015 HMDA Final Rule. Based on its analysis to date, the Bureau believes that public disclosure of the unmodified loan-level dataset, as a whole, would create risks to applicant and borrower privacy interests under the HMDA balancing test. As described in more detail below, this is due to the presence in the dataset of individual data fields that the Bureau believes would create re-identification risk and the presence of individual data fields that the Bureau believes would create a risk of harm or sensitivity. However, the Bureau believes that the modifications to the loan-level HMDA dataset proposed in this Policy Guidance would reduce these risks to applicant and borrower privacy and appropriately balance them with the benefits of disclosure for HMDA's purposes. Re-Identification Risk In evaluating the potential re-identification risk presented by the disclosure of the unmodified loan-level HMDA data that will be reported under the 2015 HMDA Final Rule, the Bureau has considered the data fields contained in the dataset, the likely methods by which applicants and borrowers could be identified in the dataset, the nature and availability of additional datasets that may be useful to the re- identification of HMDA data, and the incentives and capabilities of persons interested in re-identification. The Bureau uses the term ``adversary'' when referring to such persons.\51\ The term is not intended to indicate that the adversary's motives are necessarily malicious or adverse to the interests of the individuals in the dataset. --------------------------------------------------------------------------- \51\ See, e.g., Nat'l Inst. of Standards & Tech., ``De- Identification of Personal Information (2015),'' available at http://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf (using ``adversary'' to refer to an entity attempting to re-identify data). --------------------------------------------------------------------------- In the HMDA context, the Bureau is concerned about two re- identification scenarios. First, an adversary may use common data fields to match a HMDA record to a record in another dataset that contains the identity of the applicant or borrower. Second, an individual may rely on pre-existing personal knowledge to recognize an applicant or borrower's record in the unmodified HMDA data. Under the first scenario, it may be possible to match a HMDA record to a record from an identified dataset directly, or data fields from additional datasets may need to be matched to the HMDA record to complete the match to the identified record. However, successfully re- identifying a HMDA record would require several steps and may present a significant challenge. First, an adversary generally would have to isolate a record that is unique within the HMDA data. A HMDA record is unique when the values of the data fields associated with it are shared by no other HMDA record. But a HMDA record's uniqueness alone would not automatically result in its re-identification; an adversary would have to find a record corresponding to the applicant or borrower in another dataset that shares data fields with the unique HMDA record that permit the records to be matched. Once a unique HMDA record has been matched to a corresponding record, an adversary would possess any additional fields found in the corresponding record but not found in the HMDA record, such as the identity of the applicant or borrower.\52\ However, even after accomplishing such a match, an adversary might not have accurately re-identified the true applicant or borrower to whom the HMDA record relates.\53\ --------------------------------------------------------------------------- \52\ If the corresponding record lacks the name of the applicant or borrower, an adversary may be able to use data fields from the corresponding record to match to a record in another identified dataset. \53\ For example, if the corresponding record is not the only record in the other dataset that shares certain data fields with the unique HMDA record, an adversary would have to make a probabilistic determination as to which corresponding record belongs to the applicant or borrower. Also, depending on the coverage of the other dataset, a corresponding record may be unique in the other dataset but not unique in the general population. --------------------------------------------------------------------------- [[Page 44593]] The HMDA data that will be reported under the 2015 HMDA Final Rule, like the data reported under current Regulation C, contain data fields that create re-identification risk. First, the HMDA data display a high level of record uniqueness.\54\ As explained above, record uniqueness alone does not mean that a record can be re-identified, but a unique HMDA record could be matched to a corresponding record in another dataset that is available to an adversary. In the HMDA context, the Bureau believes that particularly relevant sources of identified data for matching purposes are publicly available real estate transaction records and property tax records. Although there is variance by jurisdiction, such records are often available electronically and typically identify a borrower through documents such as the mortgage or deed of trust. These documents typically include the loan amount, the financial institution, the unique identifier assigned to the mortgage originator, the borrower's name, and the property address, and may include other information. Because some of these data fields are also present in the HMDA data, the Bureau believes that the release of loan- level HMDA data without any modifications would create a risk that these public records could be directly matched to a HMDA record to re- identify an applicant \55\ or borrower. --------------------------------------------------------------------------- \54\ In 2005, researchers at the Board found that ``[m]ore than 90 percent of the loan records in a given year's HMDA data are unique--that is, an individual lender reported only one loan in a given census tract for a specific loan amount.'' Robert B. Avery et al., ``New Information Reported under HMDA and Its Application in Fair Lending Enforcement,'' at 367 Fed. Reserve Bulletin (Summer 2005), available at http://www.federalreserve.gov/pubs/bulletin/2005/3-05hmda.pdf. \55\ None of the public or private datasets discussed herein include information about applications that do not result in originated mortgage loans. The Bureau believes that the lack of public information about applications would significantly reduce the likelihood that an adversary could match the record of a HMDA loan application that was not originated to an identified record in another dataset. Therefore, the Bureau believes that the risk of re- identification to applicants is significantly lower than the risk to borrowers. However, some of the information contained in the unmodified HMDA data for applicants may permit an adversary to re- identify an applicant despite the lack of publicly available real estate records reflecting the transaction. For example, if an applicant withdraws an application and obtains a loan secured by the same property from another institution, it may be possible to link the HMDA data for the withdrawn application with the data for the origination, as much of the property and borrower information will be identical. --------------------------------------------------------------------------- Other publicly available sources of data similar to those included in the HMDA data that will be reported under the 2015 HMDA Final Rule include loan-level performance datasets made available by the Government-Sponsored Enterprises (GSEs) and mortgage-backed securities datasets made available by the Securities and Exchange Commission through the Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system.\56\ The loan-level performance datasets include data fields similar to those that will be included in the unmodified HMDA data, such as credit score, loan amount, interest rate, debt-to-income ratio, combined loan-to-value ratio, and loan-to-value ratio. The mortgage- backed securities dataset includes similar information, such as the credit score, loan amount, lien status, property value, and debt-to- income ratio. These datasets are available online with limited restrictions on access. But these datasets do not include the name of the borrower; as described above, this means that an adversary who is able to match a record in one of these datasets to a record in HMDA would need to make an additional match to an identified dataset to re- identify a borrower. And some of these datasets contain restrictions on use, such as a prohibition on attempting to re-identify individual borrowers.\57\ --------------------------------------------------------------------------- \56\ SE.C., ``Electronic Data Gathering, Analysis, and Retrieval (EDGAR),'' https://www.sec.gov/edgar.shtml (last visited January 26, 2017); Fannie Mae, ``Fannie Mae Single-Family Loan Performance Dataset,'' http://www.fanniemae.com/portal/funding-the-market/data/loan-performance-data.html (last visited Jan. 26, 2017); Freddie Mac, ``Single Family Loan-Level Dataset,''http://www.freddiemac.com/news/finance/sf_loanlevel_dataset.html (last visited Jan. 26, 2017); Ginnie Mae, ``Data Dictionaries,'' http://www.ginniemae.gov/investors/disclosures_and_reports/Pages/Disclosure-Data-Dictionaries.aspx (last visited Jan. 26, 2017). \57\ See, e.g., Freddie Mac, ``Terms for Single-Family Loan- Level Dataset Registration and Login Pages,'' https://freddiemac.embs.com/FLoan/HistoricalDataTerms.html (last visited Mar. 20, 2017). --------------------------------------------------------------------------- Private datasets that could be matched to the HMDA data are also available. For example, data brokers collect information about consumers from a wide range of sources and sell it for a variety of purposes, including marketing, identity verification, and fraud detection.\58\ These datasets typically include data collected from commercial, government, and other publicly available sources and may contain data about mortgage loan borrowers, including age, income, loan-to-value ratio, property value, loan amount, address, race, ethnicity, and origination date. Other datasets specific to mortgage loans are provided for purposes of evaluating mortgage-backed securities, identifying marketing opportunities, or analyzing market trends. These datasets may include loan amount, interest rate, credit score, negative amortization features, and closing date. Some of these datasets include the names of consumers, although others contain de- identified loan-level mortgage data. However, these datasets may contain contractual restrictions on use and re-disclosure, including prohibiting their use for re-identification purposes, and may be cost- prohibitive for many potential adversaries. --------------------------------------------------------------------------- \58\ See generally Fed. Trade Comm'n, ``Data Brokers: A Call for Transparency and Accountability,'' (May 2014), available at https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf (describing the types of products offered and the data sources used by data brokers). --------------------------------------------------------------------------- In addition to considering the steps an adversary would need to complete to re-identify the HMDA data and the various data sources that may be required to accomplish re-identification, including their limitations, the Bureau also has considered the capacity, incentives, and characteristics of potential adversaries, including those that may attempt re-identification for harmful purposes. The Bureau believes that some potential adversaries may be interested in re-identifying the HMDA data for marketing or other commercial purposes. For example, the unmodified HMDA data contain information about applicants and borrowers, and features of the loans they obtained or applied for, that the Bureau believes would have commercial appeal for marketing and advertising. Although extensive data about identified consumers is already available to marketers, the Bureau believes that at least some of the HMDA data that may be useful to marketers are typically not publicly available from any source for marketing purposes, are available in limited circumstances,\59\ or may be less reliable or precise than the HMDA data may be perceived to be.\60\ These potential adversaries could possess the resources to use private [[Page 44594]] datasets in addition to publicly available records to re-identify the HMDA data. However, the Bureau has considered the extent to which much of the commercial benefit to be obtained by re-identifying the HMDA data may be more readily available from private datasets to which these potential adversaries already have access without the need for recourse to the HMDA data. In many cases, information from other datasets may be timelier than that found in the HMDA data, where the delay between action taken on a loan and disclosure of the loan-level HMDA data ranges from 3 to 15 months. Further, some of these potential adversaries may refrain from re-identifying the HMDA data for reputational reasons or because they have agreed to restrictions on using data from the additional datasets described above for re- identification purposes. --------------------------------------------------------------------------- \59\ For example, a marketer currently may obtain from a consumer reporting agency a ``prescreened'' list of consumers meeting certain criteria, such as a minimum credit score, only for the purpose of making a ``firm offer of credit or insurance.'' 15 U.S.C. 1681b(c), 1681a(l). \60\ For example, private datasets may only contain an estimate of the household income, while the HMDA data contains the gross annual income relied on by the financial institution, which may be more accurate. --------------------------------------------------------------------------- Additionally, although most academics, researchers, and journalists use HMDA data only for HMDA purposes or market monitoring, some may be interested in re-identifying the HMDA data for purposes of research. These persons may differ in their capacity to re-identify an applicant or borrower in the HMDA data. The Bureau believes that those who lack resources are likely to attempt to match a HMDA record to publicly available datasets such as real estate transaction records, while those with relatively greater resources may also rely on private datasets. However, as mentioned above, some private datasets may have contractual terms prohibiting their use for re-identification purposes. Further, those academics or journalists with significant resources may be affiliated with organizations that have reputational or institutional interests that would not be served by re-identifying the HMDA data. These factors may reduce the risk of re-identification by such persons. The Bureau has considered whether parties intending to commit identity theft or financial fraud may have the incentive and capacity to re-identify the HMDA data. As discussed further below, the Bureau believes that the HMDA data would be of minimal use for these purposes. For example, the HMDA data will not include information typically required to open new accounts in a consumer's name, such as Social Security number, date of birth, place of birth, passport number, or driver's license number, nor will they include information useful to perpetrate existing account fraud, such as account numbers or passwords. Further, these potential adversaries are not law abiding and may have easier, albeit illegal, ways to secure data for these purposes than attempting to re-identify loan-level HMDA data. The resources of these potential adversaries likely vary, so some may be able to use private datasets in addition to publicly available records to re- identify the HMDA data were they to attempt to do so. In addition to the possibility of re-identifying borrowers through matching HMDA data to other datasets, some potential adversaries may be able to re-identify a particular applicant or borrower in the HMDA data by relying on personal knowledge about the applicant or borrower. As noted above, the Bureau believes that the HMDA data display a high level of record uniqueness, and the unmodified HMDA data include location and demographic information, such as race, sex, ethnicity, and age, that may be known to a potential adversary who is familiar with a specific applicant or borrower. Therefore, such a potential adversary may be able to re-identify a known applicant or borrower even if traditionally identifying information is not disclosed and without attempting to match a HMDA record to an identified record. This potential adversary could include a neighbor or acquaintance of the applicant or borrower, and the interest in re-identification may range from mere curiosity to the desire to embarrass or otherwise harm the applicant or borrower. Although these potential adversaries may lack the sophistication or resources required to re-identify a HMDA record by matching it to other datasets, they may possess a high level of specific knowledge about the characteristics of a particular applicant or borrower. Because the pre-existing personal knowledge possessed by such a potential adversary is typically limited to information about a single individual, or a small number of individuals, any re- identification attempt by such a potential adversary would likely target or impact a limited number of individuals. Although the Bureau believes that location and demographic information may be more likely to be known than other information in the HMDA data, it is impossible to predict the exact content of any pre-existing personal knowledge that such a potential adversary may possess. This uncertainty creates challenges for evaluating the degree to which individual data fields contribute to the risk of re-identification by such a potential adversary.\61\ --------------------------------------------------------------------------- \61\ For example, although the Bureau is aware of no dataset with detailed information on mortgage loan applicants, an adversary with personal knowledge of an applicant could identify an applicant in the HMDA data. --------------------------------------------------------------------------- Risk of Harm or Sensitivity The Bureau has considered whether, if a loan-level record in the HMDA dataset were re-identified, HMDA data that will be reported under the 2015 HMDA Final Rule would disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. To the extent a HMDA record could be associated with an identified applicant or borrower and could also be successfully matched to another de-identified dataset to re-identify such a dataset, harmful or sensitive information in that dataset that is not otherwise public may also be disclosed. The Bureau has considered whether the HMDA data could be used for harmful purposes such as perpetrating fraud or identity theft against an applicant or borrower or for targeted marketing of products and services that may pose risks that are not apparent. The Bureau has also considered whether certain HMDA data fields may be viewed as sensitive if associated with a particular applicant or borrower, even where the disclosure of the data field is unlikely to lead to financial or other tangible harms. In evaluating the potential sensitivity of a data field, the Bureau has also considered whether disclosure of the data field could cause dignity or reputational harm or embarrassment, or could be considered outside of societal or cultural expectations with respect to what information is available to the general public. As noted above, today, significant amounts of identifiable data concerning consumers is available to the general public, including in public records. Identifiable consumer information is also available from commercial data sources with varying barriers to access and restrictions on use. In evaluating the risk of harm or sensitivity created by the public disclosure of loan-level HMDA data, the Bureau's analysis has considered the degree to which such disclosure would increase these risks to applicant and borrower privacy compared to the risks that already exist, absent the public availability of the data in HMDA. Accordingly, the Bureau has considered whether the data that will be reported under the 2015 HMDA Final Rule are typically publicly available in an identifiable form and, if so, any barriers to accessing the information or restrictions on its use. Depending on the nature and extent of the public availability of a particular data field, the Bureau generally considers public [[Page 44595]] availability to reduce any risk of harm or sensitivity that may be created by the public disclosure of the data field in the loan-level HMDA data. For example, although some borrowers may consider the amount of their mortgage to be sensitive, the Bureau believes that this information is often publicly available and considers such availability to reduce the risk of harm or sensitivity that may be created by the disclosure of this unmodified data field in the HMDA data. In other words, if potentially harmful or sensitive information about an applicant or borrower is already available to the general public, disclosure of that information in the loan-level HMDA data creates less risk of additional harm or sensitivity than if the data were otherwise not publicly available about the applicant or borrower. In evaluating the risk of harm or sensitivity created by the disclosure of the loan-level HMDA data, the Bureau also has considered the likelihood that the loan-level HMDA data would be re-identified and used for harmful purposes or to embarrass or damage the reputation of an applicant or borrower. As discussed above, the Bureau generally believes that successful re-identification of loan-level HMDA data would require several steps and may represent a significant challenge. Even where an adversary is able to match a HMDA record to a record in an identified dataset, the adversary still may not have accurately identified the true applicant or borrower to whom the HMDA record relates. To the extent that the risk that re-identification would be accomplished is low, the risk of disclosing harmful or sensitive information is reduced. The Bureau believes that the unmodified loan-level HMDA data that will be reported under the 2015 HMDA Final Rule would be of minimal use for purposes of perpetrating identity theft or financial fraud against applicants and borrowers. As noted above, the HMDA data will not include information typically required to open new accounts in a consumer's name, such as Social Security number, date of birth, place of birth, passport number, or driver's license number, nor do they include information useful to perpetrate existing account fraud, such as account numbers or passwords.\62\ Although almost any information relating to an individual could at least theoretically be used by an adversary seeking to steal the identity of or commit fraud against the individual, the Bureau does not believe that disclosure of the HMDA data would be likely to increase information available for these purposes. For example, the HMDA data will include the name of the financial institution and other details about the loan terms that could be used in a phishing attack against an applicant or borrower by a perpetrator pretending to be the financial institution,\63\ but data that could be used for this purpose are often already available in publicly available real estate transaction records. The Bureau has also considered whether the HMDA data could be used for knowledge-based authentication purposes,\64\ but believes the data are unlikely to increase information available that is typically used for such purposes. --------------------------------------------------------------------------- \62\ As noted above, however, to the extent a HMDA record could be associated with an identified applicant or borrower and could also successfully be matched to a de-identified dataset to re- identify such a dataset, harmful or sensitive information in that dataset that is not otherwise public may also be disclosed. \63\ Phishing is an attempt by a perpetrator to obtain sensitive information, such as account numbers or passwords, by masquerading as a legitimate company. Phishing is typically conducted by fraudulent email messages appearing to come from a legitimate company that direct the recipient to a spoofed Web site or otherwise get the recipient to divulge private information. The perpetrators then use this private information to commit identity theft. \64\ Knowledge-based authentication (KBA) is a method of authentication which seeks to prove the identity of someone accessing a service, such as an account at a financial institution. KBA requires the knowledge of information about a particular individual to prove that a person attempting to access a service is the individual. ``Static'' KBA, also known as ``shared secrets,'' relies on information initially shared by the individual to the provider of the service, such as an answer to a question, which is later retrieved when an individual seeks to access the service. ``Dynamic'' KBA uses knowledge questions to verify identity but does not require the individual to have provided the questions and answers beforehand. Dynamic KBA questions are compiled from data known to or obtained by the institution, such as transaction history or data from credit reports. --------------------------------------------------------------------------- The Bureau believes that some of the unmodified loan-level HMDA data would provide information that is not already public and could be used to target applicants and borrowers for marketing, including marketing for products and services that may pose risks that are not apparent. As noted above, the unmodified HMDA data would provide information about an applicant's or borrower's financial condition and, with respect to a borrower, details about the loan obtained. The Bureau believes that, at least for a period of time after the loan-level HMDA data are disclosed, this information may be useful to those looking to offer financial products and services or otherwise improve market segmentation. Although these data could be used to market products and services that would be beneficial for applicants and borrowers, perhaps increasing competition among lenders that could help consumers receive the best loan terms possible, they could also be used to target potentially vulnerable consumers with marketing for products and services that may pose risks that are not apparent. For example, certain information about a loan might be perceived to reveal information about a borrower's sophistication as a consumer of financial products and services, and information about a borrower's financial condition may suggest vulnerability to scams relating to debt relief or credit repair. Finally, the Bureau believes that some of the unmodified loan-level HMDA data that will be reported to the agencies under the 2015 HMDA Final Rule would be considered sensitive by most consumers. In assessing whether a data field creates a risk of sensitivity, the Bureau has considered if its disclosure could lead to dignity or reputational harm or embarrassment, or could be considered outside of societal or cultural expectations with respect to what information is available to the general public. Balancing Risks and Benefits In applying the balancing test, the Bureau has considered the risks to applicant and borrower privacy interests that would be created by the public disclosure of the unmodified loan-level HMDA data that will be reported under the 2015 HMDA Final Rule and the benefits of such disclosure in light of HMDA's purposes. As discussed above, assessing risks to applicant and borrower privacy under the balancing test requires an evaluation of the unmodified HMDA dataset as a whole and of the individual data fields contained in the dataset. In developing this proposal, the Bureau reviewed the contribution of each data field, individually and in combination, toward the potential re-identification of an applicant or borrower in the HMDA dataset. As described above, for purposes of the HMDA balancing test, a significant re- identification risk is created by uniqueness in the HMDA data among data fields that are also found in other records that identify an applicant or borrower. The Bureau has reviewed the availability of public records in several jurisdictions and has also considered qualitative factors such as the capacity, incentives, and characteristics of potential adversaries that may be interested in re- identification, the public availability of HMDA data fields in other datasets, the barriers to obtaining these datasets, and [[Page 44596]] the degree to which the other datasets are identifiable. The Bureau has also considered whether certain data fields may be more likely than others to be known by a potential adversary with personal knowledge about the applicant or borrower. The Bureau also considered whether disclosure of the loan-level HMDA data, if it were to be re-identified, would reveal information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. As described above, this consideration involved reviewing the potential for disclosure to cause financial fraud or identity theft, harmful targeted marketing, or sensitivity concerns. The Bureau considered the nature of potential harms that might result from disclosure of each data field individually and in combination, and the strength of the field's contribution to such harms. The Bureau also considered whether each data field is typically publicly available in identified records and, if so, any barriers to accessing the information or restrictions on its use. In addition, the Bureau evaluated the contribution of the data fields, both individually and in combination, toward the purposes of HMDA: Helping to determine whether financial institutions are serving the housing needs of their communities; assisting public officials in distributing public-sector investment so as to attract private investment to areas where it is needed; and assisting in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Every HMDA data field provides benefits to achieving the statutory purposes, but different data fields may provide more value for certain statutory purposes or types of analyses. Data fields were examined for both current and potential uses. For data fields the public disclosure of which the Bureau preliminarily believes would create risks to applicant and borrower privacy interests, either because a field increases re-identification risk or poses a risk of harm or sensitivity, the Bureau has weighed these risks against the benefits of disclosure. Where the Bureau has preliminarily determined that the disclosure of an individual data field, alone or in combination with other fields, would create risks to applicant and borrower privacy that are not justified by the benefits of disclosure to HMDA's purposes, the Bureau has considered whether it could appropriately balance the privacy risks and disclosure benefits through strategies such as binning, rounding, and top- and bottom- coding,\65\ or whether the public dataset should be modified by excluding the field. The Bureau has also evaluated the risks and benefits of disclosing a data field in light of the proposed modifications considered for the other data fields. The Bureau is mindful of the connection between the risk of re-identification and the risk of harm or sensitivity. To the extent that the risk of re- identification created by disclosure of the HMDA data is reduced, the risk of disclosing harmful or sensitive information is also reduced. Conversely, to the extent that the public loan-level HMDA data do not disclose information that is harmful or sensitive, the consequences of re-identification are reduced. Where the Bureau has preliminarily determined that some modification of a data field is appropriate, the Bureau's consideration of the available forms of modification for the HMDA data is also informed by the operational challenges associated with various forms of modification and the need to make financial institutions' modified loan/application registers available to the public by March 31 following the calendar year for which the data are reported.\66\ --------------------------------------------------------------------------- \65\ Binning, sometimes known as recoding or interval recoding, allows data to be shown clustered into ranges rather than as precise values. Top- and bottom-coding masks the precise values of a data field that appear above or below a certain threshold. \66\ As discussed below in part IV.B, the Bureau will make a modified loan/application register for each financial institution available on its Web site by March 31 following the calendar year for which the information was compiled. With respect to data compiled in 2018 or later, this proposed Policy Guidance describes the modifications the Bureau proposes to apply to each financial institution's modified loan/application register, with the possible exception of modifications to reflect whether the loan amount is above the applicable dollar amount limitation on the original principal obligation in effect at the time of application or origination as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2), which may be disclosed later than March 31. HMDA data is reported by March 1 of the year following the calendar year for which the information was compiled, leaving the Bureau as little as 30 days to prepare each financial institution's modified loan/ application register. --------------------------------------------------------------------------- B. Application of the Balancing Test to Loan-Level HMDA Data As described above, the Bureau has interpreted HMDA to require that public HMDA data be modified when the release of the unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such release to the public in light of HMDA's purposes. Based on its analysis to date, the Bureau believes that public disclosure of the unmodified loan-level data that will be reported to the agencies under the 2015 HMDA Final Rule, as a whole, would create risks to applicant and borrower privacy interests under the HMDA balancing test. This is due to the presence in the data of individual data fields that the Bureau believes would create re- identification risk and the presence of individual data fields that the Bureau believes would create a risk of harm or sensitivity. The Bureau has applied the balancing test to determine whether and how to modify the HMDA data that will be reported under the 2015 HMDA Final Rule before it is disclosed to the public and is seeking comment on its proposed modifications. For the reasons discussed below, based on its application of the balancing test, the Bureau proposes to exclude or otherwise modify the following data fields in the loan-level HMDA data disclosed to the public: Universal loan identifier (ULI), application date, loan amount, action taken date, property address, age, credit score, debt-to-income ratio, property value, the unique identifier assigned by the Nationwide Mortgage Licensing System and Registry for the mortgage loan originator (NMLS ID); and automated underwriting system (AUS) result. The Bureau also proposes to exclude the content of free-form text fields used in certain instances to report the following data: Race, ethnicity, name and version of credit score model, reason for denial, and AUS system name. The Bureau proposes to publicly disclose without modification the remaining data reported to the agencies under the 2015 HMDA Final Rule. As discussed above, HMDA and Regulation C require the FFIEC to make available to the public certain aggregated data. The Bureau, in consultation with the other agencies, intends to evaluate options for providing the HMDA data, including the modified data, to the public in aggregated form, including through the aggregated data products the FFIEC is required to make available and other vehicles.\67\ --------------------------------------------------------------------------- \67\ See part IV.C, below. --------------------------------------------------------------------------- The Bureau acknowledges that the proposed modifications would not completely eliminate risks to applicant and borrower privacy that would likely be created by the disclosure of loan-level HMDA data, but the Bureau believes that these modifications would reduce such risks to the extent necessary to appropriately balance them with the benefits of disclosure for HMDA's purposes. The Bureau believes that, to the extent that the public disclosure of the loan-level HMDA data, modified as proposed, would create risks to applicant and borrower privacy, such risks would be justified by the benefits of such release to the public in light of HMDA's purposes. [[Page 44597]] The Bureau has considered whether, in light of what it believes to be a reduced risk of re-identification for HMDA records reflecting an application where no loan was originated, more data could be disclosed without modification for those records. As discussed above, the Bureau believes that the lack of publicly available information about applications would make it significantly more difficult for an adversary to re-identify an applicant by matching a HMDA record to a record from an identified dataset. However, the Bureau believes that some risk of re-identification by matching may remain in some circumstances,\68\ and notes that an adversary's personal knowledge may also permit re-identification of an application record. Further, the possibility that transactions could be reported as applications in error and be subsequently corrected in a resubmission would create risk that the previously-applied modifications would no longer be appropriate; the previously-disclosed HMDA data would have revealed information creating risks to applicant and borrower privacy that would not be justified by the benefits of disclosure. Finally, an approach requiring that different types of records in the dataset are subject to different modifications would be operationally challenging and costly to implement. In light of these privacy and operational concerns, the Bureau is not proposing this approach at this time, but invites comment on it. --------------------------------------------------------------------------- \68\ See supra note 53. --------------------------------------------------------------------------- The Bureau seeks comment on all aspects of its analysis and the modifications it proposes to apply to the public loan-level HMDA dataset under the balancing test. The Bureau notes that, even after it finalizes this Policy Guidance, it intends to continue to monitor developments affecting the application of the balancing test to the HMDA data. The privacy landscape is constantly evolving, and risks to applicant and borrower privacy created by the disclosure of loan-level HMDA data may change as the result of technological advances and other external developments. For example, a new source of publicly available records may become available, increasing or decreasing privacy risks under the balancing test, or the Bureau may discover evidence suggesting that individuals are using the HMDA data in unforeseen, potentially harmful ways. Potential uses of the loan-level HMDA data in furtherance of the statute's purposes may also evolve, such that the benefits associated with the disclosure of certain data may increase to an extent that justifies providing more information to the public. For example, a new loan program may emerge with debt-to-income ratio requirements that increase the benefits of releasing more precise information about the debt-to-income ratios of applicants or borrowers than the Bureau proposes herein to release. Such developments and other changed circumstances may require that, even after this proposed Policy Guidance is finalized, the Bureau revisit the conclusions previously reached based on the application of the balancing test in order to ensure the appropriate protection of applicant and borrower privacy in light of HMDA's purposes. The Bureau is proposing this Policy Guidance to provide transparency, obtain public feedback, and improve the Bureau's decisionmaking. This proposed Policy Guidance and any final Policy Guidance concerning the public disclosure of loan-level HMDA data are non-binding in part because flexibility to revise the modifications proposed to apply to the public loan-level HMDA data is necessary to maintain a proper balancing of the privacy risks and benefits of disclosure, especially in the event the Bureau becomes aware of new facts and circumstances that might contribute to privacy risks. However, except where not practical, unnecessary, or where public interest requires otherwise, the Bureau intends to seek public input on any future revisions to modifications to the public loan-level HMDA it might consider. Data To Be Disclosed in the Loan-Level HMDA Data Without Modification As discussed above, the 2015 HMDA Final Rule requires financial institutions to report information about originations and purchases of mortgage loans, as well as mortgage loan applications that do not result in originations. The Bureau proposes to disclose the following data fields to the public as reported, without modification:\69\ --------------------------------------------------------------------------- \69\ As mentioned above and discussed further below, the Bureau proposes not to disclose free-form text fields used in certain instances to report the following data: The name and version of the credit scoring model, race, ethnicity, reasons for denial, and AUS name. --------------------------------------------------------------------------- The following information about applicants, borrowers, and the underwriting process: Income, sex, race, ethnicity, name and version of the credit scoring model, reasons for denial, and AUS name. The following information about the property securing the loan: Census tract, State, county, occupancy type, construction method, manufactured housing secured property type, manufactured housing land property interest, and total units. The following information about the application or loan: Loan term, loan type, loan purpose, application channel, whether the loan was initially payable to the financial institution, whether a preapproval was requested, action taken, type of purchaser, lien status, prepayment penalty term, introductory rate period, interest rate, rate spread, total loan costs or total points and fees, origination charges, total discount points, lender credits, HOEPA status, balloon payment, interest-only payment, negative amortization, other non-amortizing features, combined loan-to-value ratio, open-end line of credit flag, business or commercial flag, and reverse mortgage flag. The following information about the lender: Legal Entity Identifier (LEI), and financial institution name.\70\ --------------------------------------------------------------------------- \70\ See 12 CFR 1003.4(a)(2)-(7), (a)(8)(i), a(9)(ii), (a)(10)(i), (a)(10)(iii), (a)(11)-(14), (a)(15)(i) (name of scoring model), (a)(16)-(22), (a)(24)-(27), (a)(29)-(33), (a)(35)(i) (name of system), (a)(36)-(38) (effective Jan. 1, 2018). --------------------------------------------------------------------------- Many of these data fields were adopted in the 2015 HMDA Final Rule, while several are already required to be reported under current Regulation C. All of the data fields required by current Regulation C listed above are currently disclosed as reported without modification in the modified loan/application register that each financial institution makes available to the public and in the agencies' loan- level release.\71\ For the reasons discussed below, the Bureau proposes to publicly disclose the data fields listed above without modification in the loan-level HMDA data and requests comment on its proposal. --------------------------------------------------------------------------- \71\ The only data fields excluded from the public loan-level HMDA data under current Regulation C are the identifying number for the loan or loan application, the application date, and the action taken date. --------------------------------------------------------------------------- With the exception of LEI, financial institution name, census tract, income, action taken (where the loan is denied), and reasons for denial, which are discussed further below, the Bureau believes that disclosure of the data fields listed above would likely present low risk to applicant and borrower privacy. First, the Bureau believes that, if the HMDA data were re-identified, disclosure of most of these data fields would likely create minimal, if any, risk of harm or sensitivity to applicants or borrowers. These fields include basic information about the features of the loan or the property securing the loan--such as the application channel, loan term, and lien status-- rather than information about personal [[Page 44598]] characteristics or financial condition of the applicant or borrower, and the Bureau believes that applicants and borrowers are unlikely to consider the disclosure of this information to be sensitive. Further, the Bureau is aware of no clear advantage provided by most of these data fields for targeted marketing of products and services that may pose risks that are not apparent. The Bureau believes that certain fields about the loan, such as the pricing data fields, and certain fields about the borrower, such as ethnicity and race, may create relatively more risk of harm or sensitivity, but that these fields still present low privacy risk. Second, the Bureau believes that disclosure of most of these data fields would likely create minimal, if any, risk of substantially facilitating the re-identification of applicants and borrowers in the HMDA data. Most of these data fields are not found in publicly available sources of records that contain the identity of an applicant or borrower; without such an identified publicly available record, an adversary would experience substantial difficulty attempting to re-identify an applicant or borrower by matching a HMDA record using these data fields. Certain data fields may create relatively more risk of re-identification because they contain values that are not widely shared among applicants or borrowers, such as an ethnic and racial category, but the Bureau believes these fields still present low re-identification risk.\72\ As described above, public disclosure of these low-risk data fields benefits users in determining whether financial institutions are serving the housing needs of their communities; in distributing public-sector investment so as to attract private investment to areas where it is needed; and in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. To the extent that disclosure of these fields would create risk to applicant and borrower privacy, the Bureau believes the risks would be justified by the benefits of disclosure. --------------------------------------------------------------------------- \72\ Although the Bureau believes that ethnic and racial categories are not found in publicly available sources of identified records, comparing the ethnicity and race found in the HMDA record to the surname found in an identified public record may help an adversary narrow the range of public records against which to match a HMDA record. Information on surnames, in other contexts, has proven useful to proxy for ethnicity or race. The Bureau also believes that ethnicity and racial category may be more likely to be known by adversaries with personal knowledge of the applicant or borrower than other fields listed above. The Bureau seeks comment in particular on whether this risk is heightened with respect to disaggregated ethnicity and race and whether these disaggregated fields should be treated differently than aggregated ethnicity and race. --------------------------------------------------------------------------- The Bureau believes that disclosure of the following data fields listed above would likely substantially facilitate the re- identification of applicants or borrowers: LEI, financial institution name, and census tract. The Bureau believes that publicly available real estate transaction records such as mortgages and deeds of trust typically contain the identity of the borrower, the name of the financial institution, and the property address, from which an adversary may derive the census tract. Although the uniqueness of a HMDA record will vary by census tract, the Bureau believes that these data fields could be used by an adversary to match a HMDA record to an identified public record. The Bureau also believes that, if the HMDA data were re-identified, disclosure of the following data fields listed above would likely create a risk of harm or sensitivity: Income, action taken (where the loan is denied), and reasons for denial. These data fields are not otherwise available to the general public in an identified form without barriers to access or use restrictions.\73\ The Bureau believes that these data fields would likely be considered sensitive by many if not most consumers. Many consumers avoid sharing their incomes, even with personal acquaintances.\74\ The fact that a financial institution denied an application and some of the reasons for denial, such as employment history, credit history, debt-to-income ratio, or insufficient cash, could reveal negative details about a consumer's personal financial situation.\75\ The Bureau also believes that these data fields could be used for harmful purposes, such as targeted marketing of products and services that may pose risks that are not apparent. --------------------------------------------------------------------------- \73\ The Bureau believes that, although estimates of income may be available in private datasets, reliable income information typically is not available to the general public without barriers to access or use restrictions. The HMDA data will include the gross annual income relied on in making the credit decision, which may be more accurate. \74\ The Bureau believes that consumers may still consider income information to be sensitive even though it is rounded to the nearest thousand when reported by financial institutions. \75\ The Bureau notes that the fact that a loan was denied and the reasons for denial are reported only for applications that have been denied. As discussed above, the Bureau believes that the risk of re-identification of applicants where a loan is not originated is significantly lower than the risk to borrowers. Because these data fields are difficult to associate with an identified applicant or borrower, the Bureau believes that the risk of harm or sensitivity created by their disclosure is reduced. --------------------------------------------------------------------------- The Bureau nonetheless believes that these risks to applicant and borrower privacy are justified by the benefits of disclosure in light of HMDA's purposes. For years, these data fields have proven critical for furthering HMDA's purposes.\76\ For example, the ability to identify the financial institution by name is critical for users to evaluate the lending practices of a financial institution.\77\ The census tract is essential for users to determine the availability of credit in certain communities and to identify potentially discriminatory lending patterns at the community level. Information about income ensures that users who are evaluating potential disparities in underwriting or pricing are comparing applicants or borrowers with similar incomes, thereby controlling for a factor that might provide a legitimate explanation for such disparities. Income data can also allow users to determine the availability of credit to consumers and communities of various income levels. Finally, action taken and reasons for denial, combined with underwriting information, help users compare the outcomes received by applicants and borrowers to identify potential disparities between similarly qualified applicants. The reasons for denial also help users understand why a particular loan application was denied and identify potential barriers in access to credit. --------------------------------------------------------------------------- \76\ Several data fields adopted in the 2015 HMDA Final Rule are closely related to, or extensions of, data fields reported under current Regulation C. Specifically, the LEI will replace the current reporter's ID, and reasons for denial may currently be reported at the option of the financial institution. However, financial institutions supervised by the OCC and the FDIC currently are required by those agencies to report denial reasons. 12 CFR 27.3(a)(1)(i), 128.6, 390.147. \77\ The LEI would enhance identification by allowing users to link the reporting financial institution to its corporate family. If the financial institution name is publicly disclosed, the LEI creates minimal, if any, additional privacy risk. --------------------------------------------------------------------------- The Bureau believes that, under the balancing test, the benefits of public disclosure of these data fields to HMDA's purposes would justify the risks to applicant and borrower privacy such disclosure would likely create. In forming its proposal to publicly disclose these data fields without modification, the Bureau considered modifications that would reduce the risks to applicant and borrower privacy while preserving the benefits of disclosure. However, with the exception of income and census tract, which have for years proven critical for furthering HMDA's purposes, no modifications other than exclusion from the public loan-level HMDA data are reasonably available for these data fields. Therefore, modification in these circumstances [[Page 44599]] would eliminate public utility of these data fields entirely. The Bureau seeks comment on its proposal to publicly disclose these fields without modification in the loan-level HMDA data. Data To Be Excluded or Otherwise Modified in the Loan Level HMDA Data Universal Loan Identifier The 2015 HMDA Final Rule requires financial institutions to report a universal loan identifier (ULI) for each covered loan or application that can be used to identify and retrieve the application file.\78\ The 2015 HMDA Final Rule sets forth detailed requirements concerning the ULI to be assigned and reported.\79\ A ULI must begin with the financial institution's LEI, followed by up to 23 additional characters to identify the covered loan or application, and then end with a two- character check digit calculated according to the methodology prescribed in appendix C of the 2015 HMDA Final Rule.\80\ In addition, a ULI must be unique within the institution and must not contain any information that could be used to directly identify the application or borrower.\81\ Institutions reporting a loan for which a ULI was previously assigned and reported must report the ULI that was previously assigned and reported for the loan. The ULI will be submitted as an alphanumeric field.\82\ The requirement to report a ULI replaces the requirement under current Regulation C that a financial institution report an identifying number for the loan or loan application.\83\ The loan or loan application number is currently excluded from both the modified loan/application register that each financial institution makes available to the public and the agencies' loan-level release. The Bureau added the requirement to report a ULI to implement the Dodd-Frank Act's amendment to HMDA providing for the collection and reporting of, ``as the Bureau may determine to be appropriate, a universal loan identifier.'' \84\ --------------------------------------------------------------------------- \78\ 12 CFR 1003.4(a)(1)(i) (effective January 1, 2018). \79\ Id. \80\ 12 CFR 1003.4(a)(1)(i)(A) through (C). \81\ 12 CFR 1003.4(a)(1)(i)(B)(3). \82\ Bureau of Consumer Fin. Prot., ``Filing instructions guide for HMDA data collected in 2018--OMB Control #3170-0008,'' at 14, 48 (Jan. 2017), available at http://www.consumerfinance.gov/data-research/hmda/static/for-filers/2018/2018-HMDA-FIG.pdf. \83\ See 12 CFR 1003.4(a)(1). \84\ 12 U.S.C. 2803(b)(6)(G). --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that, depending on how financial institutions will use ULIs once they are adopted for HMDA purposes, disclosing the ULI in the loan-level HMDA data could substantially facilitate the re-identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, until information is available concerning how financial institutions use ULIs other than for HMDA purposes, the Bureau proposes to modify the loan-level HMDA dataset made available to the public by excluding the ULI. A ULI would allow users to track over time a loan reported in HMDA data by different financial institutions. Using a ULI, a user could identify a loan originated by a HMDA reporter that is later purchased by another HMDA reporter, then sold and purchased again by yet another HMDA reporter. Understanding a loan's history would assist in identifying whether financial institutions are serving the housing needs of their communities. Widespread adoption of ULIs to identify mortgage loans in other datasets also could allow users to track a loan from ``cradle to grave,'' i.e., to link information disclosed in the public HMDA data with information found in other datasets, such as datasets reflecting loan performance. The Bureau believes that, depending on how financial institutions use ULIs other than for HMDA purposes, public disclosure of a ULI in the loan-level HMDA data could create a significant risk of re- identification. If financial institutions include ULIs on loan documents that are made publicly available, the Bureau believes that disclosure of the ULI in the public loan-level HMDA data would substantially facilitate the re-identification of HMDA records. As discussed above, many jurisdictions publicly disclose real estate transaction records in an identified form, such as mortgages and deeds of trust, and the Bureau believes that many financial institutions include loan numbers on these publicly-recorded documents.\85\ The Bureau believes that financial institutions may replace the loan numbers currently assigned to mortgage loans with ULIs \86\ and that, if they do, the ULI likely will be included on publicly-recorded loan documents. Especially in light of the uniqueness of a ULI, a ULI on a publicly-recorded loan document could be used to match a HMDA record to an identified public record directly and reliably. --------------------------------------------------------------------------- \85\ For example, in response to concerns about implications under the Gramm-Leach-Bliley Act (GLBA) of the ``longstanding common practice for a mortgage lender to place the borrower's account number on a mortgage loan document to enable the document to be tracked and place in the proper file once the document is recorded and returned from the recording office,'' Federal regulators issued guidance in 2001 opining that such practice does not violate the GLBA. See Letter from Fed. Reserve Board, Fed. Dep. Ins. Corp., Nat'l Credit Union Admin., Off. of the Comptroller of the Currency, Off. of Thrift Supervision, and Fed. Trade Comm'n (Sept. 4, 2001). \86\ In response to comments, the Bureau noted in the supplementary information to the 2015 HMDA Final Rule that a financial institution may use a ULI for both HMDA purposes and the loan identification number prescribed by Regulation Z Sec. 1026.37(a)(12). 80 FR 66128, 66177 (Oct. 28, 2015). --------------------------------------------------------------------------- The Bureau notes that the FFIEC excluded identifying numbers for loans and applications from the agencies' loan-level HMDA data release because the data field could be used to identify an applicant or borrower in the data.\87\ Similarly, Congress later identified applicant ``identification number'' as a field that the Board should consider deleting from the modified loan/application register in order to protect the privacy of applicants and borrowers.\88\ In implementing this amendment to HMDA, the Board required that financial institutions remove ``application or loan number'' from the modified loan/ application register before making it available to the public.\89\ --------------------------------------------------------------------------- \87\ The FFIEC noted that ``[a]n unedited form of the data would contain information that could be used to identify individual loan applicants'' and that the data would be edited prior to public release to remove the application identification number, the date of application, and the date of final action. 55 FR 27886, 27888 (July 6, 1990). \88\ HMDA section 304(j), added by the Housing and Community Development Act, section 932(a), 106 Stat. 3672, 3889 (1992). \89\ 12 CFR 1003.5(c). --------------------------------------------------------------------------- The Bureau believes that a ULI would disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. A ULI is associated with a particular application or loan. As noted above, the 2015 HMDA Final Rule prohibits a financial institution from including in a ULI assigned to an application or loan information about the applicant or borrower that could be used to directly identify the applicant or borrower. Commentary to this provision clarifies that ``information that could be used to directly identify the applicant or borrower includes but is not limited to the applicant's or borrower's name, date of birth, Social Security number, official government-issued driver's license or identification number, alien registration number, government passport number, or employer or taxpayer identification number.'' \90\ Although the Bureau [[Page 44600]] believes that financial institutions may include information within a ULI that is pertinent to the institution's operations, as some do now with respect to loan numbers, it does not believe that such information would be considered sensitive or could be used for harmful purposes. --------------------------------------------------------------------------- \90\ Comment 4(a)(1)(i)-2 (effective Jan. 1, 2018). --------------------------------------------------------------------------- The Bureau has considered whether a modification to the public loan-level HMDA dataset other than exclusion of the ULI would appropriately reduce the privacy risks created by the disclosure of the ULI in the loan-level data while maintaining some utility for HMDA's purposes. For example, the Bureau has considered whether it could, in the loan-level HMDA data disclosed to the public, replace the reported ULI with a different unique number, such as a hashed value.\91\ The Bureau also has considered whether it might use some other means to link HMDA records sharing the same ULI without revealing the ULI itself. The Bureau is unable to identify a feasible modification at this time, however. The Bureau believes at this time that, under the balancing test, excluding the ULI is a modification to the public loan- level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. --------------------------------------------------------------------------- \91\ A hashed value would be based on the ULI and created by a secure hash algorithm. A hash algorithm is designed to be non- invertible, meaning that the original value, in this case the actual ULI, could not be derived from the hashed value. The hashed value would only appear in the HMDA data; as it would not appear in public records, it could not be used to re-identify the HMDA record. --------------------------------------------------------------------------- Application Date The 2015 HMDA Final Rule requires financial institutions to report, except for purchased covered loans, the date the application was received or the date shown on the application form.\92\ This date will be submitted by financial institutions as the exact year, month, and day, in the format of YYYYMMDD.\93\ Financial institutions are required to report this data field under current Regulation C. The Board amended Regulation C in 1989 to require reporting of the date the application was received as part of its implementation of the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA), which expanded HMDA to include data on applications, as well as data on the race, gender, and income of individual applicants and borrowers.\94\ The application date is currently excluded from both the modified loan/application register that each financial institution makes available to the public and the agencies' loan-level release.\95\ --------------------------------------------------------------------------- \92\ 12 CFR 1003.4(a)(1)(ii) (effective Jan. 1, 2018). \93\ Supra note 83 at 49. \94\ Financial Institutions Reform, Recovery, and Enforcement Act, Public Law 101-73, section 1211, 103 Stat. 183, 524-26 (1989); 54 FR 51356 (Dec. 15, 1989). \95\ See 12 U.S.C. 2803(j)(2)(B)(i); 12 CFR 1003.5(c). --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that disclosing the application date in the loan-level HMDA data released to the public would likely substantially facilitate the re-identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA data made available to the public by excluding the date the application was received. The application date may be useful for identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. In enacting the FIRREA amendments to HMDA, Congress sought to improve the ability of HMDA users to identify possible discriminatory lending patterns by expanding HMDA to allow for comparison of accepted and rejected applications.\96\ The date of application furthered the purposes underlying this expansion. The application date helps ensure that users are comparing applicants or borrowers who applied for loans during similar dates, thereby controlling for factors that might provide a legitimate explanation for disparities, such as different market interest rates over different time periods. Users of HMDA data may also use the application date, in combination with the action taken date, to screen for delays between application and action dates that appear to exist on prohibited bases. --------------------------------------------------------------------------- \96\ H. Rept. 101-209, at 463-65 (1989). --------------------------------------------------------------------------- The Bureau believes that public disclosure of application date would likely substantially facilitate the re-identification of an applicant or borrower in the HMDA data. Disclosing the date of application would increase the ability of an adversary to associate a HMDA record with an applicant or borrower by matching it to an identified publicly available record. As discussed above, many jurisdictions publicly disclose real estate transaction records in an identified form, such as mortgages or deeds of trust. These records contain the date that the lender and borrower entered into or executed the agreement. This date is correlated with the application date data field, which reflects either the date the application was received or the date shown on the application form. Therefore, an adversary could use the date of application, combined with other data fields, to narrow the range of identified public records against which to compare the HMDA data, increasing the likelihood of matching records. The Bureau notes that the FFIEC excluded the application date from the agencies' loan-level HMDA data release because the data field could be used to re-identify a particular applicant or borrower in the data.\97\ Similarly, when Congress directed that the Board require deletions from the loan-level HMDA data financial institutions must make available to the public to protect the privacy of applicants and borrowers, it identified the application date in particular as one field to be considered for deletion.\98\ --------------------------------------------------------------------------- \97\ The FFIEC noted that ``[a]n unedited form of the data would contain information that could be used to identify individual loan applicants'' and that the data would be edited prior to public release to remove the application identification number, the date of application, and the date of final action. 55 FR 27886, 27888 (July 6, 1990). \98\ Housing and Community Development Act, Public Law 102-550, section 932(a), 106 Stat. 3672, 3889 (1992). --------------------------------------------------------------------------- If the HMDA data were re-identified, the Bureau believes that application date would likely disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. Application date is not an inherently sensitive data field. Unlike other dates, such as date of birth, the date of application contains no intrinsic connection to an individual. Instead, the information is associated with an applicant or borrower for only a single transaction in the context of mortgage lending. Further, the Bureau believes that the date of application would be unlikely to be used for targeted marketing of products and services that may pose risks that are not apparent. HMDA data is disclosed annually based on the calendar year in which action is taken on an application. Although the Bureau proposes not to disclose the application date, the year of the loan-level HMDA data will often correspond to the year in which the application was received. The Bureau considered binning the values reported for the application date into quarterly or semi-annual intervals. However, the Bureau believes that quarterly intervals would fail to reduce re- identification risk adequately and that, compared to not disclosing application date, the gains in data utility that semi-annual intervals might allow do not justify the increase in privacy risk. Disclosing the date of application in quarterly intervals would provide an individual with a [[Page 44601]] narrower range of identified public records against which to compare the HMDA data.\99\ And although disclosing application dates in semi- annual intervals would reduce re-identification risk as compared to quarterly intervals, the Bureau believes it would only marginally increase the utility over the current, annual intervals while still increasing privacy risk. Users would need a narrower range to help ensure that they were comparing applicants who applied under similar market conditions. The Bureau believes at this time that, under the balancing test, excluding the application date is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. --------------------------------------------------------------------------- \99\ The Bureau previously identified quarterly release of the loan-level HMDA data as a potential privacy concern. 80 FR 66128, 66243 (Oct. 28, 2015). --------------------------------------------------------------------------- Loan Amount The 2015 HMDA Final Rule requires financial institutions to report the amount of the covered loan or the amount applied for.\100\ For closed-end mortgage loans, open-end lines of credit, and reverse mortgages, this amount is the amount to be repaid as disclosed on the legal obligation, the amount of credit available to the borrower, and the initial principal limit, respectively. The loan amount will be submitted by financial institutions in numeric form reflecting the exact dollar amount of the loan.\101\ Financial institutions are required to report this data field under current Regulation C rounded to the nearest thousand.\102\ Although HMDA has always required financial institutions to report information about the dollar amount of a financial institution's mortgage lending activity,\103\ the Board amended Regulation C in 1989 to require reporting of the loan amount on a loan-level basis as part of its implementation of FIRREA.\104\ --------------------------------------------------------------------------- \100\ 12 CFR 1003.4(a)(7) (effective Jan. 1, 2018). \101\ Supra note 83, at 51. \102\ 12 CFR 1003, Appendix A, I.A.20. \103\ 12 U.S.C. 2803 \104\ 12 U.S.C. 2803 --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that disclosing the loan amount in the loan-level HMDA data released to the public would likely substantially facilitate the re-identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA dataset disclosed to the public by disclosing the midpoint for the $10,000 interval into which the reported loan amount falls and by indicating whether the loan amount exceeds the applicable dollar amount limitation on the original principal obligation in effect at the time of application or origination as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2) (``GSE conforming loan limit'').\105\ For example, for a reported loan amount of $117,834, the Bureau would disclose $115,000 as the midpoint between values equal to $110,000 and less than $120,000. --------------------------------------------------------------------------- \105\ The dollar amount limitation on the original principal obligation as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2) refers to the annual maximum principal loan balance for a mortgage acquired by Fannie Mae and Freddie Mac (the ``GSEs''). The Federal Housing Finance Agency is responsible for determining the maximum conforming loan limits for mortgages acquired by the GSEs. See Press Release, Fed. Hous. Fin. Agency, ``FHFA Announces Increase in Maximum Conforming Loan Limits for Fannie Mae and Freddie Mac in 2017'' (Nov. 23, 2016) https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Announces-Increase-in-Maximum-Conforming-Loan-Limits-for-Fannie-Mae-and-Freddie-Mac-in-2017.aspx. --------------------------------------------------------------------------- The loan amount is useful for determining whether financial institutions are serving the housing needs of their communities. By examining loan amount, users can better understand the amount of credit that financial institutions have made available to consumers in certain communities and the extent to which such institutions are providing credit in varying amounts. Loan amount is also beneficial for identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. For example, the loan amount allows users to divide the population of applicants or borrowers into segments that may be subject to different underwriting or pricing policies, such as those applying for non-conforming mortgage loans. Combined with the property value, the loan amount would also allow users to calculate a loan-to-value ratio, an important variable in underwriting. The loan amount and loan-to-value ratio would help ensure that users who are evaluating potential disparities in underwriting outcomes, pricing, or other terms and conditions are comparing applicants or borrowers who applied for or obtained loans with similar loan amount and loan-to- value ratios, thereby controlling for factors that might provide a legitimate explanation for disparities. The Bureau believes that disclosing the exact loan amount would likely substantially facilitate the re-identification of an applicant or borrower. The loan amount is a numeric data field that will often consist of at least six digits, which increases its contribution to the uniqueness of a particular HMDA record. As discussed above, this information is also found in identified real estate transaction records such as mortgages and deeds of trust that are publicly disclosed by many jurisdictions. Therefore, in many cases, an adversary could use the exact loan amount, combined with other fields, to match a HMDA record to an identified publicly available record. If the HMDA data were re-identified, the Bureau believes that loan amount would likely disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. In some cases, high loan amounts, combined with other information, may be considered sensitive or may indicate financial vulnerability that could form the basis for targeted marketing of products and services that may pose risks that are not apparent. The loan amount may also at least theoretically be used for phishing attacks. However, the Bureau believes that loan amount is often already included in identified publicly available documents, such as the mortgage or deed of trust. The Bureau believes that this existing public availability decreases any potential sensitivity and harmfulness of disclosing loan amount in the HMDA data. The Bureau believes that the loan-level HMDA data may be modified to appropriately reduce the privacy risks created by the public disclosure of the loan amount while preserving much of the benefits of the data field. The Bureau believes that disclosing the midpoint for the $10,000 interval into which the reported loan amount falls, and indicating whether the loan amount exceeds the applicable GSE conforming loan limit, provides enough precision to allow users to rely on loan amount to achieve HMDA's purposes. For example, $10,000 intervals will allow users to segment applicants and borrowers that may be subject to different underwriting or pricing policies. In fact, for intervals that include the applicable GSE conforming loan limit, an indication of whether the loan amount is above the applicable limit may provide greater precision than is provided by the loan-level HMDA data currently disclosed to the public, in which certain loan amounts above and below the applicable limit will round to the same thousand. $10,000 intervals will not allow users to calculate an exact loan-to-value ratio, although users may still derive an estimated loan-to-value ratio. However, the Bureau believes that releasing the combined [[Page 44602]] loan-to-value ratio, as it proposes to do, will be more beneficial for fair lending purposes than the loan-to-value ratio that users would have calculated from the exact loan amount and property value. Disclosing loan amount in $10,000 intervals also decreases the ability of adversaries to match HMDA data to identified public records by reducing the uniqueness of a data field common to both datasets. Because the Bureau is also proposing to modify reported property value similarly, adversaries will be unable to use the combined loan-to-value ratio to reduce the effectiveness of the proposed modification by deriving the reported loan amount. Although the proposed modifications do not entirely eliminate the risk of re-identification that the Bureau believes would likely be created by the disclosure of loan amount information, the Bureau believes that the remaining risk would be justified by the benefits of disclosing loan amount with the proposed modifications. Therefore, the Bureau believes at this time that, under the balancing test, modifying loan amount as described above appropriately balances the privacy risks and disclosure benefits. The Bureau seeks comment on this proposal, including the proposed $10,000 intervals to be used for binning, the proposal to disclose the midpoint for each interval, and the proposal to indicate whether the reported loan amount exceeds the applicable GSE conforming loan limit. Additionally, the Bureau seeks comment on whether to indicate that a reported loan amount exceeds the applicable limit for loans eligible for insurance by the Federal Housing Administration (FHA conforming loan limit).\106\ Factors not reflected in the HMDA data may affect the accuracy of any such indicator, such as whether the loan amount has been increased by the amount of any one-time or up-front mortgage insurance premium that will be financed as part of the loan, in which case the loan may be eligible for insurance despite appearing in the HMDA data to exceed the applicable FHA conforming loan limit.\107\ The Bureau seeks comment on the value of indicating whether the reported loan amount exceeds the FHA conforming loan limit in light of these limitations. --------------------------------------------------------------------------- \106\ See 24 CFR 203.18. \107\ 24 CFR 203.18c. --------------------------------------------------------------------------- Action Taken Date The 2015 HMDA Final Rule requires financial institutions to report the date of action taken by the financial institution on a covered loan or application.\108\ For originated loans, this date is generally the date of closing or account opening.\109\ Regulation C provides some flexibility in reporting the date for other types of actions taken, such as applications denied, withdrawn, or approved by the institution but not accepted by the applicant. For example, for applications approved but not accepted, a financial institution may report ``any reasonable date, such as the approval date, the deadline for accepting the offer, or the date the file was closed,'' provided it adopts a generally consistent approach.\110\ This date is submitted by financial institutions as the exact year, month, and day, in the format of YYYYMMDD.\111\ Financial institutions are required to report this data field under current Regulation C. As with the application date, the Board added the requirement to report the action taken date as part of the amendments to Regulation C that implemented FIRREA.\112\ The action taken date is also currently excluded from both the modified loan/ application register that each financial institution makes available to the public and the agencies' loan-level release.\113\ --------------------------------------------------------------------------- \108\ 12 CFR 1003.4(a)(8)(ii) (effective Jan. 1, 2018). \109\ Comment 4(a)(8)(ii)-5 (effective Jan. 1, 2018). \110\ Comment 4(a)(8)(ii)-4 (effective Jan. 1, 2018). \111\ Supra note 83, at 52. \112\ 54 FR 51356 (Dec. 15, 1989). \113\ See 12 U.S.C. 2803(j)(2)(B)(i); 12 CFR 1003.5(c). --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that disclosing the action taken date in the loan-level HMDA data released to the public would likely substantially facilitate the identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA dataset made available to the public by excluding the date of action taken by the financial institution. The action taken date may be useful for identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. The fair lending benefits provided by the date of action taken are similar to those provided by the date of application, described above. The action taken date helps ensure that users who are evaluating potential disparities in pricing or other terms and conditions are comparing applicants or borrowers who obtained loans on similar dates, thereby controlling for factors that might provide a legitimate explanation for such disparities, such as different market interest rates or different institutional practices over different time periods. Users of HMDA data may also use the date of action taken, in combination with application date, to screen for delays between application and action dates that appear to exist on prohibited bases. The Bureau believes that disclosing the action taken date would likely substantially facilitate the re-identification of an applicant or borrower in the HMDA data. Disclosing the action taken date would increase the ability of an adversary to associate a HMDA record with an individual by matching it to an identified publicly available record. As explained above, many jurisdictions publicly disclose real estate transaction records in an identified form, such as mortgages or deeds of trust. These records contain the date that the lender and borrower entered into or executed the agreement, which, like the application date, is closely correlated with the action taken date. Indeed, because the action taken date for originated loans is generally the date of closing or account opening, in most cases these dates will be identical. Therefore, in many cases, an adversary could use the action taken date, combined with other data fields, to match a HMDA record to an identified public record. The Bureau notes that, as with the application date, the FFIEC excluded the action taken date from the agencies' loan-level HMDA data release because the data field could be used to re-identify a particular applicant or borrower in the data.\114\ Similarly, Congress later identified the action taken date as one field that the Board should consider deleting from the modified loan/application register to protect the privacy of applicants and borrowers.\115\ --------------------------------------------------------------------------- \114\ The FFIEC noted that ``[a]n unedited form of the data would contain information that could be used to identify individual loan applicants'' and that the data would be edited prior to public release to remove the application identification number, the date of application, and the date of final action. 55 FR 27886, 27888 (July 6, 1990). \115\ Housing and Community Development Act, Public Law 102-550, section 932(a), 106 Stat. 3672, 3889 (1992). --------------------------------------------------------------------------- If the HMDA data were re-identified, the Bureau believes that, similar to the application date, the action taken date would likely disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. As with the application date, the action taken date is not an inherently sensitive data field; it is associated with an applicant or borrower for only a single transaction in the context of mortgage lending and [[Page 44603]] does not reflect an intrinsic connection to an individual. Further, the Bureau believes that the action taken date would be unlikely to be used for targeted marketing of products and services that pose risks that may not be apparent. Although the Bureau proposes not to disclose the action taken date, the loan-level data will disclose the year in which final action was taken. As with application date, the Bureau considered binning the values reported for action taken date into quarterly or semi-annual intervals. However, the Bureau believes that quarterly intervals would fail to reduce re-identification risk adequately and that, compared to not disclosing action taken date, the gains in data utility that semi- annual intervals might allow do not justify the increase in privacy risk. Disclosing the action taken date in quarterly intervals would still provide an individual with a narrow range of identified public records against which to compare the HMDA data. And although disclosing action taken dates in semi-annual intervals would reduce re- identification risk as compared to quarterly intervals, it would only marginally increase the utility over the current, annual intervals, while still increasing privacy risk. Users would need a narrower range to help ensure that they were comparing borrowers who obtained loans under similar market conditions. The Bureau believes at this time that, under the balancing test, excluding action taken date is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure.\116\ The Bureau seeks comment on this proposal. --------------------------------------------------------------------------- \116\ However, as described above, the year of the loan-level HMDA data will disclose the year in which the action was taken. With respect to quarterly release of the HMDA data, the Bureau stated in the 2015 HMDA Final Rule that, based on its analysis to date, ``disclosure of loan-level data with more granular date information than year of final action would create risks to applicant and borrower privacy that are not outweighed by the benefits of such disclosure.'' 80 FR 66128, 66243 n.389 (Oct. 28, 2015). --------------------------------------------------------------------------- Property Address The 2015 HMDA Final Rule requires financial institutions to report the address of the property securing the loan or, in the case of an application, proposed to secure the loan.\117\ This address corresponds to the property identified on the legal obligation related to the covered loan.\118\ The format of the property address submitted by financial institutions will include, as applicable, the street address, city name, State name, and zip code.\119\ Financial institutions are not required to report this data field under current Regulation C. The Bureau added the requirement to report property address in the 2015 HMDA Final Rule to implement the Dodd-Frank Act's amendment to HMDA providing for the collection and reporting of, ``as the Bureau may determine to be appropriate, the parcel number that corresponds to the real property pledged or proposed to be pledged as collateral.'' \120\ --------------------------------------------------------------------------- \117\ 12 CFR 1003.4(a)(9)(i) (effective Jan. 1, 2018). \118\ Comment 4(a)(9)(i)-1 (effective Jan. 1, 2018). For applications ``the address should correspond to the location of the property proposed to secure the loan as identified by the applicant.'' \119\ Comment 4(a)(9)(i)-2 (effective Jan. 1, 2018). \120\ 12 U.S.C. 2803(b)(6)(H). --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that disclosing the property address in the loan-level HMDA data released to the public would substantially facilitate the re-identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA dataset made available to the public by excluding the property address. The address of the property securing the loan would be useful for identifying possible discriminatory lending patterns. With the exact property address, users could examine these patterns at a finer level of detail than that permitted by the census tract or other geographic boundaries. More precise geographic identification would also better allow public officials to target geographic areas that might benefit from public or private sector investment. Users could also better determine whether financial institutions are serving the housing needs of their communities with information that would enable identification of specific neighborhoods and communities smaller than census tracts. Finally, the property address would allow users to understand better the amount of equity retained in that property over time by tracking multiple liens associated with the same dwelling. This information would help identify communities with overleveraged properties. The Bureau believes that disclosure of the property address itself would likely present minimal, if any, risk of harm or sensitivity. Property owners' addresses are generally widely publicly available.\121\ As explained above, the Bureau considers this public availability to reduce the risk of harm and sensitivity from the release of this data field. However, the Bureau believes that the widespread availability of property addresses creates a significant risk of re-identification. The Bureau believes that adversaries could easily match the property address contained in the HMDA data to identified publicly available property address information. Property addresses are publicly available through a number of sources, including real estate transaction records, property tax records, reverse phone directories, online real estate databases, and online ``people search'' Web sites. Because the address disclosed under Regulation C typically would be identical to the address contained in these publicly available records, an adversary would know that any match was likely to be accurate. Therefore, disclosing the property address in the loan-level HMDA data would substantially facilitate the re-identification of an applicant or borrower. Further, even if disclosing the property address would not permit matching, the Bureau believes that the disclosure of the property address alone could be used in harmful ways. For example, disclosure of property address would allow an applicant or borrower to be targeted with marketing for products and services that may pose risks that are not apparent. --------------------------------------------------------------------------- \121\ The Bureau understands that some jurisdictions may allow borrowers to prevent their identities from being disclosed in public records, and some applicants or borrowers, such as victims of domestic violence, may hide their addresses to prevent certain individuals from locating them in person or to prevent other unwanted intrusions upon the sanctuary or seclusion of their homes. --------------------------------------------------------------------------- As an alternative to excluding the property address data field from the loan-level HMDA data released to the public, the Bureau considered releasing property address in a less granular form. For example, the Bureau could release geographic information that identifies the property securing the loan with less specificity. However, for most reportable transactions, Regulation C already requires reporting of three additional, less-precise geographic identifiers: (1) State; (2) county; and (3) census tract. As discussed above, the Bureau proposes to release these data fields without modification. Further, as discussed below in part IV.A, the Bureau proposes to identify in the public loan-level HMDA data the MSA or MD for each reported record. Other geographic identifiers exist with a level of precision between census tract and property address to which property addresses could be mapped, such as census block and census block group. However, the Bureau believes that these identifiers present similar re- identification risk to property address because they are sufficiently precise to [[Page 44604]] enable an adversary to match them to publicly available property address information. The Bureau believes at this time that, under the balancing test, excluding property address is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. Age The 2015 HMDA Final Rule requires financial institutions to report the age of an applicant or borrower.\122\ A financial institution complies with this requirement by reporting age, as of the application date reported, as the number of whole years derived from the date of birth as shown on the application form.\123\ The Bureau added the requirement in the 2015 HMDA Final Rule to report age to implement the Dodd-Frank Act's amendment to HMDA providing for the collection and reporting of age.\124\ --------------------------------------------------------------------------- \122\ 12 CFR 1003.4(a)(10)(ii) (effective Jan. 1, 2018). \123\ Comment 4(a)(1)(ii)-1 (effective Jan. 1, 2018). \124\ 12 U.S.C. 2803(b)(4). --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that disclosing the applicant or borrower age in the loan-level HMDA data released to the public would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA dataset disclosed to the public by binning and top- and bottom- coding age and by indicating whether the reported value is 62 or higher. Applicant or borrower age would assist users in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Age would be useful to evaluate potential age discrimination in lending.\125\ Disclosure of applicant or borrower age also would assist in identifying whether financial institutions are serving the housing needs of their communities, including the needs of various age cohorts. --------------------------------------------------------------------------- \125\ For example, ECOA and Regulation B generally prohibit creditors from discriminating against applicants in credit transactions on the basis of age. 12 U.S.C. 1691(b)(1); 12 CFR 1002.4(a). --------------------------------------------------------------------------- The Bureau believes that, if the HMDA data were re-identified, disclosure of applicant or borrower age would likely reveal information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. The Bureau believes that, although information about an individual's age may be available for purchase under some circumstances, birth and similarly reliable records reflecting age typically are not available to the general public without barriers to access or use restrictions. The Bureau believes that age likely would be considered sensitive by many if not most consumers and that disclosure of an identified applicant's or borrower's age could lead to dignity harm or embarrassment. The Bureau believes that many consumers would consider the disclosure of identified age to the general public to be outside of societal and cultural expectations. The Bureau also believes that identified age could be used to target marketing to applicants and borrowers, including marketing for products and services that may pose risks that are not apparent, and that the inclusion of this data field in the public loan-level HMDA data would increase the risk of such uses compared to today. The Bureau notes that in section 304(h)(3)(A), added by the Dodd-Frank Act, Congress specifically identified age as a data field to which a modification under section 304(h)(1)(E) should apply if the Bureau determines it to be necessary to protect the privacy interests of applicants or borrowers.\126\ --------------------------------------------------------------------------- \126\ 12 U.S.C. 2803(h)(3)(A)(ii). --------------------------------------------------------------------------- The Bureau believes that public disclosure in the loan-level HMDA dataset of unmodified applicant or borrower age may create some risk of facilitating the re-identification of applicants and borrowers in the HMDA data, but that this field likely would not substantially facilitate re-identification. For example, though information about an individual's age may be available for purchase under some circumstances, the Bureau believes that an adversary typically would face difficulty attempting to re-identify an applicant or borrower in the HMDA data by using age to match HMDA records to other identified records. An applicant's or borrower's age may be more likely to be known than other HMDA data by a person with pre-existing knowledge of a specific applicant or borrower, however, and may help such an adversary to re-identify a particular applicant or borrower. The Bureau believes that the loan-level HMDA data may be modified to appropriately reduce the privacy risks created by the public disclosure of age while preserving much of the benefits of the data field. The Bureau proposes to disclose age binned into the following ranges, as applicable: 25 to 34; 35 to 44; 45 to 54; 55 to 64; and 65 to 74. For example, a reported age of 52 would be shown in the public loan-level HMDA data as between 45 and 54. The Bureau also proposes to bottom-code age under 25 and to top-code age over 74. For example, a reported age of 22 would be shown in the public loan-level HMDA data as 24 or under. The Bureau proposes the particular intervals described above to allow HMDA data users to analyze HMDA data in combination with data found in other public data sources, such as U.S. Census Bureau data.\127\ Finally, the Bureau proposes to indicate whether a reported age is 62 or higher to enhance the utility of the data for identifying the particular fair lending risks that may be posed with regard to elderly populations. The Bureau recognizes that an effect of this indicator would be to divide the 55 to 64 bin into two bins, 55 to 61 and 62 to 64. The Bureau seeks comment on whether privacy risks created by such increased precision are justified by the benefits of disclosure in the proposed ranges. Specifically, the Bureau seeks comment on whether, instead of binning as proposed and indicating whether a reported age is 62 or higher, the Bureau should structure the bins to disclose reported ages of 55 to 74 in ranges of 55 to 61 and 62 to 74. The Bureau believes at this time that, under the balancing test, the proposed modifications to the public loan-level HMDA dataset would appropriately balance the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal, including the proposal to bin age and the proposed intervals to be used for binning. --------------------------------------------------------------------------- \127\ See, e.g., U.S. Census Bureau, ``Age and Sex Composition: 2010,'' at tbl. 2, available at https://www.census.gov/prod/cen2010/briefs/c2010br-03.pdf (disclosing age in five-year intervals, i.e., 25 to 29, 30 to 34, 35 to 40, etc.). --------------------------------------------------------------------------- Credit Score The 2015 HMDA Final Rule requires financial institutions to report, except for purchased covered loans, the credit score or scores relied on in making the credit decision and the name and version of the scoring model used to generate each credit score.\128\ It also provides that, for purposes of this requirement, ``credit score'' has the meaning set forth in section 609(f)(2)(A) of the Fair Credit Reporting Act (FCRA).\129\ The credit score or scores relied on in making the credit decision will be submitted as a numeric field, e.g., 650.\130\ A financial institution will submit a code from a specified list to indicate the name and version of the [[Page 44605]] scoring model used to generate each credit score reported.\131\ The Bureau added the requirement in the 2015 HMDA Final Rule to report information about the credit score or scores relied on to implement the Dodd-Frank Act's amendment to HMDA providing for the collection and reporting of ``the credit score of mortgage applicants and mortgagors, in such form as the Bureau may prescribe.'' \132\ --------------------------------------------------------------------------- \128\ 12 CFR 1003.4(a)(15)(i) (effective Jan. 1, 2018). \129\ 15 U.S.C. 1681g(f)(2)(A). \130\ Supra note 83, at 62-63. \131\ Supra note 83, at 63-64. \132\ 12 U.S.C. 2803(b)(6)(I). --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that disclosing the credit score or scores relied on in making the credit decision in the loan-level HMDA data released to the public would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the public loan-level HMDA dataset by excluding the credit score or scores relied on in making the credit decision.\133\ --------------------------------------------------------------------------- \133\ As noted above, the Bureau proposes to disclose without modification the reported name and version of the credit score model used. --------------------------------------------------------------------------- The credit score or scores relied on in making the credit decision would assist users in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Applicants' credit scores generally are considered to be important indicators of creditworthiness and are used in mortgage underwriting and pricing decisions. Disclosure of the credit score in the public loan-level HMDA data would help ensure that users are comparing applicants and borrowers with similar credit profiles, thereby controlling for factors that might provide a legitimate explanation for disparities in credit and pricing decisions. Credit scores would also assist in identifying whether financial institutions are serving the housing needs of their communities. For example, in order to serve the housing needs of particular communities, a financial institution may offer different types of loan products in communities with high numbers of borrowers with high credit scores than in communities with high numbers of borrowers with low credit scores. The Bureau believes that, if the HMDA data were re-identified, disclosure of the credit score relied on in making the credit decision would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. A credit score is a numerical summary of a consumer's apparent creditworthiness, based on the consumer's credit report, and reflects the likelihood relative to other consumers that the consumer will default on a credit obligation. Identified consumer credit scores and the consumer reports upon which they are based are not available to the general public. To the extent credit scores based on consumer reports are available for commercial purposes, they may be obtained under limited circumstances and are subject to restrictions on their use.\134\ The Bureau believes that most consumers consider their credit score to be very sensitive information. The Bureau believes that public disclosure of an applicant's or borrower's identified credit score could lead to dignity or reputational harm or embarrassment, and that many consumers would consider the disclosure of identified credit scores to the general public to be outside of societal and cultural expectations. The Bureau also believes that an identified credit score could be used to target marketing to applicants and borrowers, including marketing for products and services that may pose risks that are not apparent, and that the inclusion of this data field in the public loan-level HMDA data would increase the risk of such uses compared to today.\135\ The Bureau notes that in section 304(h)(3)(A), added by the Dodd-Frank Act, Congress specifically identified credit score as a data field to which a modification under section 304(h)(1)(E) should apply if the Bureau determines it to be necessary to protect the privacy interests of applicants or borrowers.\136\ --------------------------------------------------------------------------- \134\ Credit scores based on consumer credit reports are consumer reports for purposes of the Fair Credit Reporting Act (FCRA). Accordingly, for example, they may be obtained from a consumer reporting agency only for a permissible purpose under the statute, such as in connection with an application for credit. See 12 U.S.C. 1681b(a). \135\ For example, a marketer currently may obtain from a consumer reporting agency a ``prescreened'' list of consumers meeting certain criteria, such as a minimum credit score, only for the purpose of making a ``firm offer of credit or insurance.'' 15 U.S.C. 1681b(c), 1681a(l). \136\ 12 U.S.C. 2803(h)(3)(A)(i). --------------------------------------------------------------------------- The Bureau has considered the extent to which the age of the loan- level HMDA data at the time it is disclosed may reduce the risk of harm or sensitivity created by the public disclosure of credit score were the HMDA data to be re-identified. For example, as noted above, timely data are essential for most marketing or advertising efforts, and the delay between the date a reported credit score is obtained by the financial institutions and public disclosure of the loan-level HMDA data on the modified loan/application register ranges from to 3 to 15 months. An applicant's or borrower's credit score may change enough over these time periods to reduce the usefulness of a score disclosed in the public HMDA data for marketing purposes. However, the Bureau does not believe that the passage of these time periods would reduce the risk of sensitivity created by the disclosure of credit score. For example, the Bureau does not believe that a borrower would consider the disclosure of her identified six-month-old credit score to be much less sensitive than disclosure of her current credit score; the potential for dignity or reputational harm or embarrassment from a neighbor or other acquaintance learning the information remains significant. The Bureau believes that disclosure in the loan-level HMDA data of the credit score or scores relied on in making the credit decision creates minimal risk, if any, of substantially facilitating the re- identification of applicants and borrowers in the HMDA data. As discussed above, credit scores are not included in identified records available to the general public. A creditor or marketer may possess identified credit score information obtained in connection with, for example, an application for credit or a request for a prescreened list, but the Bureau does not believe that such information would be useful for purposes of re-identifying an applicant or borrower in the loan- level HMDA data. The variation in credit scoring models and versions, along with the likely difference in the dates that a credit score in the HMDA data and the credit score information in possession of a creditor or marketer were created, would make matching the credit score in loan-level HMDA data to such privately held information challenging and unreliable. The Bureau believes an adversary would face substantial difficulty attempting to re-identify an applicant or borrower by using credit score or scores relied on to match HMDA records to other identified records. The Bureau considered whether modifications to the public loan- level HMDA dataset other than excluding credit score, such as binning or rounding of credit score, would appropriately reduce the privacy risks created by the disclosure of credit score in the loan-level data while maintaining some utility for HMDA's purposes. However, the Bureau believes that these strategies would not appropriately reduce the risk of harm or sensitivity and that the gains in data utility that these strategies might allow would not [[Page 44606]] justify the privacy risk created by the disclosure of the modified field. For example, the Bureau believes that, even if it were to disclose in the loan-level HMDA data the credit score for a particular record as being in one of two or three large bins, this information would still create a significant sensitivity risk if the record were re-identified. The Bureau believes that the utility to HMDA's purposes of such binned credit score information would not justify these risks. The Bureau believes at this time that, under the balancing test, excluding credit score is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. Debt-to-Income Ratio The 2015 HMDA Final Rule requires financial institutions to report, except for purchased covered loans, the ratio of the applicant's or borrower's total monthly debt to the total monthly income relied on in making the credit decision (debt-to-income ratio).\137\ The debt-to- income ratio relied on in making the credit decision will be submitted as a percentage.\138\ The Bureau added the requirement in the 2015 HMDA Final Rule to report information about the debt-to-income ratio relied on using its discretionary authority to require the reporting of ``such other information as the Bureau may require'' provided by the Dodd- Frank Act's amendment to HMDA.\139\ --------------------------------------------------------------------------- \137\ 12 CFR 1003.4(a)(23) (effective Jan. 1, 2018). \138\ Supra note 83, at 36, 38. \139\ HMDA section 304(b)(6). --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that disclosing the debt-to-income ratio relied on in making the credit decision in the loan-level HMDA data released to the public would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive and that, for certain debt-to- income ratio values, this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan- level HMDA dataset by binning and top- and bottom-coding certain debt- to-income ratio values. The debt-to-income ratio relied on in making the credit decision would assist users in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Applicants' debt- to-income ratios generally are considered to be important indicators of ability to repay and are used in mortgage underwriting decisions and some pricing decisions. Disclosure of debt-to-income ratio in the public loan-level HMDA data would help ensure that users are comparing applicants and borrowers with similar profiles, thereby controlling for factors that might provide a legitimate explanation for disparities in credit and pricing decisions. Debt-to-income ratio values that are at or close to regulatory or program benchmarks are especially critical to identifying possible discriminatory lending patterns. These benchmarks include, for example, the 43 percent debt-to-income limit for a qualified mortgage under Regulation Z \140\ and the debt-to-income ratio limits imposed by guarantors and investors.\141\ Disclosure of debt-to-income ratio also would assist in identifying whether financial institutions are serving the housing needs of their communities. For example, in order to serve the housing needs of particular communities, financial institutions may offer different types of loan products in communities with high numbers of borrowers with high debt-to-income ratios than in communities with high numbers of borrowers with low debt-to-income ratios. --------------------------------------------------------------------------- \140\ 12 CFR 1026.43(e)(2)(vi). \141\ See, e.g., Fannie Mae, ``B3-6-02: Debt to Income Ratios,'' (Aug. 30, 2016), available at https://www.fanniemae.com/content/guide/selling/b3/6/02.html. --------------------------------------------------------------------------- The Bureau believes that, if the HMDA data were re-identified, disclosure of an applicant's or borrower's debt-to-income ratio relied on in making the credit decision would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. The debt-to-income ratio generally reflects the amount of an applicant's or borrower's monthly debt, including the payment for the mortgage loan sought or originated, relative to his or her monthly income. In addition, when combined with other information that the Bureau proposes to publicly disclose in the loan-level HMDA data, such as information about the mortgage loan sought or originated and applicant or borrower income relied on in making the credit decision, disclosure of debt-to-income ratio may permit a user to approximate the amount of the applicant's or borrower's monthly debt excluding mortgage debt. Information about a consumer's debt is not available to the general public without barriers to access and restrictions on use. The Bureau believes that most consumers consider information about their debt to be sensitive information and that the public disclosure of an identified applicant's or borrower's debt-to- income ratio, especially at higher ratios, could lead to dignity or reputational harm or embarrassment. The Bureau also believes that, especially with respect to higher or lower debt-to-income ratios, identified information about an identified applicant's or borrower's debt could be used to target marketing to the applicant or borrower, including marketing for products and services that may pose risks that are not apparent. The Bureau believes that disclosure in the loan-level HMDA data of the debt-to-income ratio relied on in making the credit decision creates minimal risk, if any, of substantially facilitating the re- identification of applicants and borrowers in the HMDA data. As mentioned above, information about a consumer's debts is not included in identified records available to the general public and, to the extent such information is available for commercial purposes, it generally may be obtained under limited circumstances and is subject to restrictions on its use. To the extent that a creditor possessed information about an applicant or borrower's debt or debt-to-income ratio, the Bureau does not believe that such information would be useful for purposes of re-identifying an applicant or borrower in the loan-level HMDA data. The variation in methods of calculating debt-to- income ratio along with changes in the ratio or the amount of debt over time would make using debt-to-income ratio in the public loan-level HMDA data to match to any privately held debt or debt-to-income ratio information challenging and unreliable. The Bureau believes an adversary would face substantial difficulty attempting to re-identify an applicant or borrower by using debt-to-income ratio or debt amount to match HMDA records to other identified records. The Bureau believes that disclosing unmodified debt-to-income ratio values in the loan-level HMDA data released to the public would create risks to applicant and borrower privacy but that, with respect to debt- to-income values greater than or equal to 40 percent and less than 50 percent, these risks would be justified by the benefits of disclosure to HMDA's purposes. Debt-to-income ratio values in this range are generally at or close to regulatory and guarantor and investor program benchmarks and are especially critical to identifying possible discriminatory lending patterns because they may reveal non- discriminatory explanations for differential treatment. Accordingly, the Bureau proposes to release reported debt-to-income values of greater than or [[Page 44607]] equal to 40 percent and less than 50 percent without modification. With respect to all other debt-to-income ratio values, the Bureau believes that the risks to applicant and borrower privacy that would be created by the disclosure of the unmodified field likely would not be justified by the benefits of the disclosure, but that the loan-level HMDA data may be modified to appropriately reduce the privacy risks while preserving some of the benefits of the data field. The Bureau proposes to bin reported debt-to-income ratio values into the following ranges, as applicable: 20 percent to less than 30 percent; 30 percent to less than 40 percent; and 50 percent to less than 60 percent. For example, a reported debt-to-income ratio of 35 percent would be shown in the loan-level HMDA data disclosed to the public as a debt-to-income ratio of between 30 percent and less than 40 percent. The Bureau also proposes to bottom-code reported debt-to-income ratio values under 20 percent and to top-code reported debt-to-income ratios of 60 percent or higher. For example, a reported debt-to-income ratio of 63 percent would be shown in the public loan-level HMDA data as 61 percent or higher. The Bureau believes at this time that, under the balancing test, these modifications to the public loan-level HMDA data would appropriately balance the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau has considered whether it should disclose debt-to-income ratio at or close to 36 percent without modification.\142\ It is the Bureau's understanding that, for many financial institutions, debt-to- income ratio of 36 percent serves as an internal underwriting benchmark, so that the ability to identify whether an applicant's debt- to-income ratio is above or below this value would help users seeking to identify possible discriminatory lending patterns to control for factors that might provide a legitimate explanation for disparities in credit or pricing decisions. The Bureau seeks comment on whether the benefits of disclosing more granular information concerning debt-to- income ratio values at or around 36 percent would justify the risks to applicant and borrower privacy such disclosure would likely create and how such information should be disclosed. --------------------------------------------------------------------------- \142\ For example, debt-to-income values of between 35 percent and 40 percent could be disclosed without modification, or the Bureau could indicate in the loan-level HMDA data disclosed to the public whether the reported debt-to-income ratio is 36 percent or higher. --------------------------------------------------------------------------- The Bureau seeks comment on this proposal, including both the proposal to bin and top- and bottom-code certain debt-to-income values and the proposed intervals to be used for binning. Property Value The 2015 HMDA Final Rule requires financial institutions to report the value of the property securing the covered loan or, in the case of an application, proposed to secure the covered loan.\143\ Financial institutions will report the value relied on in making the credit decision, such as an appraisal value or the purchase price of the property.\144\ The property value will be reported in numeric form reflecting the exact dollar amount of the value relied on.\145\ The Bureau added the requirement to report the property value relied on in the 2015 HMDA Final Rule to implement the Dodd-Frank Act's amendment to HMDA providing for the collection and reporting of the value of the real property pledged or proposed to be pledged as collateral.\146\ --------------------------------------------------------------------------- \143\ 12 CFR 1003.4(a)(28) (effective Jan. 1, 2018). \144\ Id. \145\ Supra note 83, at 71. \146\ Dodd-Frank Act section 1094(3)(A)(iv), 12 U.S.C. 2803(b)(6)(A). --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that disclosing the property value in the loan-level HMDA data released to the public would likely substantially facilitate the re-identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA data by disclosing the midpoint for the $10,000 interval into which the reported property value falls. For example, for a property value of $117,834, the Bureau would disclose $115,000 as the midpoint between values equal to $110,000 and less than $120,000. The property value data field would be useful for determining whether financial institutions are serving the housing needs of their communities. Users could better understand the values of properties for which financial institutions are (and are not) providing financing to consumers in certain communities. The property value, combined with the loan amount and combined loan-to-value ratio, can also be used to determine whether the property is subject to a second lien. Property value would also be beneficial for identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Combined with the loan amount, the property value would allow users to calculate a loan-to-value ratio, an important variable in underwriting. The loan- to-value ratio would help ensure that users who are evaluating potential disparities in underwriting outcomes, pricing, or other terms and conditions are comparing applicants or borrowers who obtained or applied for loans with similar loan-to-value ratios, thereby controlling for factors that might provide a legitimate explanation for disparities. The Bureau believes that disclosing the exact property value would likely substantially facilitate the re-identification of an applicant or borrower. As with loan amount, property value is a numeric data field that will often consist of at least six digits, which increases its contribution to the uniqueness of a particular HMDA record. As discussed above, many jurisdictions publicly disclose property tax records or real estate transaction records in an identified form, such as mortgages or deeds of trust. These records contain estimates of property value or information that is closely related to property value. Although the value of the property reflected in these public records generally will not be identical to the property value relied on by the financial institution in making the credit decision, the Bureau believes that it may be close enough to permit matching. Therefore, in many cases, an adversary could use the exact property value, combined with other fields, to match a HMDA record to an identified publicly available record. If the HMDA data were re-identified, the Bureau believes that the property value would likely disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. In some cases, the property value may be combined with other information to identify borrowers with high levels of equity, which information could be used to target borrowers with predatory lending offers. For most consumers, however, the Bureau believes that property value would be unlikely to be used for targeted marketing of products and services that pose risks that may not be apparent. Indeed, the Bureau believes that information about borrower equity is already available to many marketers and may be calculated or estimated from publicly available property tax or real estate transaction records that include loan amounts and property values, such as mortgages and real estate sales records. Estimates of property value are also available through online real estate databases. [[Page 44608]] The Bureau believes that the loan-level HMDA data may be modified to appropriately reduce the privacy risks created by the public disclosure of the property value while preserving much of the benefits of the data field. The Bureau believes that disclosing the midpoint for the $10,000 interval into which the reported property value falls provides enough precision to allow users to rely on property value to achieve HMDA's purposes. For example, $10,000 intervals will provide general information about values of properties for which financial institutions are providing financing. Such intervals will not allow users to calculate an exact loan-to-value ratio, although users may still derive an estimated loan-to-value ratio. However, the Bureau believes that releasing the combined loan-to-value ratio, as it proposes to do, will be more beneficial for fair lending purposes than the loan-to-value ratio that users would have calculated from the exact loan amount and property value. Disclosing the midpoint for the $10,000 interval into which the reported property value falls also decreases the ability of adversaries to match HMDA data to identified public records by reducing the uniqueness of a data field common to both datasets. Because the Bureau is also proposing to bin loan amount similarly, adversaries will be unable to use the combined loan-to-value ratio to reduce the effectiveness of the proposed modification by deriving the reported property value. Although such modifications do not entirely eliminate the risk of re-identification, the Bureau believes that the remaining risk would be justified by the benefits of disclosing the property value in $10,000 intervals. Therefore, the Bureau believes at this time that, under the balancing test, modifying property value as described above appropriately balances the privacy risks and disclosure benefits. The Bureau seeks comment on this proposal, including both the proposed $10,000 intervals to be used for binning and the proposal to disclose the midpoint for each interval. Nationwide Mortgage Licensing System and Registry Identifier The 2015 HMDA Final Rule requires financial institutions to report ``the unique identifier assigned by the Nationwide Mortgage Licensing System and Registry [NMLSR ID] for the mortgage loan originator, as defined in Regulation G, 12 CFR 1007.102, or Regulation H, 12 CFR 1008.23, as applicable.'' \147\ The NMLSR ID will be submitted by financial institutions in numeric form, such as 123450.\148\ The Bureau added the requirement to report the NMLSR ID in the 2015 HMDA Final Rule to implement the Dodd-Frank Act's requirement that financial institutions report, ``as the Bureau may determine to be appropriate, a unique identifier that identifies the loan originator as set forth in section 1503 of the [Secure and Fair Enforcement for] Mortgage Licensing Act of 2008.'' \149\ --------------------------------------------------------------------------- \147\ 12 CFR 1003.4(a)(34) (effective Jan. 1, 2018). \148\ Supra note 83, at 75. \149\ [thinsp]Dodd-Frank Act section 1094(3)(A)(iv), 12 U.S.C. 2803(b)(6)(F). --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that disclosing the NMLSR ID in the loan-level HMDA data released to the public would likely substantially facilitate the re-identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan- level HMDA data by excluding the NMLSR ID. The NMLSR ID would be useful for identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. The NMLSR ID would allow users to identify individual mortgage loan originators with primary responsibility over applications, originations, and purchased loans. This information would help public officials and members of the public to identify loan originators that are engaged in problematic business practices, which would provide a greater level of precision for understanding and correcting possible discriminatory lending patterns. The Bureau believes that disclosing the NMLSR ID would likely substantially facilitate the re-identification of an applicant or borrower in the HMDA data. The NMLSR ID is required to appear on various documents associated with the loan, including the security instrument.\150\ As explained above, many jurisdictions publicly disclose these real estate transaction records in an identified form. Although the NMLSR ID is not unique to an individual HMDA record, it is unique to the mortgage loan originator who is unlikely to be associated with many loans for which the other HMDA data fields are identical. Therefore, in many cases, an adversary could use the NMLSR ID, combined with other data fields, to match a HMDA record to an identified public record. --------------------------------------------------------------------------- \150\ 12 CFR 1026.36(g). --------------------------------------------------------------------------- If the HMDA data were re-identified, the Bureau believes that the NMLSR ID would likely disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. The Bureau understands that the NMLSR ID may allow users to determine information that loan originators may consider sensitive. However, as explained in the 2015 HMDA Final Rule, because the Dodd-Frank Act explicitly amended HMDA to add a loan originator identifier, while at the same time directing the Bureau to modify or require modification of itemized information ``for the purpose of protecting the privacy interests of the mortgage applicants or mortgagors,'' the Bureau believes it is reasonable to interpret HMDA as not requiring modifications of itemized information to protect the privacy interests of mortgage loan originators, and that that interpretation best effectuates the purposes of HMDA.\151\ Rather, under the balancing test, the Bureau evaluates the risks to applicant and borrower privacy interests and the benefits of public disclosure in light of the statutory purposes. Because the NMLSR ID conveys no sensitive information about applicants or borrowers, the Bureau believes that disclosure of this data field would create minimal, if any, risk of harm or sensitivity under the balancing test. However, because the Bureau believes that disclosing the NMLSR ID in the loan-level HMDA data released to the public would likely substantially facilitate the re-identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure, the Bureau proposes not to disclose in the loan-level HMDA data the NMLSR ID. --------------------------------------------------------------------------- \151\ 80 FR 66128, 66232 (Oct. 28, 2015). --------------------------------------------------------------------------- The Bureau has considered whether a modification to the public loan-level HMDA dataset other than exclusion of the NMLSR ID would appropriately reduce the privacy risks created by disclosure while maintaining some utility for HMDA's purposes. For example, as with the ULI, the Bureau has considered whether it could, in the loan-level HMDA data disclosed to the public, replace the NMLSR ID reported to the regulators with a different unique number, such as a hashed value. The Bureau is unable to identify a feasible modification at this time, however. The Bureau believes at this time that, under the balancing test, excluding the NMLSR ID is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the [[Page 44609]] benefits of disclosure. The Bureau seeks comment on this proposal. Automated Underwriting System Result The 2015 HMDA Final Rule requires that, except for purchased covered loans, financial institutions report ``the name of the automated underwriting system used by the financial institution to evaluate the application and the result generated by that automated underwriting system.'' \152\ The 2015 HMDA Final Rule defines ``automated underwriting system'' for the purposes of this requirement as ``an electronic tool developed by a securitizer, Federal government insurer, or Federal government guarantor that provides a result regarding the credit risk of the applicant and whether the covered loan is eligible to be originated, purchased, insured, or guaranteed by that securitizer, Federal government insurer, or Federal government guarantor.'' \153\ A financial institution will submit a code from a specified list to indicate the result or results generated by the AUS or AUSs used.\154\ Up to five AUS names and five AUS results may be reported.\155\ The Bureau added these requirements in the 2015 HMDA Final Rule using its discretionary authority to require the reporting of ``such other information as the Bureau may require'' provided by the Dodd-Frank Act's amendment to HMDA.\156\ --------------------------------------------------------------------------- \152\ 12 CFR 1003.4(a)(35)(i) (effective Jan. 1, 2018). \153\ 12 CFR 1003.4(a)(35)(ii) (effective Jan. 1, 2018). \154\ Supra note 8, at 74-75. AUS result will be reported using the following codes: Code 1--Approve/Eligible; Code 2--Approve/ Ineligible; Code 3--Refer/Eligible; Code 4--Refer/Ineligible; Code 5--Refer with Caution; Code 6--Out of Scope; Code 7--Error; Code 8-- Accept; Code 9--Caution; Code 10--Ineligible; Code 11--Incomplete; Code 12--Invalid; Code 13--Refer; Code 14--Eligible; Code 15--Unable to Determine; Code 16--Other; Code 17--Not applicable. If the AUS result is not listed, the financial institution will submit code 16 for ``other'' and will report in a free-form text field the name and version of the scoring model used. \155\ Comment 4(a)(35)-3 (concerning reporting of multiple AUS results); supra note 83, at 37-39, 73. \156\ HMDA section 304(b)(6). --------------------------------------------------------------------------- For the reasons given below, the Bureau believes that disclosing in the loan-level HMDA data released to the public the AUS result field would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the public loan-level HMDA dataset by excluding the AUS result field.\157\ --------------------------------------------------------------------------- \157\ As discussed above, the Bureau proposes to disclose AUS name. --------------------------------------------------------------------------- The AUS result would assist users in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. The AUS result would assist in understanding a financial institution's underwriting decision-making and would help ensure that users are comparing applicants and borrowers with similar profiles, thereby controlling for factors that might provide a legitimate explanation for disparities in credit and pricing decisions. The Bureau believes that, if the HMDA data were re-identified, disclosure of AUS result would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. Applicants' AUS results are not available to the general public. An AUS result is based on a complex set of factors used to evaluate the credit risk associated with a loan. The traditional underwriting process often uses, among other things, loan-to-value ratio to evaluate collateral, credit score to evaluate creditworthiness and willingness to pay, and debt-to-income ratio to evaluate ability to pay. The result from an AUS reflects in a single indicator these and other factors used to evaluate the risk of the borrower and the eligibility of the loan to be purchased, insured, or guaranteed. The Bureau believes that, if a HMDA record were associated with an identifiable applicant or borrower, disclosure of a ``negative'' AUS result \158\ would reveal information that would likely be perceived as reflecting negatively on the applicant or borrower's willingness or ability to pay. The Bureau believes that most consumers would consider such information sensitive and that disclosure of this information could lead to dignity harm or embarrassment. The Bureau believes that this field also could be used to target marketing to applicants or borrowers, including marketing of products and services that may pose risks that are not apparent. --------------------------------------------------------------------------- \158\ For example, a ``refer with caution'' result would indicate that the loan would need to be manually underwritten. --------------------------------------------------------------------------- The Bureau believes that disclosure in the loan-level HMDA data of AUS result would create minimal, if any, risk of facilitating the re- identification of applicants and borrowers in the HMDA data. The Bureau believes that AUS results are not included in any public records or found in other datasets available to the public and that an adversary would face substantial difficulty attempting to re-identify an applicant or borrower by using AUS result to match HMDA records to other identified records. The Bureau has considered whether modifications to the public loan- level HMDA data other than the exclusion of AUS result would appropriately reduce the privacy risks created by the disclosure of the AUS result while maintaining some utility for HMDA's purposes. However, the Bureau does not believe that AUS result can be modified in a manner that appropriately protects privacy and that also preserves utility. AUS result is a categorical field, as opposed to a numerical one, and thus cannot be binned or rounded. The Bureau believes at this time that, under the balancing test, excluding AUS result is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. Free-Form Text Fields The 2015 HMDA Final Rule requires financial institutions to use free-form text fields to report certain data. For example, the 2015 HMDA Final Rule requires financial institutions to report, except for purchased covered loans, the credit score or scores relied on in making the credit decision and the name and version of the scoring model used to generate each credit score.\159\ A financial institution will submit a code from a specified list to indicate the name and version of the scoring model used to generate each credit score reported.\160\ If the name and version of the scoring model used to generate a credit score is not listed, the financial institution will submit the code for ``other credit scoring model'' and will report in a free-form text field the name and version of the scoring model used.\161\ Free-form text fields may also be used to report race,\162\ ethnicity,\163\ reason for denial,\164\ and AUS system name.\165\ The maximum number of characters for the AUS system name free-form text field and for the reason for denial free-form text field, including spaces, is 255; the maximum number of characters including spaces for all other free-form text fields is 100. Free-form text fields used to report race and ethnicity will be completed by [[Page 44610]] applicants; \166\ all other free-form text fields will be completed by the financial institution. --------------------------------------------------------------------------- \159\ 12 CFR 1003.4(a)(15)(i) (effective Jan. 1, 2018). \160\ Supra note 83, at 33-34, 63-64. \161\ Id. \162\ 12 CFR 1003.4(a)(10)(i); supra note 83, at 21-31. \163\ 12 CFR 1003.4(a)(10)(i); supra note 83, at 17-20. \164\ 12 CFR 1003.4(a)(16); supra note 83, at 35-36. \165\ 12 CFR 1003.4(a)(35)(i); supra note 83, at 38-40. \166\ Appendix B, paragraph 8 (effective Jan. 1, 2018). --------------------------------------------------------------------------- Free-form text fields will allow the reporting of any information, including information that creates risks to applicant and borrower privacy. Given the volume of HMDA data reported each year, it will not be feasible for the Bureau to review the contents of each free-form text field submitted before disclosing the loan-level HMDA data to the public. The Bureau believes at this time that, under the balancing test, excluding free-form text fields is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. IV. Other Considerations Related to Disclosure A. Additional Data Current Regulation C requires financial institutions to report the location of the property to which the loan or application relates, by MSA or by Metropolitan Division, by State, by county, and by census tract, if the institution has a home or branch office in that MSA or Metropolitan Division.\167\ To reduce burden on financial institutions, the 2015 HMDA Final Rule eliminates from this provision the requirement to report the MSA or Metropolitan Division in which the property is located.\168\ The Bureau proposes to identify for each loan and application subject to this provision the MSA or Metropolitan Division in which the property securing or proposed to secure the loan is located and to include this information in the loan-level HMDA data disclosed to the public so that the utility of these currently disclosed data fields are preserved. The Bureau seeks comment on this proposal. --------------------------------------------------------------------------- \167\ 12 CFR 1003.4(a)(9). \168\ 12 CFR 1003.4(a)(9)(ii) (effective Jan. 1, 2018); 80 FR 66128, 66187 (Oct. 28, 2015). --------------------------------------------------------------------------- The FFIEC currently includes with the agencies' loan-level release the following census and income data: Population (total population in tract); Minority Population Percent (percentage of minority population to total population for tract, carried to two decimal places); FFIEC Median Family Income (FFIEC Median family income in dollars for the MSA/MD in which the tract is located (adjusted annually by FFIEC)); Tract to MSA/MD Median Family Income Percentage (percentage of tract median family income compared to MSA/MD median family income, carried to two decimal places); Number of Owner Occupied Units (number of dwellings, including individual condominiums, that are lived in by the owner); and Number of 1- to 4-Family units (dwellings that are built to house fewer than five families).\169\ These data are intended to provide additional context to the reported HMDA data. The Bureau proposes to continue to include these data in the loan-level HMDA data disclosed to the public. The Bureau seeks comment on this proposal. --------------------------------------------------------------------------- \169\ For more information concerning these data, including the sources of these data, see Federal Financial Institutions Examination Council, ``FFIEC Census and Demographic Data,'' https://www.ffiec.gov/censusproducts.htm (last visited Mar. 20, 2017). --------------------------------------------------------------------------- The FFIEC also currently includes with the agencies' loan-level release an application date indicator reflecting whether the application date was before January 1, 2004, on or after January 1, 2004, or not available. The Bureau believes that this indicator is no longer useful to analysis of the HMDA data and proposes to no longer include the application date indicator in the loan-level HMDA data disclosed to the public. The Bureau seeks comment on this proposal. B. The Modified LAR and the Agencies' Loan-Level Release As discussed above, HMDA requires that financial institutions make available to the public, upon request, ``loan application register information'' as defined by the Bureau and in the form required under regulations prescribed by the Bureau.\170\ This information must be made available as early as March 31 following the calendar year for which the information was compiled.\171\ In addition to the loan-level data made available by each financial institution on its modified loan/ application register, the FFIEC currently makes available in September of each year the agencies' loan-level release, which is a loan-level dataset containing all reported HMDA data for the preceding calendar year. --------------------------------------------------------------------------- \170\ HMDA section 304(j)(1). This requirement is implemented in 12 CFR 1003.5(c), which requires that each financial institution make available to the public its modified loan/application register, sometimes referred to as a ``modified LAR.'' \171\ HMDA section 304(j)(5). --------------------------------------------------------------------------- Under the 2015 HMDA Final Rule, financial institutions will no longer be required to provide their modified loan/application registers directly to the public and will be required instead to provide a notice advising members of the public seeking their data that it may be obtained on the Bureau's Web site.\172\ By March 31 following the calendar year for which the data was compiled, the Bureau will make available on the Bureau's Web site a modified loan/application register for each financial institution that timely submits its HMDA data.\173\ With respect to data compiled in 2018 or later, this proposed Policy Guidance describes the modifications the Bureau proposes to apply to each financial institution's modified loan/application register as well as to the agencies' loan-level release, with the possible exception of modifications to reflect whether the loan amount is above the applicable GSE conforming loan limit, which may be released later than March 31.\174\ --------------------------------------------------------------------------- \172\ 12 CFR 1003.5(c) (effective Jan. 1, 2018). \173\ With respect to data that is submitted late, the Bureau intends to make available a modified loan/application register by March 31 whenever possible, or as soon thereafter as is feasible. \174\ As noted above, HMDA data is reported by March 1 of the year following the calendar year for which the information was compiled, leaving the Bureau as little as 30 days to prepare each financial institution's modified loan/application register. The Bureau is exploring how best to provide the public with information concerning whether a loan is above the applicable GSE conforming loan limit. --------------------------------------------------------------------------- C. Aggregate and Disclosure Reports HMDA and Regulation C require the FFIEC to make available a disclosure statement for each financial institution each year.\175\ The statute and regulation also require the FFIEC to compile aggregate data by census tract for all financial institutions reporting under HMDA and to produce tables indicating aggregate lending patterns for various categories of census tracts grouped according to location, age of housing stock, income level, and racial characteristics.\176\ The FFIEC currently makes these aggregate data products available in September of each year reflecting HMDA data reported for the preceding calendar year. --------------------------------------------------------------------------- \175\ 12 U.S.C. 2803(k); 12 CFR 1003.5(b)(1) (effective Jan. 1, 2018). \176\ 12 U.S.C. 2809(a); 12 CFR 1003.5(f) (effective Jan. 1, 2018). --------------------------------------------------------------------------- The FFIEC, the Bureau, and the other agencies continue to evaluate options for making available the disclosure statements and aggregate data required by HMDA and the 2015 HMDA Final Rule. The Bureau may also consider making available other data products to enhance understanding of the HMDA data and otherwise further the goals of the statute. D. Restricted Access Program As indicated in the supplementary information to the 2014 HMDA Proposed Rule and the 2015 HMDA Final Rule, the Bureau believes that HMDA's public disclosure purposes may be furthered by allowing academics [[Page 44611]] and industry and community researchers to access the unmodified HMDA dataset through a restricted access program, for research purposes. The Bureau continues to evaluate whether access to unmodified HMDA data should be permitted through such a program, the options for such a program, and the risks and costs that may be associated with such a program. V. Regulatory Requirements The Bureau concludes that the proposed Policy Guidance on Disclosure of Loan-Level HMDA Data is a non-binding general statement of policy and/or a rule of agency organization, procedure, or practice exempt from notice and comment rulemaking requirements under the Administrative Procedure Act pursuant to 5 U.S.C. 553(b). Notwithstanding this conclusion, the Bureau invites public comment on the proposed Policy Guidance. Because no notice of proposed rulemaking is required, the Regulatory Flexibility Act does not require an initial or final regulatory flexibility analysis.\177\ The existing information collections contained in Regulation C have been approved by the Office of Management and Budget (OMB) and assigned OMB control number 3170- 0008. The Bureau has determined that this proposed Policy Guidance does not impose any new or revise any existing recordkeeping, reporting, or disclosure requirements on covered entities or members of the public that would be collections of information requiring OMB approval under the Paperwork Reduction Act, 44 U.S.C. 3501, et seq. The Bureau has a continuing interest in the public's opinions regarding this determination. At any time, comments regarding this determination may be sent to the Consumer Financial Protection Bureau (Attention: PRA Office), 1700 G Street NW., Washington, DC 20552, or by email to [email protected]. --------------------------------------------------------------------------- \177\ 5 U.S.C. 603(a), 604(a). --------------------------------------------------------------------------- VI. Proposed Policy Guidance on Disclosure of Loan-Level HMDA Data The text of the proposed Policy Guidance is as follows: Policy Guidance on Disclosure of Loan-Level HMDA Data A. Background The Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et seq., requires certain financial institutions to collect, report, and disclose data about their mortgage lending activity. HMDA is implemented by Regulation C, 12 CFR part 1003. HMDA identifies its purposes as providing the public and public officials with sufficient information to enable them to determine whether financial institutions are serving the housing needs of the communities in which they are located, and to assist public officials in their determination of the distribution of public sector investments in a manner designed to improve the private investment environment.\178\ In 1989, the Board of Governors of the Federal Reserve System (Board) recognized a third HMDA purpose of identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes, which now appears with HMDA's other purposes in Regulation C.\179\ --------------------------------------------------------------------------- \178\ 12 U.S.C. 2801(b). \179\ 54 FR 51356, 51357 (Dec. 15, 1989) (codified at 12 CFR 1003.1(b)(1)) (Bureau's post-Dodd-Frank Act Regulation C). --------------------------------------------------------------------------- In 2010, Congress enacted the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act).\180\ Among other changes, the Dodd-Frank Act expanded the scope of information relating to mortgage applications and loans that must be collected, reported, and disclosed under HMDA and authorized the Bureau to require financial institutions to collect, report, and disclose additional information. The Dodd-Frank Act amendments to HMDA also added new section 304(h)(1)(E), which directs the Bureau to develop regulations, in consultation with the agencies identified in section 304(h)(2),\181\ that ``modify or require modification of itemized information, for the purpose of protecting the privacy interests of the mortgage applicants or mortgagors, that is or will be available to the public.'' Section 304(h)(3)(B), also added by the Dodd-Frank Act, directs the Bureau to ``prescribe standards for any modification under paragraph (1)(E) to effectuate the purposes of [HMDA], in light of the privacy interests of mortgage applicants or mortgagors. Where necessary to protect the privacy interests of mortgage applicants or mortgagors, the Bureau shall provide for the disclosure of information . . . in aggregate or other reasonably modified form, in order to effectuate the purposes of [HMDA].'' \182\ --------------------------------------------------------------------------- \180\ Dodd-Frank Wall Street Reform and Consumer Protection Act, Public Law 111-203, 124 Stat. 1376, 1980, 2035-38, 2097-101 (2010). \181\ These agencies are the prudential regulators--the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency--and the Department of Housing and Urban Development. Together with the Bureau, these agencies are referred to herein as ``the agencies.'' \182\ Section 304(h)(3)(A) provides that a modification under section 304(h)(1)(E) shall apply to information concerning ``(i) credit score data . . . in a manner that is consistent with the purpose described in paragraph (1)(E); and (ii) age or any other category of data described in paragraph (5) or (6) of subsection (b), as the Bureau determines to be necessary to satisfy the purpose described in paragraph (1)(E), and in a manner consistent with that purpose.'' --------------------------------------------------------------------------- On October 28, 2015, the Bureau published a final rule amending Regulation C (2015 HMDA Final Rule) to implement the Dodd-Frank Act amendments and make other changes.\183\ Most provisions of the 2015 HMDA Final Rule go into effect on January 1, 2018,\184\ and apply to data financial institutions will collect beginning in 2018 and will report beginning in 2019. --------------------------------------------------------------------------- \183\ 80 FR 66128 (Oct. 28, 2015); see also 80 FR 69567 (Nov. 10, 2015) (making technical corrections). \184\ Certain amendments to the definition of financial institution went into effect on January 1, 2017. See 12 CFR 1003.2 (effective Jan. 1, 2017); 80 FR 66128, 66308 (Oct. 28, 2015). --------------------------------------------------------------------------- B. The Balancing Test In the 2015 HMDA Final Rule, in consultation with the agencies and after notice and comment, the Bureau interpreted HMDA, as amended by the Dodd-Frank Act, to require that the Bureau use a balancing test to determine whether and how HMDA data should be modified prior to its disclosure to the public in order to protect applicant and borrower privacy while also fulfilling HMDA's public disclosure purposes. The Bureau interpreted HMDA to require that public HMDA data be modified when the release of the unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such release to the public in light of the statutory purposes. In such circumstances, the need to protect the privacy interests of mortgage applicants or mortgagors requires that the itemized information be modified. This binding interpretation implemented HMDA sections 304(h)(1)(E) and 304(h)(3)(B) because it prescribed standards for requiring modification of itemized information, for the purpose of protecting the privacy interests of mortgage applicants and borrowers, that is or will be available to the public.\185\ --------------------------------------------------------------------------- \185\ 80 FR 66128, 66134 (Oct. 28, 2015). --------------------------------------------------------------------------- The Bureau has applied the balancing test to determine whether and how to modify the HMDA data reported under the 2015 HMDA Final Rule before it is disclosed on the loan level to the public. This Policy Guidance describes the loan-level HMDA data that the Bureau intends to make available to the public beginning in 2019, with respect to data compiled by financial institutions in or after 2018, including modifications that [[Page 44612]] the Bureau intends to apply to the data. The Bureau intends to continue to monitor developments affecting the application of the balancing test to the HMDA data and may reconsider whether and how to modify the HMDA data, based on the application of the balancing test, in order to ensure the appropriate protection of applicant and borrower privacy in light of HMDA's purposes. This Policy Guidance is non-binding in part because flexibility to revise the modifications to be applied to the public loan-level HMDA data is necessary to maintain a proper balancing of the privacy risks and benefits of disclosure. C. Loan-Level HMDA Data To Be Disclosed to the Public The Bureau intends to publicly disclose loan-level HMDA data reported pursuant to the 2015 HMDA Rule as follows: 1. Except as provided in paragraphs 2 through 6 below, the Bureau intends to disclose all data as reported, without modification. 2. The Bureau intends to exclude the following from the public loan-level HMDA data: a. Universal loan identifier, collected pursuant to 12 CFR 1003.4(a)(1)(i); b. The date the application was received or the date shown on the application form, collected pursuant to 12 CFR 1003.4(a)(1)(ii); c. The date of action taken by the financial institution on a covered loan or application, collected pursuant to 12 CFR 1003.4(a)(8)(ii); d. The address of the property securing the loan or, in the case of an application, proposed to secure the loan, collected pursuant to 12 CFR 1003.4(a)(9)(i); e. The credit score or scores relied on in making the credit decision, collected pursuant to 12 CFR 1003.4(a)(15)(i); f. The unique identifier assigned by the Nationwide Mortgage Licensing System and Registry for the mortgage loan originator, as defined in Regulation G, 12 CFR 1007.102, or Regulation H, 12 CFR 1008.23, as applicable, collected pursuant to 12 CFR 1003.4(a)(34); g. The result generated by the automated underwriting system used by the financial institution to evaluate the application, collected pursuant to 12 CFR 1003.4(a)(35)(i); and h. Free-form text fields used to report the following data: Applicant or borrower race, collected pursuant to 12 CFR 1003.4(a)(10)(i); applicant or borrower ethnicity, collected pursuant to 12 CFR 1003.4(a)(10)(i); name and version of the credit scoring model used to generate each credit score or credit scores relied on in making the credit decision, collected pursuant to 12 CFR 1003.4(a)(15)(i); the principal reason or reasons the financial institution denied the application, if applicable, collected pursuant to 12 CFR 1003.4(a)(16); and automated underwriting system name, collected pursuant to 12 CFR 1003.4(a)(35)(i). 3. With respect to the amount of the covered loan or the amount applied for, collected pursuant to 12 CFR 1003.4(a)(7), the Bureau intends to: a. Disclose the midpoint for the $10,000 interval into which the reported value falls, e.g., for a reported value of $117,834, disclose $115,000 as the midpoint between values equal to $110,000 and less than $120,000; and b. Indicate whether the reported value exceeds the applicable dollar amount limitation on the original principal obligation in effect at the time of application or origination as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2). 4. With respect to the age of an applicant or borrower, collected pursuant to 12 CFR 1003.4(a)(10)(ii), the Bureau intends to: a. Bin reported values into the following ranges, as applicable: 25 to 34; 35 to 44; 45 to 54; 55 to 64; and 65 to 74; b. Bottom-code reported values under 25; c. Top-code reported values over 74; and d. Indicate whether the reported value is 62 or higher. 5. With respect to the ratio of the applicant's or borrower's total monthly debt to the total monthly income relied on in making the credit decision, collected pursuant to 12 CFR 1003.4(a)(23), the Bureau intends to: a. Bin reported values into the following ranges, as applicable: 20 percent to less than 30 percent; 30 percent to less than 40 percent; and 50 percent to less than 60 percent; b. Bottom-code reported values under 20 percent; c. Top-code reported values of 60 percent or higher; and d. Disclose, without modification, reported values greater than or equal to 40 percent and less than 50 percent. 6. With respect to the value of the property securing the covered loan or, in the case of an application, proposed to secure the covered loan, collected pursuant to 12 CFR 1003.4(a)(28), the Bureau intends to disclose the midpoint for the $10,000 interval into which the reported value falls, e.g., for a reported value of $117,834, disclose $115,000 as the midpoint between values equal to $110,000 and less than $120,000. Dated: September 8, 2017. Richard Cordray, Director, Bureau of Consumer Financial Protection. [FR Doc. 2017-20409 Filed 9-22-17; 8:45 am] BILLING CODE 4810-AM-P
| Category | Regulatory Information | |
| Collection | Federal Register | |
| sudoc Class | AE 2.7: GS 4.107: AE 2.106: | |
| Publisher | Office of the Federal Register, National Archives and Records Administration | |
| Section | Notices | |
| Action | Notice of proposed policy guidance with request for public comment. | |
| Dates | Comments must be received on or before November 24, 2017. | |
| Contact | David Jacobs, Counsel, or Laura Stack, Senior Counsel, Office of Regulations, at 202-435-7700 or https:// reginquiries.consumerfinance.gov/. | |
| FR Citation | 82 FR 44586 |