As previously reported, in September 2017 the CFPB (Consumer Financial Protection Bureau) proposed policy guidance regarding what application-level Home Mortgage Disclosure Act (HMDA) data would be disclosed to the public based on the significant expansion to the HMDA data reporting items that the CFPB adopted in October 2015. Calendar year 2018 was the first year that reporting institutions collected data under the expanded requirements, and that data must be reported to the government by March 1, 2019. Not long after Kathy Kraninger became the new CFPB Director, the CFPB announced the final policy guidance regarding the application-level HMDA data that will be made available to the public. Unfortunately, by adopting final guidance that is very similar to the proposed guidance, the CFPB is emphasizing public disclosure over consumer privacy concerns.

HMDA requires the modification of data released to the public “for the purpose of protecting the privacy interests of mortgage applicants”. Under the prior HMDA requirements, the application or loan number, the date the application was received and the date the institution took final action on the application were removed from the application-level data that was released to the public. However, even under the prior HMDA requirements, there were concerns that by combining the publicly available HMDA data with other data sources, the identity of each applicant can be determined. With the significant expansion of the HMDA data items, as well as the overall increase in data on consumers that is available in the marketplace, the privacy concerns are even greater. For example, the revised HMDA data items include, among other items, the applicant’s age, income (which is currently reported), credit score, and debt-to-income ratio; the automated underwriting results; the property address; loan cost information; and, for denied applications, the principal denial reasons.

When the CFPB adopted the October 2015 revisions it deferred making a decision on which elements of the expanded HMDA data would be reported on an application-level basis. However, the CFPB indicated that it would use a balancing test to decide what information to disclose publicly, and would allow public input on the information that it proposed to disclose. At that time the CFPB advised that
“[c]‍‍‍onsidering the public disclosure of HMDA data as a whole, applicant and borrower privacy interests arise under the balancing test only where the disclosure of HMDA data may both substantially facilitate the identification of an applicant or borrower in the data and disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive.” The CFPB echoed the balancing test approach in adopting the final guidance. However, the approach is off balance, as it sides too much on the side of public disclosure, ignoring valid consumer privacy concerns.

Under the final policy guidance, the CFPB will make all of the HMDA data available to the public on an application-level basis, except as follows:

• The following information would not be disclosed to the public (the non-disclosure of the first three items is consistent with prior public disclosure practices):
  • The universal loan identifier.
  • The date the application was received or the date shown on the application form (whichever was reported).
  • The date of the action taken on the application.
  • The property address.
  • The credit score(s) relied on.
  • The NMLS identifier for the mortgage loan originator.
  • The automated underwriting system result.
  • The free form text fields for the following (the standard fields reported would be disclosed):
    • The applicant’s race and ethnicity.
    • The name and version of the credit scoring model.
    • The principal reason(s) for denial.
    • The automated underwriting system name.
• The CFPB will disclose in a modified format the loan amount, age of the applicant, the applicant’s debt-to-income ratio, the property value, the total individual dwelling units in the property, and for a multi-family dwelling the individual dwelling units that are income-restricted.
  • For the loan amount, the CFPB will disclose:
    • The midpoint for the $10,000 interval into which the reported value falls, such as $115,000 for amounts of $110,000 to less than $120,000. (Under prior requirements the loan amount was reported to the nearest $1,000, and the reported amount was disclosed to the public.)
    • Whether the reported loan amount exceeds the Fannie Mae and Freddie Mac conforming loan limit.
  • For the age of the applicant, the CFPB will disclose:
    • Ages of applicants in the following ranges: Under 25, 25 to 34, 35 to 44, 45 to 54, 55 to 64, 65 to 74, and over 74.
    • Whether the reported age is 62 or over. For purposes of the Equal Credit Opportunity Act, a person is considered elderly if they are age 62 or over.
  • For the debt-to-income ratio, the CFPB will disclose:
    • The reported debt-to-income ratio for reported values of 36% to less than 50%, and other debt-to-income ratios in the following ranges: under 20%, 20% to less than 30%, 30% to less than 36%, 50% to less than 60% and 60% or higher. As proposed, the reported debt-to-income level would have been disclosed for reported values of 40% to less than 50%.
  • For the property value, the CFPB will disclose the midpoint for the $10,000 interval into which the reported value falls, such as $115,000 for amounts of $110,000 to less than $120,000.
  • For the total individual dwelling units in the property, the CFPB will disclose:
    • The reported number of units for reported values below 5, and other unit numbers in the following ranges: 5 to 24, 25 to 49, 50 to 99, 100 to 149 and over 149. The CFPB had proposed to disclose the actual number of units reported.
  • For the individual dwelling units in a multifamily property that are income-restricted, the CFPB will disclose the reported value as a percentage, rounded to the nearest whole number, of the value reported for the total individual dwelling units. The CFPB had proposed to disclose the actual number of units reported.

Although the loan amount will now be reported in the applicable $10,000 interval and not to the nearest $1,000, the concern is that the totality of the information that is publicly available will make it easier than it is today to determine the identity of the applicant. Thus, based on the final policy guidance, there is a risk that a significant amount of information that consumers view as being confidential will become publicly available. The CFPB essentially dismissed most privacy concerns raised by parties commenting on the proposed policy guidance.

While the final policy guidance favors public disclosure over consumer privacy concerns, the final policy guidance may have a limited life. As previously reported, the CFPB has indicated that it plans to reopen HMDA rulemaking to reconsider various aspects of the revised HMDA rule, including the discretionary data points that were added by the CFPB. We noted previously that the CFPB’s Fall Rulemaking Agenda has a target of May 2019 for the issuance of a notice of proposed rulemaking. Potentially, the CFPB may eliminate entirely, or modify, one or more data categories that are included in the information disclosed publicly. The CFPB states as follows in the supplementary information to the final policy guidance: “The Bureau intends to commence a rulemaking in the spring of 2019 that will enable it to identify more definitively modifications to the data that the Bureau determines to be appropriate under the balancing test and incorporate these modifications into a legislative rule. The rulemaking will reconsider the determinations reflected in this final policy guidance based upon the Bureau’s experience administering the final policy guidance in 2019 and on a new rulemaking record, including data concerning the privacy risks posed by the disclosure of the HMDA data and the benefits of such disclosure in light of HMDA’s purposes.” Thus, in addition to reconsidering the HMDA rule itself, the CFPB already plans to reconsider the approach to public disclosure taken in the final policy guidance.

The adoption of policy guidance that favors public disclosure over consumer privacy appears contrary to the approach of former Acting Director Mulvaney. Perhaps the action reflects that Director Kraninger will take a different approach. Or perhaps Director Kraninger simply decided to initially punt on the issue. The guidance needed to be adopted in view the impending March 1 filing deadline for HMDA data. But as noted above, the CFPB intends to revisit both the HMDA rule itself and the policy guidance. Perhaps Director Kraninger will reassess the approach during the upcoming rulemaking.

Note that while the approach to the public disclosure of HMDA data is adopted in the form of public guidance and not a formal rule, the CFPB advises in the supplementary information to the guidance that pursuant to the Congressional Review Act it will file the guidance with Congress. As we previously reported, the Government Accountability Office determined that the CFPB bulletin on “Indirect Auto Lending and Compliance with the Equal Credit Opportunity Act” was a rule subject to the Congressional Review Act, and subsequently under the Act Congress passed, and President Trump signed, legislation disapproving the bulletin. Presumably, this result influenced the decision of the CFPB to file the policy guidance with Congress under the Act.