Disclosure of Loan-Level HMDA Data, 44586-44612 [2017-20409]

Download as PDF 44586 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices TABLE 1—HOURLY BURDEN Estimated time for response (hour) Item Estimated annual responses Estimated annual burden Rate ($/hr) Estimated annual respondent cost burden (a) IC No. (b) (c) = (a) × (b) (d) (e) = (c) × (d) 1 ................. PTRC Metric Worksheet 0.50 (30 minutes) 352 176 $31.46 $5,53611.96 Total .... ........................................ .............................. 352 176 .............................. 5,536.96 Estimated Total Annual Non-Hour Respondent Cost Burden: $0. There are no filing fees, capital start-up, maintenance, operation, or postage costs associated with this collection. IV. Request for Comments Comments submitted in response to this notice will be summarized or included in the request for OMB approval of this information collection. They also will become a matter of public record. Comments are invited on: (a) Whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility; (b) The accuracy of the agency’s estimate of the burden (including hours and cost) of the proposed collection of information; (c) Ways to enhance the quality, utility, and clarity of the information to be collected, and; (d) Ways to minimize the burden of the collection of information on respondents, e.g., the use of automated collection techniques or other forms of information technology. Marcie Lovett, Records and Information Governance Division Director, OCTO, United States Patent and Trademark Office. [FR Doc. 2017–20369 Filed 9–22–17; 8:45 am] BILLING CODE 3510–16–P BUREAU OF CONSUMER FINANCIAL PROTECTION [Docket No. CFPB–2017–0025] Disclosure of Loan-Level HMDA Data Bureau of Consumer Financial Protection. ACTION: Notice of proposed policy guidance with request for public comment. asabaliauskas on DSKBBXCHB2PROD with NOTICES AGENCY: The Bureau of Consumer Financial Protection (Bureau) is proposing policy guidance that would describe modifications that the Bureau SUMMARY: VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 intends to apply to the loan-level HMDA data that financial institutions will report under the Home Mortgage Disclosure (Regulation C) before the data is disclosed to the public. The proposed policy guidance applies to HMDA data to be reported under Regulation C effective January 1, 2018. The Bureau will make this data available to the public beginning in 2019. Comments must be received on or before November 24, 2017. ADDRESSES: You may submit comments, identified by Docket No. CFPB–2017– 0025, by any of the following methods: • Email: FederalRegisterComments@ cfpb.gov. Include Docket No. CFPB– 2017–0025 in the subject line of the email. • Federal eRulemaking Portal: http:// www.regulations.gov. Follow the instructions for submitting comments. • Mail: Monica Jackson, Office of the Executive Secretary, Consumer Financial Protection Bureau, 1700 G Street NW., Washington, DC 20552. • Hand Delivery/Courier: Monica Jackson, Office of the Executive Secretary, Consumer Financial Protection Bureau, 1700 G Street NW., Washington, DC 20552. Instructions: All submissions should include the agency name and docket number or Regulatory Information Number (RIN). Because paper mail in the Washington, DC area and at the Bureau is subject to delay, commenters are encouraged to submit comments electronically. In general, all comments received will be posted without change to http://www.regulations.gov. In addition, comments will be available for public inspection and copying at 1700 G Street NW., Washington, DC 20552, on official business days between the hours of 10 a.m. and 5:00 p.m. Eastern Time. You can make an appointment to inspect the documents by telephoning 202–435–7275. All comments, including attachments and other supporting materials, will become part of the public record and subject to public disclosure. Sensitive personal information, such as account DATES: PO 00000 Frm 00032 Fmt 4703 Sfmt 4703 numbers or Social Security numbers, should not be included. Comments will not be edited to remove any identifying or contact information. FOR FURTHER INFORMATION CONTACT: David Jacobs, Counsel, or Laura Stack, Senior Counsel, Office of Regulations, at 202–435–7700 or https:// reginquiries.consumerfinance.gov/. SUPPLEMENTARY INFORMATION: I. Summary The Home Mortgage Disclosure Act (HMDA) requires certain financial institutions to collect, report, and disclose data about their mortgage lending activity on an ongoing basis to both Federal regulators and the general public. The home mortgage market is the country’s single largest market for consumer financial products and services, with $10 trillion outstanding.1 It is a critical source of wealth-building for both individual families and communities, and has a substantial impact on the nation’s economy as evidenced by its role in triggering in 2008, the worst financial crisis since the Great Depression. As of 2015, 48 million consumers had a mortgage, representing 65 percent of all owner-occupied homes.2 HMDA is implemented by Regulation C, which describes its purposes as helping to determine whether financial institutions are serving the housing needs of their communities; assisting public officials in distributing publicsector investment so as to attract private investment to areas where it is needed; and assisting in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. As described further below, public disclosure of HMDA data is central to 1 Federal Reserve Bank of St. Louis, Board of Governors of the Federal Reserve System (US), ‘‘Mortgage Debt Outstanding by Type of Property: One- to Four-Family Residences (MDOTP1T4FR),’’ https://fred.stlouisfed.org/series/MDOTP1T4FR (last updated June 9, 2017). 2 U.S. Census Bureau, ‘‘Selected Housing Characteristics: 2011–2015 American Community Survey 5-Year Characteristics,’’ https:// factfinder.census.gov/faces/tableservices/jsf/pages/ productview.xhtml?src=bkmk (last visited Aug. 31, 2017). E:\FR\FM\25SEN1.SGM 25SEN1 asabaliauskas on DSKBBXCHB2PROD with NOTICES Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices the achievement of the statutory goals established by Congress. In 2010, Congress enacted the DoddFrank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), which amended HMDA to require collection of additional mortgage market data and transferred HMDA rulemaking authority and other functions from the Board of Governors of the Federal Reserve System (Board) to the Bureau. On October 28, 2015, the Bureau published a final rule amending Regulation C (2015 HMDA Final Rule) to implement the Dodd-Frank Act amendments. In the 2015 HMDA Final Rule, the Bureau interpreted HMDA, as amended by the Dodd-Frank Act, to require that the Bureau use a balancing test to determine whether and how HMDA data should be modified prior to its disclosure to the public in order to protect applicant and borrower privacy while also fulfilling HMDA’s public disclosure purposes. The Bureau interpreted HMDA to require that public HMDA data be modified when the release of the unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such release to the public in light of the statutory purposes. This proposed Policy Guidance describes the Bureau’s application of the balancing test to date and the loan-level HMDA data that it proposes to make available to the public beginning in 2019, with respect to data compiled by financial institutions in or after 2018, including modifications that the Bureau intends to apply to the data. In developing this guidance, the Bureau has consulted with the prudential regulators—Board, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency—the Department of Housing and Urban Development, and the Federal Housing Finance Agency. The Bureau proposes to publicly disclose the loan-level HMDA data reported under the 2015 HMDA Final Rule with the following modifications. First, the Bureau proposes to modify the public loan-level HMDA data to exclude: The universal loan identifier; the date the application was received or the date shown on the application form; the date of action taken by the financial institution on a covered loan or application; the address of the property securing the loan or, in the case of an application, proposed to secure the loan; the credit score or scores relied on in making the credit decision; the unique identifier assigned by the Nationwide Mortgage Licensing System and Registry for the mortgage loan VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 originator; and the result generated by the automated underwriting system used by the financial institution to evaluate the application. The Bureau also intends to exclude free-form text fields used to report the following data: Applicant or borrower race; applicant or borrower ethnicity; the name and version of the credit scoring model used to generate each credit score or credit scores relied on in making the credit decision; the principal reason or reasons the financial institution denied the application, if applicable; and the automated underwriting system name. Second, the Bureau proposes to modify the public loan-level HMDA data to reduce the precision of most of the values reported for the following data fields. With respect to the amount of the covered loan or the amount applied for, the Bureau proposes to disclose the midpoint for the $10,000 interval into which the reported value falls. The Bureau also proposes to indicate whether the reported value exceeds the applicable dollar amount limitation on the original principal obligation in effect at the time of application or origination as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2). With respect to the age of an applicant or borrower, the Bureau proposes to bin reported values into the following ranges, as applicable: 25 to 34, 35 to 44, 45 to 54, 55 to 64, and 65 to 74; bottom-code reported values under 25; top-code reported values over 74; and indicate whether the reported value is 62 or higher. With respect to the ratio of the applicant’s or borrower’s total monthly debt to the total monthly income relied on in making the credit decision, the Bureau proposes to disclose without modification reported values greater than or equal to 40 percent and less than 50 percent; bin reported values into the following ranges, as applicable: 20 percent to less than 30 percent; 30 percent to less than 40 percent; and 50 percent to less than 60 percent; bottomcode reported values under 20 percent; and top-code reported values of 60 percent or higher. With respect to the value of the property securing the covered loan or, in the case of an application, proposed to secure the covered loan, the Bureau proposes to disclose the midpoint for the $10,000 interval into which the reported value falls. This proposed Policy Guidance is exempt from notice and comment rulemaking requirements under the Administrative Procedure Act pursuant to 5 U.S.C. 553(b). It is non-binding in part to preserve flexibility to revise the modifications to be applied to the PO 00000 Frm 00033 Fmt 4703 Sfmt 4703 44587 public loan-level HMDA data as necessary to maintain a proper balancing of the privacy risks and benefits of disclosure, especially in the event the Bureau becomes aware of new facts and circumstances that might contribute to privacy risks. However, the Bureau invites public comment on the proposed Policy Guidance to provide transparency, obtain public feedback on its application of the balancing test, and improve the Bureau’s decisionmaking. This proposal does not re-open any portion of the 2015 HMDA Final Rule, and the Bureau does not intend in this proposal to revisit any decisions made in that rulemaking. II. Background A. HMDA’s Purposes and the Public Disclosure of HMDA Data The Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et seq., requires certain financial institutions to collect, report, and disclose data about their mortgage lending activity on an ongoing basis to both Federal regulators and the general public. HMDA is implemented by Regulation C, 12 CFR part 1003. HMDA identifies its purposes as providing the public and public officials with sufficient information to enable them to determine whether financial institutions are serving the housing needs of the communities in which they are located, and to assist public officials in their determination of the distribution of public sector investments in a manner designed to improve the private investment environment.3 In 1989, Congress expanded HMDA to require, among other things, financial institutions to report racial characteristics, gender, and income information on applicants and borrowers.4 In light of these amendments, the Board subsequently recognized a third HMDA purpose of identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes, which now appears with HMDA’s other purposes in Regulation C.5 Public disclosure of HMDA data is central to the achievement of HMDA’s goals. Since HMDA’s enactment in 1975, the data financial institutions are required to disclose under HMDA and Regulation C have been expanded, public access to HMDA data has increased, and the formats in which 3 12 U.S.C. 2801(b). Institutions Reform, Recovery, and Enforcement Act, Public Law 101–73, section 1211, 103 Stat. 183, 524–26 (1989). 5 54 FR 51356, 51357 (Dec. 15, 1989) (codified at 12 CFR 1003.1(b)(1)) (Bureau’s post-Dodd-Frank Act Regulation C). 4 Financial E:\FR\FM\25SEN1.SGM 25SEN1 asabaliauskas on DSKBBXCHB2PROD with NOTICES 44588 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices HMDA data have been disclosed to the public have evolved to provide more useful information to the public and public officials. Amendments to the statute and Regulation C over time illustrate the importance of public access to HMDA data to fulfill the statute’s purposes. As originally promulgated, HMDA and Regulation C required a covered financial institution to make available to the public at its home and branch offices a ‘‘disclosure statement’’ reflecting aggregates of certain mortgage loan data.6 In 1980, Congress amended HMDA to increase the public’s access to and the utility of the aggregated HMDA data. First, Congress amended HMDA section 304 to require that the Federal Financial Institutions Examination Council (FFIEC) implement a system to facilitate public access to the data required to be disclosed under the statute, and provided that such system must include arrangements for a ‘‘central depository of data’’ in each standard metropolitan statistical area (MSA).7 In amending Regulation C to implement this requirement, the Board noted that ‘‘the principal benefit of the central repository system is that users of HMDA data will be able to obtain all of the various institutions’ disclosure statements at one location. The current system requires users to contact the institutions on an individual basis to obtain the disclosure data.8 Second, the 1980 HMDA amendments required that the FFIEC compile annually for each MSA aggregate data by census tract for all financial institutions required to disclose data under HMDA, and produce tables indicating, for each MSA, aggregate lending patterns for various categories of census tracts grouped according to location, age of housing stock, income level, and racial characteristics.9 A principal benefit cited to support these requirements was that the utility of individual institutions’ disclosure statements ‘‘would be enhanced if they could be compared to aggregate [MSA] lending patterns.’’ 10 In 1989, as noted above, Congress amended HMDA to expand the data financial institutions were required to 6 12 CFR part 203. and Community Development Act, Public Law 96–399, section 340, 94 Stat. 1614 (1980). 8 46 FR 11780, 11786 (Feb. 10, 1981). 9 Housing and Community Development Act, Public Law 96–399, section 34010, § 340, 94 Stat. 1614 (1980). 10 46 FR 11780, 11786 (Feb. 10, 1981). 7 Housing VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 disclose to the public.11 In addition to requiring that financial institutions disclose data concerning the race, sex, and income of applicants and borrowers, the 1989 amendments required that institutions disclose data on loan applications in addition to originations and purchases. In implementing these amendments in Regulation C, the Board required financial institutions to report HMDA data to their supervisory agencies on a loan-by-loan and application-byapplication basis using the ‘‘loan/ application register’’ format.12 Commenters on the Board’s proposal to amend Regulation C to implement the 1989 amendments urged the Board to require that financial institutions make their loan/application registers available to the public to provide for more meaningful analysis of the data than that permitted by the required aggregate disclosures.13 The Board declined to require that financial institutions make available to the public their loan/ application registers, but in 1990 the FFIEC announced that it believed public disclosure of the reported loan-level HMDA data to be ‘‘consistent with the congressional intent to maximize the utilization of lending data’’ and that it would make all reported HMDA data available to the public in a loan-level format, after deleting three fields to protect applicant and borrower privacy.14 The FFIEC first disclosed the reported loan-level HMDA data to the public in October 1991. The following year, Congress amended HMDA to require that each financial institution make available to the public its ‘‘loan application register information’’ for each year as early as March 31 of the succeeding year, as required under regulations prescribed by the Board.15 New section 304(j) directed the Board to require such deletions from the loan application register information made available to the public as the Board determined to be appropriate to protect any privacy 11 Financial Institutions Reform, Recovery and Enforcement Act, Public Law 101–73, section 1211, 103 Stat. 183 (1989). 12 12 CFR 203.4, 203.5; see also 54 FR 51356, 51359–60 (Dec. 15, 1989). 13 54 FR 51356, 51360–61 (Dec. 15, 1989). 14 55 FR 27886, 27888 (July 6, 1990). In announcing that the loan-level data submitted to the supervisory agencies on the loan/application register would be made available to the public, the FFIEC noted that ‘‘[a]n unedited form of the data would contain information that could be used to identify individual loan applicants’’ and that the data would be edited prior to public release to remove the application identification number, the date of application, and the date of final action. 15 Housing and Community Development Act, Public Law 102–550, section 932, 106 Stat. 3672 (1992). PO 00000 Frm 00034 Fmt 4703 Sfmt 4703 interest of any applicant, and identified as appropriate for deletion the same three fields the FFIEC had determined should be deleted from the loan-level HMDA data it disclosed to the public.16 A House Report characterizes the 1992 amendment to HMDA as making ‘‘changes . . . to ensure that the public receives useful and timely information regarding the lending records of financial institutions.’’ 17 The Board implemented this amendment by requiring that financial institutions make their ‘‘modified’’ loan/application registers available to the public after deleting the same fields deleted from the loan-level HMDA data disclosed by the FFIEC.18 Today, HMDA data are the preeminent data source that regulators, researchers, economists, industry, and advocates use to achieve HMDA’s purposes and to analyze the mortgage market. HMDA and current Regulation C 19 continue to require that data be made available to the public in both aggregate and loan-level formats. Each financial institution is required to make its modified loan/application register available to the public, with three fields deleted to protect applicant and borrower privacy,20 and also make available to the public a disclosure statement prepared by the FFIEC that shows the financial institution’s HMDA data in aggregate form.21 In addition, the FFIEC makes available to the public disclosure statements for each financial institution,22 aggregate reports for each MSA and metropolitan division (MD) showing lending patterns by certain property and applicant characteristics,23 and the loan-level dataset containing all reported HMDA data for the preceding calendar year, modified to protect 16 HMDA section 304(j) identifies as appropriate for deletion ‘‘the applicant’s name and identification number, the date of the application, and the date of any determination by the institution with respect to such application.’’ 17 H. Rept. 102–760 (1992). 18 See 12 CFR 1003.5(c) (Bureau’s successor Regulation C, which restates the Board’s predecessor Regulation C). Section 1003.5(c) requires that, before making its loan/application register available to the public, a financial institution must delete three fields to protect applicant and borrower privacy: Application or loan number, the date that the application was received, and the date action was taken. 19 Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et seq., as implemented by Regulation C, 12 CFR part 1003. ‘‘Current Regulation C’’ as used herein refers to Regulation C in effect as of the date of publication of this proposed Policy Guidance. 20 HMDA section 304(j)(2)(B); 12 CFR 1003.5(c). 21 HMDA section 304(k); 12 CFR 1003.5(b). 22 HMDA section 304(f); 12 CFR 1003.5(f). 23 HMDA section 310; 12 CFR 1003.5(f). E:\FR\FM\25SEN1.SGM 25SEN1 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices applicant and borrower privacy (the agencies’ loan-level release).24 asabaliauskas on DSKBBXCHB2PROD with NOTICES B. The Dodd-Frank Act and Amendments to HMDA and Regulation C In 2010, the Dodd-Frank Act, which amended HMDA and also transferred HMDA rulemaking authority and other functions from the Board to the Bureau, was enacted into law.25 Among other changes, the Dodd-Frank Act again expanded the scope of information relating to mortgage applications and loans that must be collected, reported, and disclosed under HMDA and authorized the Bureau to require financial institutions to collect, report, and disclose additional information. The Dodd-Frank Act amendments to HMDA also added new section 304(h)(1)(E), which directs the Bureau to develop regulations, in consultation with the agencies identified in section 304(h)(2),26 that ‘‘modify or require modification of itemized information, for the purpose of protecting the privacy interests of the mortgage applicants or mortgagors, that is or will be available to the public.’’ Section 304(h)(3)(B), also added by the Dodd-Frank Act, directs the Bureau to ‘‘prescribe standards for any modification under paragraph (1)(E) to effectuate the purposes of [HMDA], in light of the privacy interests of mortgage applicants or mortgagors. Where necessary to protect the privacy interests of mortgage applicants or mortgagors, the Bureau shall provide for the disclosure of information . . . in aggregate or other reasonably modified form, in order to effectuate the purposes of [HMDA].’’ 27 On August 29, 2014, the Bureau published proposed amendments to Regulation C (2014 HMDA Proposed Rule) to implement the Dodd-Frank Act 24 55 FR 27886 (July 6, 1990) (announcing that the loan-level HMDA data submitted on the loan/ application register would be made available to the public after deletion of three fields to protect applicant and borrower privacy). 25 Dodd Frank Wall Street Reform and Consumer Protection Act, Public Law 111–203, 124 Stat. 1376, 1980, 2035–38, 2097–101 (2010). 26 These agencies are the prudential regulators— the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency—and the Department of Housing and Urban Development. Together with the Bureau, these agencies are referred to herein as ‘‘the agencies.’’ 27 Section 304(h)(3)(A) provides that a modification under section 304(h)(1)(E) shall apply to information concerning ‘‘(i) credit score data . . . in a manner that is consistent with the purpose described in paragraph (1)(E); and (ii) age or any other category of data described in paragraph (5) or (6) of subsection (b), as the Bureau determines to be necessary to satisfy the purpose described in paragraph (1)(E), and in a manner consistent with that purpose.’’ VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 amendments and to make additional changes.28 After careful consideration of comments received on its proposal, the Bureau published a final rule on October 28, 2015 (2015 HMDA Final Rule) amending Regulation C.29 The 2015 HMDA Final Rule implements the Dodd-Frank Act amendments and makes other changes to Regulation C. Most provisions of the 2015 HMDA Final Rule go into effect on January 1, 2018 30 and apply to data financial institutions will collect beginning in 2018 and will report beginning in 2019.31 The 2015 HMDA Final Rule addressed the public disclosure of HMDA data in two ways. First, the 2015 HMDA Final Rule made changes to financial institutions’ public disclosure obligations under Regulation C. Under the 2015 HMDA Final Rule, the public disclosure of HMDA data is shifted entirely to the agencies. Effective with respect to HMDA data compiled in 2017 and later, financial institutions will no longer be required to provide their modified loan/application registers and disclosure statements directly to the public and will be required instead to provide only a notice advising members of the public seeking their data that it may be obtained on the Bureau’s Web site. In addition to reducing burden on financial institutions associated with their disclosure of HMDA data, the 2015 HMDA Final Rule eliminates risks to financial institutions associated with errors in preparing their modified loan/ application registers that could result in the unintended disclosure of data. Further, the 2015 HMDA Final Rule allows decisions with respect to what to include on the modified loan/ application register to be made in conjunction with decisions regarding the agencies’ loan-level data release, providing flexibility and allowing for consistency with respect to both releases. This shift of responsibility also permits the Bureau to consider modifications to protect applicant and borrower privacy that preserve data utility but that may be burdensome for financial institutions to implement. Finally, shifting the disclosure of HMDA data to the agencies will allow 28 79 FR 51732 (Aug. 29, 2014). Mortgage Disclosure (Regulation C), 80 FR 66128 (Oct. 28, 2015); see also 80 FR 69567 (Nov. 10, 2015) (making technical corrections). 30 Certain amendments to the definition of financial institution went into effect on January 1, 2017. See 12 CFR 1003.2; 80 FR 66128, 66308 (Oct. 28, 2015). 31 Beginning in 2018, with respect to data compiled in 2017 and later, financial institutions will file their HMDA data with the Bureau. The Bureau will collect and process HMDA data on behalf of the FFIEC and the agencies. 29 Home PO 00000 Frm 00035 Fmt 4703 Sfmt 4703 44589 for easier adjustment of privacy protections applied to disclosures of loan-level HMDA data as privacy risks and potential uses of HMDA data evolve. Also in the 2015 HMDA Final Rule, in consultation with the agencies and after notice and comment, the Bureau interpreted HMDA, as amended by the Dodd-Frank Act, to require that the Bureau use a balancing test to determine whether and how HMDA data should be modified prior to its disclosure to the public in order to protect applicant and borrower privacy while also fulfilling HMDA’s public disclosure purposes. The Bureau interpreted HMDA to require that public HMDA data be modified when the release of the unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such release to the public in light of the statutory purposes.32 In such circumstances, the need to protect the privacy interests of mortgage applicants or mortgagors requires that the itemized information be modified. This binding interpretation implemented HMDA sections 304(h)(1)(E) and 304(h)(3)(B) because it prescribed standards for requiring modification of itemized information, for the purpose of protecting the privacy interests of mortgage applicants and borrowers, that is or will be available to the public.33 The 2015 HMDA Final Rule’s interpretation of HMDA section 304(h)(1)(E) and 304(h)(3)(B) to require a balancing test is a regulation that limits the Bureau’s discretion with respect to public release of HMDA data. The standards impose binding obligations on the Bureau to evaluate the HMDA data, individually and in combination, to assess whether and how HMDA data should be modified prior to its disclosure to the public in order to protect applicant and borrower privacy while also fulfilling HMDA’s public disclosure purposes. The standards for modification of itemized information that is or will be available to the public apply to all data reported under the 2015 HMDA Final Rule.34 Part III of this proposed Policy Guidance describes the Bureau’s application of the balancing test to date and its proposals concerning the public disclosure of the loan-level HMDA data that will be reported to the agencies pursuant to Regulation C as amended by 32 80 FR 66128, 66134 (Oct. 28, 2015). 33 Id. 34 Id. at 66133, 66252 (noting that the Bureau’s application of the balancing test would include data fields currently disclosed on the modified loan/ application register and in the agencies’ loan-level release). E:\FR\FM\25SEN1.SGM 25SEN1 44590 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices the 2015 HMDA Final Rule.35 Part IV of this proposed Policy Guidance addresses other considerations related to the disclosure of HMDA data, including the disclosure of aggregate HMDA data.36 III. Application of the Balancing Test asabaliauskas on DSKBBXCHB2PROD with NOTICES A. The Balancing Test As noted above, in the 2015 HMDA Final Rule, the Bureau interpreted HMDA to require that public HMDA data be modified when the disclosure of the unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such disclosure to the public in light of the statutory purposes. Considering the public disclosure of the loan-level HMDA dataset as a whole, risks to applicant and borrower privacy interests arise under the balancing test only where the disclosure of the unmodified loan-level HMDA dataset may both substantially facilitate the identification of an applicant or borrower in the data and disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive.37 Thus, under the balancing test, risks to applicant and borrower privacy interests would not arise if a loan-level dataset substantially facilitated the identification of applicants and borrowers in the data but revealed no information about applicants and borrowers that was harmful or sensitive and not otherwise public. Alternatively, risks to applicant and borrower privacy interests would not arise under the balancing test if a loan-level dataset contained harmful or sensitive information about applicants and borrowers that was not otherwise public but it was not possible to identify an applicant or borrower in the dataset. Accordingly, under the balancing test, the disclosure of the loan-level HMDA 35 The Bureau received some comments on the 2014 HMDA Proposed Rule suggesting that disclosure of certain HMDA data fields could reveal confidential business information and that such data fields should not be disclosed to the public in order to protect such information. The Bureau notes that HMDA requires modification of the HMDA data to protect the privacy interests of applicants and borrowers without mentioning the protection of confidential business information. Although the balancing test adopted in the 2015 HMDA Final Rule addresses risks to applicant and borrower privacy created by the disclosure of HMDA data, the modifications resulting from its application may mitigate some of the confidentiality concerns raised by commenters. 36 As discussed above and also below in part IV.C, HMDA and Regulation C require the FFIEC to make available to the public certain aggregated data. The FFIEC, the Bureau, and the other agencies continue to evaluate options for disclosure of the required aggregates of data that will be reported under the 2015 HMDA Final Rule. 37 80 FR 66128, 66134 (Oct. 28, 2015). VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 dataset creates risks to applicant and borrower privacy interests only where at least one data field or a combination of data fields in the dataset substantially facilitates the identification of an applicant or borrower, and at least one data field or combination of data fields discloses information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. At the individual data field level, a field may create ‘‘reidentification risk’’ by substantially facilitating the identification of an applicant or borrower in the HMDA data (for example, as discussed below, because it may be used to match a HMDA record to an identified record), or may create ‘‘risk of harm or sensitivity’’ by disclosing information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. Assessing the risks to applicant and borrower privacy under the balancing test requires an evaluation of the unmodified HMDA dataset as a whole and of the individual data fields contained in the dataset. Where the public disclosure of the unmodified loan-level HMDA dataset would create risks to applicant and borrower privacy, the balancing test requires that the Bureau consider the benefits of disclosure to HMDA’s purposes and, where these benefits do not justify the privacy risks the disclosure would create, modify the dataset to appropriately balance the privacy risks and disclosure benefits. An individual data field is a candidate for potential modification under the balancing test if its disclosure in unmodified form would create a risk of re-identification or a risk of harm or sensitivity. As discussed further below, with respect to the HMDA data that will be reported to the agencies under the 2015 HMDA Final Rule and based on its analysis to date, the Bureau believes that public disclosure of the unmodified loan-level dataset, as a whole, would create risks to applicant and borrower privacy interests under the HMDA balancing test. This is due to the presence in the dataset of individual data fields that the Bureau believes would create re-identification risk and the presence of individual data fields that the Bureau believes are not currently public and would create a risk of harm or sensitivity. The Bureau thus has applied the balancing test to determine whether and how it should modify the HMDA data that will be reported under the 2015 HMDA Final Rule before it is disclosed to the public. Based on its analysis, the Bureau believes that the balancing test requires PO 00000 Frm 00036 Fmt 4703 Sfmt 4703 the loan-level HMDA dataset to be modified before it is disclosed to the public to reduce risks to applicant and borrower privacy created by disclosure and appropriately balance them with the benefits of disclosure for HMDA’s purposes. The Bureau proposes to modify the public loan-level dataset as described in this proposed Policy Guidance.38 The Bureau believes that the modifications to the loan-level HMDA dataset proposed in this Policy Guidance would reduce risks to applicant and borrower privacy and appropriately balance them with the benefits of disclosure for HMDA’s purposes. The Bureau seeks comment on all aspects of this proposed Policy Guidance, including its analysis of risks to applicant and borrower privacy, its application of the balancing test, and its proposed modifications. This part III.A describes the benefits of public disclosure of the data that will be reported under the 2015 HMDA Final Rule, the risks to applicant and borrower privacy that may be created by the public disclosure of the unmodified HMDA data that the Bureau has considered, and the Bureau’s approach to balancing these benefits and risks. Part III.B describes the application of the balancing test to the data that will be reported under the 2015 HMDA Final Rule and the Bureau’s proposed modifications to the loan-level HMDA data that will be disclosed to the public. Disclosure Benefits Under the balancing test, the Bureau considers the benefits of disclosure of the loan-level HMDA data to the public. As described above, HMDA has a long history of providing the public with information about mortgage lending activity, and Congress has repeatedly amended the statute to increase the scope and utility of the data disclosed to the public. Users of HMDA data have relied on this information to help achieve HMDA’s purposes: Helping to determine whether financial institutions are serving the housing needs of their communities; assisting public officials in distributing public-sector investment so as to attract private investment to areas where it is needed; and assisting in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Today, 38 With respect to data compiled in 2018 or later, this proposed Policy Guidance describes the modifications the Bureau proposes to apply to the agencies’ loan-level release and to each financial institution’s modified loan/application register. The terms ‘‘loan-level dataset’’ and ‘‘loan-level data’’ used herein refer to HMDA data disclosed on the loan level, whether the data are those submitted by an individual financial institution or by all reporting financial institutions. E:\FR\FM\25SEN1.SGM 25SEN1 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices asabaliauskas on DSKBBXCHB2PROD with NOTICES HMDA data are the preeminent data source that regulators, researchers, economists, industry, and advocates rely on to achieve HMDA’s purposes and to analyze the mortgage market.39 Community groups, researchers, and public officials have used HMDA data to help determine whether financial institutions are serving the housing needs of their communities. For example, HMDA data have enabled community groups to understand the magnitude of disinvestment within minority neighborhoods.40 Public officials have relied on HMDA data to compare the lending activity of financial institutions to the credit needs of communities and to examine whether minority communities were disproportionately affected by foreclosures following the financial crisis.41 Further, community groups relied on HMDA data to document the rise in subprime lending among minority communities in the years before the financial crisis.42 Public officials also have used HMDA data to develop and allocate housing and community development investments. For example, local governments have used HMDA data to characterize neighborhoods for purposes of determining the most effective use of housing grants, to select financial institutions for contracts and participation in local programs, and to identify a need for homebuyer counseling and education.43 Similarly, 39 For more information about the history and benefits of HMDA, see the supplementary information to the Bureau’s 2014 HMDA Proposed Rule, 79 FR 51732, 51735–36 (Aug. 29, 2014), and the Bureau’s 2015 HMDA Final Rule, 80 FR 66128, 66129–31 (Oct. 28, 2015). 40 See John Goering and Ron Wienk, ‘‘Mortgage Lending, Racial Discrimination and Federal Policy,’’ at 10 (Urban Inst. Press 1996). 41 Robert B. Avery & Thomas M. Buynak, ‘‘Economic Review—Mortgage Redlining: Some New Evidence,’’ at 18–32 (Fed. Reserve Bank of Cleveland, Working Paper No. 0013–0281, 1981), available at https://fraser.stlouisfed.org/scribd/ ?item_id=4183&filepath=/files/docs/publications/ frbclevreview/rev_frbclev_198102.pdf; Carolina Reid and Elizabeth Laderman, ‘‘The Untold Costs of Subprime Lending: Examining the Links Among Higher-Priced Lending, Foreclosures and Race in California’’ (Fed. Reserve Bank of S.F., Working Paper No. 2009–09, 2009), available at https:// iasp.brandeis.edu/pdfs/Author/reid-carolina/ The%20Untold%20Costs%20of%20Subprime %20Lending%203.pdf. 42 ‘‘Home Mortgage Disclosure Act: Newly Collected Data and What It Means,’’ Hearing on the 2004 Home Mortgage Disclosure Act before the Subcomm. on Fin. Servs. and Consumer Credit of the H. Comm. on Fin. Servs., 109th Cong. 4 (2006) (written testimony of Calvin Bradford, President, Calvin Bradford Assocs., Ltd., on behalf of the Nat’l Fair Hous. Alliance). 43 See City of Albuquerque, Dep’t of Family and Comty. Hous., ‘‘Five Year Consolidated Housing Plan and Workforce Housing Plan (2008–2012),’’ at 100 (2008), available at http://www.cabq.gov/ VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 the Department of Housing and Urban Development used HMDA data to develop the formula by which funding would be provided to communities suffering from foreclosures and abandonment under the Neighborhood Stabilization Program.44 HMDA data have also been used by public officials, researchers, and community groups to identify potentially discriminatory lending patterns and to enforce antidiscrimination statutes. For example, researchers, journalists, and public officials relied on HMDA data along with other publicly available data to identify racial disparities in mortgage lending between neighborhoods in Atlanta, Detroit, and Boston.45 Since Congress amended HMDA to require reporting of the race, gender, and income of individual applicants and borrowers,46 the expanded HMDA data have been used to identify potential discriminatory lending practices.47 Community groups have used the data to monitor fair lending within their communities and enter into agreements with financial institutions to ensure that the local needs were being served in a responsible manner.48 HMDA data also family/documents/ConsolidatedWorkforceHousing Plan20082012final.pdf; City of Antioch, Cal., ‘‘Fiscal Year 2012–2013: Consolidated Annual Performance Evaluation Report,’’ at 29 (2012), available at http://ci.antioch.ca.us/CitySvcs/ CDBGdocs/CAPER%20FY%2012-13.pdf; City of Lawrence, Mass., ‘‘HUD Consolidated Plan 2010– 2015,’’ at 68 (2010), available at http:// www.cityoflawrence.com/Data/Sites/1/documents/ cd/Lawrence_Consolidated_Plan_Final.pdf. 44 See U.S. Dep’t of Housing and Urban Dev., ‘‘Neighborhood Stabilization Program Formula Methodology’’ (2008), available at https:// www.huduser.gov/portal/datasets/NSP.html. 45 Bill Dedman, ‘‘The Color of Money,’’ (parts 1– 4), Atlanta Journal-Const., May 1–4, 1988; David Everett et al., ‘‘The Race for Money,’’ (parts 1–4), Detroit Free Press, July 24–27, 1988; Bill Dedman, ‘‘Blacks Turned Down for Home Loans from S&Ls Twice as Often as Whites,’’ Atlanta Journal-Const., Jan. 22, 1989; Katharine Bradbury et al., ‘‘Geographic Patterns of Mortgage Lending in Boston, 1982–1987,’’ New Eng. Econ. Rev., (1989). These reports and studies helped motivate Congress to amend HMDA to improve publicly available information about lending practices through the Financial Institutions Reform, Recovery, and Enforcement Act of 1989. 46 Federal Institutions Reform, Recovery, and Enforcement Act, Public Law 101–73, section 1211, § 304, 103 Stat. 183, 524–26 (1989). 47 For example, researchers have found evidence that, in many cases, an applicant’s race alone influenced whether the applicant was denied credit. See, e.g., Alicia H. Munnell et al., ‘‘Mortgage Lending in Boston: Interpreting the HMDA Data,’’ at 22 (Am. Econ. Rev., Fed. Reserve Bank of Boston Working Paper 92–7 (1992); James H. Carr & Isaac F. Megbolugbe, ‘‘The Federal Reserve Bank of Boston: Study on Mortgage Lending Revisited,’’ 4 J. of Hous. Res. 2, at 277 (1993). 48 See Adam Rust, ‘‘A Principle-Based Redesign of HMDA and CRA Data in Revisiting the Community Reinvestment Act: Perspectives on the Future of the Community Reinvestment Act,’’ at 179 (Fed. Reserve Banks of Bos. and S.F. 2009). PO 00000 Frm 00037 Fmt 4703 Sfmt 4703 44591 played an important role in recent enforcement actions by the Illinois and New York Attorneys General related to discriminatory mortgage lending.49 The Bureau and other regulators regularly rely on HMDA data in fair lending analyses, including in identifying possible discriminatory practices such as illegal redlining.50 In enacting the Dodd-Frank Act in 2010, Congress expanded the data financial institutions are required to collect, report, and disclose under HMDA and authorized the Bureau to require additional information. The Bureau’s 2015 HMDA Final Rule amended Regulation C to implement the Dodd-Frank Act amendments and address the informational shortcomings exposed by the financial crisis to better meet the needs of the public, public officials, and regulators. Although the 2015 HMDA Final Rule did not address the specific data fields that would be disclosed to the public in the loan-level HMDA data, the rule required the collection and reporting of a number of data fields which, if publicly disclosed, would improve the ability of HMDA data users to fulfill HMDA’s purposes. For example, mandatory reporting of information about the reasons for denial of a loan application, combined with data fields used to make underwriting decisions, would improve the ability to understand lenders’ decision-making and to identify possible discriminatory lending patterns in underwriting. Pricing information, such as rate spread for additional types of loans, total loan costs, total discount points, lender credits, and interest rate, would allow users to better understand pricing decisions and the cost of credit to mortgage borrowers. Information about manufactured housing and multifamily financing would allow users to better understand important sources of housing for low-income and potentially financially vulnerable borrowers, which helps users determine whether financial institutions are serving the housing needs of their communities and helps public officials target public investment 49 Yana Kunichoff, ‘‘Lisa Madigan credits Reporter with initiating largest discriminatory lending settlements in U.S. history,’’ Chicago Rep. (June 14, 2013), available at http:// www.chicagonow.com/chicago-muckrakers/2013/ 06/lisa-madigan-credits-reporter-with-initiatinglargest-discriminatory-lending-settlements-in-u-shistory/; Press Release, N.Y. State Off. of the Att’y Gen., ‘‘Attorney General Cuomo Obtains Approximately $1 Million For Victims Of Greenpoint’s Discriminatory Lending Practices’’ (July 16, 2008), available at http://www.ag.ny.gov/ press-release/attorney-general-cuomo-obtainsapproximately-1-million-victims-greenpoints. 50 Although certain regulators have access to the non-public HMDA data, their analyses also rely heavily on data fields that are publicly disclosed. E:\FR\FM\25SEN1.SGM 25SEN1 asabaliauskas on DSKBBXCHB2PROD with NOTICES 44592 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices to better attract private investment. Information about the ages of applicants or borrowers and disaggregated racial and ethnic information would assist in identifying potentially discriminatory lending patterns and help determine whether financial institutions are serving the housing needs of their communities. Data fields about occupancy status and home-equity lines of credit provide information about potentially speculative purchases of housing and the degrees of leverage borrowers are undertaking. This information would better allow users to identify trends in the mortgage market that may increase systemic risk to the overall economy. Understanding these risks helps public officials distribute public-sector investment and helps users determine whether financial institutions are serving the housing needs of their communities. Today, HMDA data represent a public good that responds to the fact that private lenders do not, in the ordinary course, make information about their loans and lending decisions publicly available. HMDA provides the only source of loan-level mortgage data with comprehensive national coverage that is free and easily accessible to the public. Other publicly available mortgage datasets lack information crucial for HMDA’s purposes that is found in the HMDA data, such as the race, ethnicity, and sex of applicants and borrowers. Private data vendors sell several large datasets that typically contain data collected from the largest mortgage loan servicers or securitizers, but none of these datasets match the coverage of the HMDA data. These private datasets also typically lack information that identifies individual lenders and therefore cannot be used to study whether specific lenders are meeting community needs or may be making discriminatory credit decisions. Additionally, the Bureau is aware of no private dataset that includes information about applications that do not result in originated loans. By including applications in addition to originated and purchased loans, HMDA provides a near-census of the mortgage market that allows users to draw a detailed picture of the supply and demand of mortgage credit at various levels of geographic and lender aggregation. Finally, unlike the HMDA data, private datasets are costly for subscribers, creating a substantial hurdle for many community groups, government agencies, and researchers that wish to access them. HMDA data also benefit users by addressing the information asymmetries present in credit markets. The degree of control that lenders exercise over the VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 mortgage lending process gives them a significant information advantage over borrowers, researchers, and other members of the public. This advantage can contribute to certain types of lender behavior, such as discrimination or predatory lending, that conflict with the best interests of borrowers and the housing needs of communities. The relative difference in information may also lead to herding behavior where both lenders and consumers pursue risky mortgage loans based primarily on the popularity of these products, creating substantial systemic risk to the mortgage market and the financial system. Publicly available mortgage data increase transparency in the mortgage market, narrowing the information gap between lenders and borrowers, community groups, and public officials. Greater information can enable these latter parties to advocate for financial institutions to maintain fair practices and serve the housing needs of their communities, and can increase the prospect of self-correction by financial institutions. Additional information also helps to reduce the herding behavior of both lenders and borrowers, reducing systemic risk. Risks to Applicant and Borrower Privacy Interests The Bureau has considered the risks to applicant and borrower privacy that may be created by the public disclosure of the HMDA data that will be reported to the agencies under the 2015 HMDA Final Rule. Based on its analysis to date, the Bureau believes that public disclosure of the unmodified loan-level dataset, as a whole, would create risks to applicant and borrower privacy interests under the HMDA balancing test. As described in more detail below, this is due to the presence in the dataset of individual data fields that the Bureau believes would create re-identification risk and the presence of individual data fields that the Bureau believes would create a risk of harm or sensitivity. However, the Bureau believes that the modifications to the loan-level HMDA dataset proposed in this Policy Guidance would reduce these risks to applicant and borrower privacy and appropriately balance them with the benefits of disclosure for HMDA’s purposes. Re-Identification Risk In evaluating the potential reidentification risk presented by the disclosure of the unmodified loan-level HMDA data that will be reported under the 2015 HMDA Final Rule, the Bureau has considered the data fields contained in the dataset, the likely methods by PO 00000 Frm 00038 Fmt 4703 Sfmt 4703 which applicants and borrowers could be identified in the dataset, the nature and availability of additional datasets that may be useful to the reidentification of HMDA data, and the incentives and capabilities of persons interested in re-identification. The Bureau uses the term ‘‘adversary’’ when referring to such persons.51 The term is not intended to indicate that the adversary’s motives are necessarily malicious or adverse to the interests of the individuals in the dataset. In the HMDA context, the Bureau is concerned about two re-identification scenarios. First, an adversary may use common data fields to match a HMDA record to a record in another dataset that contains the identity of the applicant or borrower. Second, an individual may rely on pre-existing personal knowledge to recognize an applicant or borrower’s record in the unmodified HMDA data. Under the first scenario, it may be possible to match a HMDA record to a record from an identified dataset directly, or data fields from additional datasets may need to be matched to the HMDA record to complete the match to the identified record. However, successfully re-identifying a HMDA record would require several steps and may present a significant challenge. First, an adversary generally would have to isolate a record that is unique within the HMDA data. A HMDA record is unique when the values of the data fields associated with it are shared by no other HMDA record. But a HMDA record’s uniqueness alone would not automatically result in its reidentification; an adversary would have to find a record corresponding to the applicant or borrower in another dataset that shares data fields with the unique HMDA record that permit the records to be matched. Once a unique HMDA record has been matched to a corresponding record, an adversary would possess any additional fields found in the corresponding record but not found in the HMDA record, such as the identity of the applicant or borrower.52 However, even after accomplishing such a match, an adversary might not have accurately reidentified the true applicant or borrower to whom the HMDA record relates.53 51 See, e.g., Nat’l Inst. of Standards & Tech., ‘‘DeIdentification of Personal Information (2015),’’ available at http://nvlpubs.nist.gov/nistpubs/ir/ 2015/NIST.IR.8053.pdf (using ‘‘adversary’’ to refer to an entity attempting to re-identify data). 52 If the corresponding record lacks the name of the applicant or borrower, an adversary may be able to use data fields from the corresponding record to match to a record in another identified dataset. 53 For example, if the corresponding record is not the only record in the other dataset that shares certain data fields with the unique HMDA record, E:\FR\FM\25SEN1.SGM 25SEN1 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices asabaliauskas on DSKBBXCHB2PROD with NOTICES The HMDA data that will be reported under the 2015 HMDA Final Rule, like the data reported under current Regulation C, contain data fields that create re-identification risk. First, the HMDA data display a high level of record uniqueness.54 As explained above, record uniqueness alone does not mean that a record can be re-identified, but a unique HMDA record could be matched to a corresponding record in another dataset that is available to an adversary. In the HMDA context, the Bureau believes that particularly relevant sources of identified data for matching purposes are publicly available real estate transaction records and property tax records. Although there is variance by jurisdiction, such records are often available electronically and typically identify a borrower through documents such as the mortgage or deed of trust. These documents typically include the loan amount, the financial institution, the unique identifier assigned to the mortgage originator, the borrower’s name, and the property address, and may include other information. Because some of these data fields are also present in the HMDA data, the Bureau believes that the release of loan-level HMDA data without any modifications would create a risk that these public records could be directly matched to a HMDA record to re-identify an applicant 55 or borrower. an adversary would have to make a probabilistic determination as to which corresponding record belongs to the applicant or borrower. Also, depending on the coverage of the other dataset, a corresponding record may be unique in the other dataset but not unique in the general population. 54 In 2005, researchers at the Board found that ‘‘[m]ore than 90 percent of the loan records in a given year’s HMDA data are unique—that is, an individual lender reported only one loan in a given census tract for a specific loan amount.’’ Robert B. Avery et al., ‘‘New Information Reported under HMDA and Its Application in Fair Lending Enforcement,’’ at 367 Fed. Reserve Bulletin (Summer 2005), available at http:// www.federalreserve.gov/pubs/bulletin/2005/305hmda.pdf. 55 None of the public or private datasets discussed herein include information about applications that do not result in originated mortgage loans. The Bureau believes that the lack of public information about applications would significantly reduce the likelihood that an adversary could match the record of a HMDA loan application that was not originated to an identified record in another dataset. Therefore, the Bureau believes that the risk of reidentification to applicants is significantly lower than the risk to borrowers. However, some of the information contained in the unmodified HMDA data for applicants may permit an adversary to reidentify an applicant despite the lack of publicly available real estate records reflecting the transaction. For example, if an applicant withdraws an application and obtains a loan secured by the same property from another institution, it may be possible to link the HMDA data for the withdrawn application with the data for the origination, as VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 Other publicly available sources of data similar to those included in the HMDA data that will be reported under the 2015 HMDA Final Rule include loan-level performance datasets made available by the Government-Sponsored Enterprises (GSEs) and mortgage-backed securities datasets made available by the Securities and Exchange Commission through the Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system.56 The loan-level performance datasets include data fields similar to those that will be included in the unmodified HMDA data, such as credit score, loan amount, interest rate, debtto-income ratio, combined loan-to-value ratio, and loan-to-value ratio. The mortgage-backed securities dataset includes similar information, such as the credit score, loan amount, lien status, property value, and debt-toincome ratio. These datasets are available online with limited restrictions on access. But these datasets do not include the name of the borrower; as described above, this means that an adversary who is able to match a record in one of these datasets to a record in HMDA would need to make an additional match to an identified dataset to re-identify a borrower. And some of these datasets contain restrictions on use, such as a prohibition on attempting to re-identify individual borrowers.57 Private datasets that could be matched to the HMDA data are also available. For example, data brokers collect information about consumers from a wide range of sources and sell it for a variety of purposes, including marketing, identity verification, and fraud detection.58 These datasets much of the property and borrower information will be identical. 56 SE.C., ‘‘Electronic Data Gathering, Analysis, and Retrieval (EDGAR),’’ https://www.sec.gov/ edgar.shtml (last visited January 26, 2017); Fannie Mae, ‘‘Fannie Mae Single-Family Loan Performance Dataset,’’ http://www.fanniemae.com/portal/ funding-the-market/data/loan-performancedata.html (last visited Jan. 26, 2017); Freddie Mac, ‘‘Single Family Loan-Level Dataset,’’http:// www.freddiemac.com/news/finance/sf_loanlevel_ dataset.html (last visited Jan. 26, 2017); Ginnie Mae, ‘‘Data Dictionaries,’’ http://www.ginniemae.gov/ investors/disclosures_and_reports/Pages/ Disclosure-Data-Dictionaries.aspx (last visited Jan. 26, 2017). 57 See, e.g., Freddie Mac, ‘‘Terms for SingleFamily Loan-Level Dataset Registration and Login Pages,’’ https://freddiemac.embs.com/FLoan/ HistoricalDataTerms.html (last visited Mar. 20, 2017). 58 See generally Fed. Trade Comm’n, ‘‘Data Brokers: A Call for Transparency and Accountability,’’ (May 2014), available at https:// www.ftc.gov/system/files/documents/reports/databrokers-call-transparency-accountability-reportfederal-trade-commission-may-2014/ 140527databrokerreport.pdf (describing the types of PO 00000 Frm 00039 Fmt 4703 Sfmt 4703 44593 typically include data collected from commercial, government, and other publicly available sources and may contain data about mortgage loan borrowers, including age, income, loanto-value ratio, property value, loan amount, address, race, ethnicity, and origination date. Other datasets specific to mortgage loans are provided for purposes of evaluating mortgage-backed securities, identifying marketing opportunities, or analyzing market trends. These datasets may include loan amount, interest rate, credit score, negative amortization features, and closing date. Some of these datasets include the names of consumers, although others contain de-identified loan-level mortgage data. However, these datasets may contain contractual restrictions on use and re-disclosure, including prohibiting their use for reidentification purposes, and may be cost-prohibitive for many potential adversaries. In addition to considering the steps an adversary would need to complete to reidentify the HMDA data and the various data sources that may be required to accomplish re-identification, including their limitations, the Bureau also has considered the capacity, incentives, and characteristics of potential adversaries, including those that may attempt reidentification for harmful purposes. The Bureau believes that some potential adversaries may be interested in reidentifying the HMDA data for marketing or other commercial purposes. For example, the unmodified HMDA data contain information about applicants and borrowers, and features of the loans they obtained or applied for, that the Bureau believes would have commercial appeal for marketing and advertising. Although extensive data about identified consumers is already available to marketers, the Bureau believes that at least some of the HMDA data that may be useful to marketers are typically not publicly available from any source for marketing purposes, are available in limited circumstances,59 or may be less reliable or precise than the HMDA data may be perceived to be.60 These potential adversaries could possess the resources to use private products offered and the data sources used by data brokers). 59 For example, a marketer currently may obtain from a consumer reporting agency a ‘‘prescreened’’ list of consumers meeting certain criteria, such as a minimum credit score, only for the purpose of making a ‘‘firm offer of credit or insurance.’’ 15 U.S.C. 1681b(c), 1681a(l). 60 For example, private datasets may only contain an estimate of the household income, while the HMDA data contains the gross annual income relied on by the financial institution, which may be more accurate. E:\FR\FM\25SEN1.SGM 25SEN1 asabaliauskas on DSKBBXCHB2PROD with NOTICES 44594 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices datasets in addition to publicly available records to re-identify the HMDA data. However, the Bureau has considered the extent to which much of the commercial benefit to be obtained by re-identifying the HMDA data may be more readily available from private datasets to which these potential adversaries already have access without the need for recourse to the HMDA data. In many cases, information from other datasets may be timelier than that found in the HMDA data, where the delay between action taken on a loan and disclosure of the loan-level HMDA data ranges from 3 to 15 months. Further, some of these potential adversaries may refrain from re-identifying the HMDA data for reputational reasons or because they have agreed to restrictions on using data from the additional datasets described above for re-identification purposes. Additionally, although most academics, researchers, and journalists use HMDA data only for HMDA purposes or market monitoring, some may be interested in re-identifying the HMDA data for purposes of research. These persons may differ in their capacity to re-identify an applicant or borrower in the HMDA data. The Bureau believes that those who lack resources are likely to attempt to match a HMDA record to publicly available datasets such as real estate transaction records, while those with relatively greater resources may also rely on private datasets. However, as mentioned above, some private datasets may have contractual terms prohibiting their use for re-identification purposes. Further, those academics or journalists with significant resources may be affiliated with organizations that have reputational or institutional interests that would not be served by reidentifying the HMDA data. These factors may reduce the risk of reidentification by such persons. The Bureau has considered whether parties intending to commit identity theft or financial fraud may have the incentive and capacity to re-identify the HMDA data. As discussed further below, the Bureau believes that the HMDA data would be of minimal use for these purposes. For example, the HMDA data will not include information typically required to open new accounts in a consumer’s name, such as Social Security number, date of birth, place of birth, passport number, or driver’s license number, nor will they include information useful to perpetrate existing account fraud, such as account numbers or passwords. Further, these potential adversaries are not law abiding and may have easier, albeit illegal, ways VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 to secure data for these purposes than attempting to re-identify loan-level HMDA data. The resources of these potential adversaries likely vary, so some may be able to use private datasets in addition to publicly available records to re-identify the HMDA data were they to attempt to do so. In addition to the possibility of reidentifying borrowers through matching HMDA data to other datasets, some potential adversaries may be able to reidentify a particular applicant or borrower in the HMDA data by relying on personal knowledge about the applicant or borrower. As noted above, the Bureau believes that the HMDA data display a high level of record uniqueness, and the unmodified HMDA data include location and demographic information, such as race, sex, ethnicity, and age, that may be known to a potential adversary who is familiar with a specific applicant or borrower. Therefore, such a potential adversary may be able to re-identify a known applicant or borrower even if traditionally identifying information is not disclosed and without attempting to match a HMDA record to an identified record. This potential adversary could include a neighbor or acquaintance of the applicant or borrower, and the interest in re-identification may range from mere curiosity to the desire to embarrass or otherwise harm the applicant or borrower. Although these potential adversaries may lack the sophistication or resources required to re-identify a HMDA record by matching it to other datasets, they may possess a high level of specific knowledge about the characteristics of a particular applicant or borrower. Because the preexisting personal knowledge possessed by such a potential adversary is typically limited to information about a single individual, or a small number of individuals, any re-identification attempt by such a potential adversary would likely target or impact a limited number of individuals. Although the Bureau believes that location and demographic information may be more likely to be known than other information in the HMDA data, it is impossible to predict the exact content of any pre-existing personal knowledge that such a potential adversary may possess. This uncertainty creates challenges for evaluating the degree to which individual data fields contribute to the risk of re-identification by such a potential adversary.61 61 For example, although the Bureau is aware of no dataset with detailed information on mortgage loan applicants, an adversary with personal PO 00000 Frm 00040 Fmt 4703 Sfmt 4703 Risk of Harm or Sensitivity The Bureau has considered whether, if a loan-level record in the HMDA dataset were re-identified, HMDA data that will be reported under the 2015 HMDA Final Rule would disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. To the extent a HMDA record could be associated with an identified applicant or borrower and could also be successfully matched to another deidentified dataset to re-identify such a dataset, harmful or sensitive information in that dataset that is not otherwise public may also be disclosed. The Bureau has considered whether the HMDA data could be used for harmful purposes such as perpetrating fraud or identity theft against an applicant or borrower or for targeted marketing of products and services that may pose risks that are not apparent. The Bureau has also considered whether certain HMDA data fields may be viewed as sensitive if associated with a particular applicant or borrower, even where the disclosure of the data field is unlikely to lead to financial or other tangible harms. In evaluating the potential sensitivity of a data field, the Bureau has also considered whether disclosure of the data field could cause dignity or reputational harm or embarrassment, or could be considered outside of societal or cultural expectations with respect to what information is available to the general public. As noted above, today, significant amounts of identifiable data concerning consumers is available to the general public, including in public records. Identifiable consumer information is also available from commercial data sources with varying barriers to access and restrictions on use. In evaluating the risk of harm or sensitivity created by the public disclosure of loan-level HMDA data, the Bureau’s analysis has considered the degree to which such disclosure would increase these risks to applicant and borrower privacy compared to the risks that already exist, absent the public availability of the data in HMDA. Accordingly, the Bureau has considered whether the data that will be reported under the 2015 HMDA Final Rule are typically publicly available in an identifiable form and, if so, any barriers to accessing the information or restrictions on its use. Depending on the nature and extent of the public availability of a particular data field, the Bureau generally considers public knowledge of an applicant could identify an applicant in the HMDA data. E:\FR\FM\25SEN1.SGM 25SEN1 asabaliauskas on DSKBBXCHB2PROD with NOTICES Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices availability to reduce any risk of harm or sensitivity that may be created by the public disclosure of the data field in the loan-level HMDA data. For example, although some borrowers may consider the amount of their mortgage to be sensitive, the Bureau believes that this information is often publicly available and considers such availability to reduce the risk of harm or sensitivity that may be created by the disclosure of this unmodified data field in the HMDA data. In other words, if potentially harmful or sensitive information about an applicant or borrower is already available to the general public, disclosure of that information in the loan-level HMDA data creates less risk of additional harm or sensitivity than if the data were otherwise not publicly available about the applicant or borrower. In evaluating the risk of harm or sensitivity created by the disclosure of the loan-level HMDA data, the Bureau also has considered the likelihood that the loan-level HMDA data would be reidentified and used for harmful purposes or to embarrass or damage the reputation of an applicant or borrower. As discussed above, the Bureau generally believes that successful reidentification of loan-level HMDA data would require several steps and may represent a significant challenge. Even where an adversary is able to match a HMDA record to a record in an identified dataset, the adversary still may not have accurately identified the true applicant or borrower to whom the HMDA record relates. To the extent that the risk that re-identification would be accomplished is low, the risk of disclosing harmful or sensitive information is reduced. The Bureau believes that the unmodified loan-level HMDA data that will be reported under the 2015 HMDA Final Rule would be of minimal use for purposes of perpetrating identity theft or financial fraud against applicants and borrowers. As noted above, the HMDA data will not include information typically required to open new accounts in a consumer’s name, such as Social Security number, date of birth, place of birth, passport number, or driver’s license number, nor do they include information useful to perpetrate existing account fraud, such as account numbers or passwords.62 Although almost any information relating to an individual 62 As noted above, however, to the extent a HMDA record could be associated with an identified applicant or borrower and could also successfully be matched to a de-identified dataset to re-identify such a dataset, harmful or sensitive information in that dataset that is not otherwise public may also be disclosed. VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 could at least theoretically be used by an adversary seeking to steal the identity of or commit fraud against the individual, the Bureau does not believe that disclosure of the HMDA data would be likely to increase information available for these purposes. For example, the HMDA data will include the name of the financial institution and other details about the loan terms that could be used in a phishing attack against an applicant or borrower by a perpetrator pretending to be the financial institution,63 but data that could be used for this purpose are often already available in publicly available real estate transaction records. The Bureau has also considered whether the HMDA data could be used for knowledge-based authentication purposes,64 but believes the data are unlikely to increase information available that is typically used for such purposes. The Bureau believes that some of the unmodified loan-level HMDA data would provide information that is not already public and could be used to target applicants and borrowers for marketing, including marketing for products and services that may pose risks that are not apparent. As noted above, the unmodified HMDA data would provide information about an applicant’s or borrower’s financial condition and, with respect to a borrower, details about the loan obtained. The Bureau believes that, at least for a period of time after the loanlevel HMDA data are disclosed, this information may be useful to those looking to offer financial products and services or otherwise improve market segmentation. Although these data could be used to market products and 63 Phishing is an attempt by a perpetrator to obtain sensitive information, such as account numbers or passwords, by masquerading as a legitimate company. Phishing is typically conducted by fraudulent email messages appearing to come from a legitimate company that direct the recipient to a spoofed Web site or otherwise get the recipient to divulge private information. The perpetrators then use this private information to commit identity theft. 64 Knowledge-based authentication (KBA) is a method of authentication which seeks to prove the identity of someone accessing a service, such as an account at a financial institution. KBA requires the knowledge of information about a particular individual to prove that a person attempting to access a service is the individual. ‘‘Static’’ KBA, also known as ‘‘shared secrets,’’ relies on information initially shared by the individual to the provider of the service, such as an answer to a question, which is later retrieved when an individual seeks to access the service. ‘‘Dynamic’’ KBA uses knowledge questions to verify identity but does not require the individual to have provided the questions and answers beforehand. Dynamic KBA questions are compiled from data known to or obtained by the institution, such as transaction history or data from credit reports. PO 00000 Frm 00041 Fmt 4703 Sfmt 4703 44595 services that would be beneficial for applicants and borrowers, perhaps increasing competition among lenders that could help consumers receive the best loan terms possible, they could also be used to target potentially vulnerable consumers with marketing for products and services that may pose risks that are not apparent. For example, certain information about a loan might be perceived to reveal information about a borrower’s sophistication as a consumer of financial products and services, and information about a borrower’s financial condition may suggest vulnerability to scams relating to debt relief or credit repair. Finally, the Bureau believes that some of the unmodified loan-level HMDA data that will be reported to the agencies under the 2015 HMDA Final Rule would be considered sensitive by most consumers. In assessing whether a data field creates a risk of sensitivity, the Bureau has considered if its disclosure could lead to dignity or reputational harm or embarrassment, or could be considered outside of societal or cultural expectations with respect to what information is available to the general public. Balancing Risks and Benefits In applying the balancing test, the Bureau has considered the risks to applicant and borrower privacy interests that would be created by the public disclosure of the unmodified loan-level HMDA data that will be reported under the 2015 HMDA Final Rule and the benefits of such disclosure in light of HMDA’s purposes. As discussed above, assessing risks to applicant and borrower privacy under the balancing test requires an evaluation of the unmodified HMDA dataset as a whole and of the individual data fields contained in the dataset. In developing this proposal, the Bureau reviewed the contribution of each data field, individually and in combination, toward the potential re-identification of an applicant or borrower in the HMDA dataset. As described above, for purposes of the HMDA balancing test, a significant re-identification risk is created by uniqueness in the HMDA data among data fields that are also found in other records that identify an applicant or borrower. The Bureau has reviewed the availability of public records in several jurisdictions and has also considered qualitative factors such as the capacity, incentives, and characteristics of potential adversaries that may be interested in reidentification, the public availability of HMDA data fields in other datasets, the barriers to obtaining these datasets, and E:\FR\FM\25SEN1.SGM 25SEN1 asabaliauskas on DSKBBXCHB2PROD with NOTICES 44596 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices the degree to which the other datasets are identifiable. The Bureau has also considered whether certain data fields may be more likely than others to be known by a potential adversary with personal knowledge about the applicant or borrower. The Bureau also considered whether disclosure of the loan-level HMDA data, if it were to be re-identified, would reveal information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. As described above, this consideration involved reviewing the potential for disclosure to cause financial fraud or identity theft, harmful targeted marketing, or sensitivity concerns. The Bureau considered the nature of potential harms that might result from disclosure of each data field individually and in combination, and the strength of the field’s contribution to such harms. The Bureau also considered whether each data field is typically publicly available in identified records and, if so, any barriers to accessing the information or restrictions on its use. In addition, the Bureau evaluated the contribution of the data fields, both individually and in combination, toward the purposes of HMDA: Helping to determine whether financial institutions are serving the housing needs of their communities; assisting public officials in distributing publicsector investment so as to attract private investment to areas where it is needed; and assisting in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Every HMDA data field provides benefits to achieving the statutory purposes, but different data fields may provide more value for certain statutory purposes or types of analyses. Data fields were examined for both current and potential uses. For data fields the public disclosure of which the Bureau preliminarily believes would create risks to applicant and borrower privacy interests, either because a field increases reidentification risk or poses a risk of harm or sensitivity, the Bureau has weighed these risks against the benefits of disclosure. Where the Bureau has preliminarily determined that the disclosure of an individual data field, alone or in combination with other fields, would create risks to applicant and borrower privacy that are not justified by the benefits of disclosure to HMDA’s purposes, the Bureau has considered whether it could appropriately balance the privacy risks and disclosure benefits through strategies such as binning, rounding, VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 and top- and bottom-coding,65 or whether the public dataset should be modified by excluding the field. The Bureau has also evaluated the risks and benefits of disclosing a data field in light of the proposed modifications considered for the other data fields. The Bureau is mindful of the connection between the risk of re-identification and the risk of harm or sensitivity. To the extent that the risk of re-identification created by disclosure of the HMDA data is reduced, the risk of disclosing harmful or sensitive information is also reduced. Conversely, to the extent that the public loan-level HMDA data do not disclose information that is harmful or sensitive, the consequences of reidentification are reduced. Where the Bureau has preliminarily determined that some modification of a data field is appropriate, the Bureau’s consideration of the available forms of modification for the HMDA data is also informed by the operational challenges associated with various forms of modification and the need to make financial institutions’ modified loan/application registers available to the public by March 31 following the calendar year for which the data are reported.66 B. Application of the Balancing Test to Loan-Level HMDA Data As described above, the Bureau has interpreted HMDA to require that public HMDA data be modified when the release of the unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such release to the public in light of HMDA’s purposes. Based on its analysis to date, the Bureau believes that public disclosure of the unmodified loan-level data that will be reported to the agencies under the 2015 HMDA Final Rule, as a whole, would create risks to applicant and borrower privacy 65 Binning, sometimes known as recoding or interval recoding, allows data to be shown clustered into ranges rather than as precise values. Top- and bottom-coding masks the precise values of a data field that appear above or below a certain threshold. 66 As discussed below in part IV.B, the Bureau will make a modified loan/application register for each financial institution available on its Web site by March 31 following the calendar year for which the information was compiled. With respect to data compiled in 2018 or later, this proposed Policy Guidance describes the modifications the Bureau proposes to apply to each financial institution’s modified loan/application register, with the possible exception of modifications to reflect whether the loan amount is above the applicable dollar amount limitation on the original principal obligation in effect at the time of application or origination as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2), which may be disclosed later than March 31. HMDA data is reported by March 1 of the year following the calendar year for which the information was compiled, leaving the Bureau as little as 30 days to prepare each financial institution’s modified loan/application register. PO 00000 Frm 00042 Fmt 4703 Sfmt 4703 interests under the HMDA balancing test. This is due to the presence in the data of individual data fields that the Bureau believes would create reidentification risk and the presence of individual data fields that the Bureau believes would create a risk of harm or sensitivity. The Bureau has applied the balancing test to determine whether and how to modify the HMDA data that will be reported under the 2015 HMDA Final Rule before it is disclosed to the public and is seeking comment on its proposed modifications. For the reasons discussed below, based on its application of the balancing test, the Bureau proposes to exclude or otherwise modify the following data fields in the loan-level HMDA data disclosed to the public: Universal loan identifier (ULI), application date, loan amount, action taken date, property address, age, credit score, debt-toincome ratio, property value, the unique identifier assigned by the Nationwide Mortgage Licensing System and Registry for the mortgage loan originator (NMLS ID); and automated underwriting system (AUS) result. The Bureau also proposes to exclude the content of free-form text fields used in certain instances to report the following data: Race, ethnicity, name and version of credit score model, reason for denial, and AUS system name. The Bureau proposes to publicly disclose without modification the remaining data reported to the agencies under the 2015 HMDA Final Rule. As discussed above, HMDA and Regulation C require the FFIEC to make available to the public certain aggregated data. The Bureau, in consultation with the other agencies, intends to evaluate options for providing the HMDA data, including the modified data, to the public in aggregated form, including through the aggregated data products the FFIEC is required to make available and other vehicles.67 The Bureau acknowledges that the proposed modifications would not completely eliminate risks to applicant and borrower privacy that would likely be created by the disclosure of loanlevel HMDA data, but the Bureau believes that these modifications would reduce such risks to the extent necessary to appropriately balance them with the benefits of disclosure for HMDA’s purposes. The Bureau believes that, to the extent that the public disclosure of the loan-level HMDA data, modified as proposed, would create risks to applicant and borrower privacy, such risks would be justified by the benefits of such release to the public in light of HMDA’s purposes. 67 See E:\FR\FM\25SEN1.SGM part IV.C, below. 25SEN1 asabaliauskas on DSKBBXCHB2PROD with NOTICES Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices The Bureau has considered whether, in light of what it believes to be a reduced risk of re-identification for HMDA records reflecting an application where no loan was originated, more data could be disclosed without modification for those records. As discussed above, the Bureau believes that the lack of publicly available information about applications would make it significantly more difficult for an adversary to reidentify an applicant by matching a HMDA record to a record from an identified dataset. However, the Bureau believes that some risk of reidentification by matching may remain in some circumstances,68 and notes that an adversary’s personal knowledge may also permit re-identification of an application record. Further, the possibility that transactions could be reported as applications in error and be subsequently corrected in a resubmission would create risk that the previously-applied modifications would no longer be appropriate; the previously-disclosed HMDA data would have revealed information creating risks to applicant and borrower privacy that would not be justified by the benefits of disclosure. Finally, an approach requiring that different types of records in the dataset are subject to different modifications would be operationally challenging and costly to implement. In light of these privacy and operational concerns, the Bureau is not proposing this approach at this time, but invites comment on it. The Bureau seeks comment on all aspects of its analysis and the modifications it proposes to apply to the public loan-level HMDA dataset under the balancing test. The Bureau notes that, even after it finalizes this Policy Guidance, it intends to continue to monitor developments affecting the application of the balancing test to the HMDA data. The privacy landscape is constantly evolving, and risks to applicant and borrower privacy created by the disclosure of loan-level HMDA data may change as the result of technological advances and other external developments. For example, a new source of publicly available records may become available, increasing or decreasing privacy risks under the balancing test, or the Bureau may discover evidence suggesting that individuals are using the HMDA data in unforeseen, potentially harmful ways. Potential uses of the loan-level HMDA data in furtherance of the statute’s purposes may also evolve, such that the benefits associated with the disclosure of certain data may increase to an extent 68 See supra note 53. VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 that justifies providing more information to the public. For example, a new loan program may emerge with debt-to-income ratio requirements that increase the benefits of releasing more precise information about the debt-toincome ratios of applicants or borrowers than the Bureau proposes herein to release. Such developments and other changed circumstances may require that, even after this proposed Policy Guidance is finalized, the Bureau revisit the conclusions previously reached based on the application of the balancing test in order to ensure the appropriate protection of applicant and borrower privacy in light of HMDA’s purposes. The Bureau is proposing this Policy Guidance to provide transparency, obtain public feedback, and improve the Bureau’s decisionmaking. This proposed Policy Guidance and any final Policy Guidance concerning the public disclosure of loan-level HMDA data are non-binding in part because flexibility to revise the modifications proposed to apply to the public loan-level HMDA data is necessary to maintain a proper balancing of the privacy risks and benefits of disclosure, especially in the event the Bureau becomes aware of new facts and circumstances that might contribute to privacy risks. However, except where not practical, unnecessary, or where public interest requires otherwise, the Bureau intends to seek public input on any future revisions to modifications to the public loan-level HMDA it might consider. Data To Be Disclosed in the Loan-Level HMDA Data Without Modification As discussed above, the 2015 HMDA Final Rule requires financial institutions to report information about originations and purchases of mortgage loans, as well as mortgage loan applications that do not result in originations. The Bureau proposes to disclose the following data fields to the public as reported, without modification:69 • The following information about applicants, borrowers, and the underwriting process: Income, sex, race, ethnicity, name and version of the credit scoring model, reasons for denial, and AUS name. • The following information about the property securing the loan: Census tract, State, county, occupancy type, construction method, manufactured housing secured property type, 69 As mentioned above and discussed further below, the Bureau proposes not to disclose freeform text fields used in certain instances to report the following data: The name and version of the credit scoring model, race, ethnicity, reasons for denial, and AUS name. PO 00000 Frm 00043 Fmt 4703 Sfmt 4703 44597 manufactured housing land property interest, and total units. • The following information about the application or loan: Loan term, loan type, loan purpose, application channel, whether the loan was initially payable to the financial institution, whether a preapproval was requested, action taken, type of purchaser, lien status, prepayment penalty term, introductory rate period, interest rate, rate spread, total loan costs or total points and fees, origination charges, total discount points, lender credits, HOEPA status, balloon payment, interest-only payment, negative amortization, other nonamortizing features, combined loan-tovalue ratio, open-end line of credit flag, business or commercial flag, and reverse mortgage flag. • The following information about the lender: Legal Entity Identifier (LEI), and financial institution name.70 Many of these data fields were adopted in the 2015 HMDA Final Rule, while several are already required to be reported under current Regulation C. All of the data fields required by current Regulation C listed above are currently disclosed as reported without modification in the modified loan/ application register that each financial institution makes available to the public and in the agencies’ loan-level release.71 For the reasons discussed below, the Bureau proposes to publicly disclose the data fields listed above without modification in the loan-level HMDA data and requests comment on its proposal. With the exception of LEI, financial institution name, census tract, income, action taken (where the loan is denied), and reasons for denial, which are discussed further below, the Bureau believes that disclosure of the data fields listed above would likely present low risk to applicant and borrower privacy. First, the Bureau believes that, if the HMDA data were re-identified, disclosure of most of these data fields would likely create minimal, if any, risk of harm or sensitivity to applicants or borrowers. These fields include basic information about the features of the loan or the property securing the loan— such as the application channel, loan term, and lien status—rather than information about personal 70 See 12 CFR 1003.4(a)(2)–(7), (a)(8)(i), a(9)(ii), (a)(10)(i), (a)(10)(iii), (a)(11)–(14), (a)(15)(i) (name of scoring model), (a)(16)–(22), (a)(24)–(27), (a)(29)– (33), (a)(35)(i) (name of system), (a)(36)–(38) (effective Jan. 1, 2018). 71 The only data fields excluded from the public loan-level HMDA data under current Regulation C are the identifying number for the loan or loan application, the application date, and the action taken date. E:\FR\FM\25SEN1.SGM 25SEN1 44598 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices asabaliauskas on DSKBBXCHB2PROD with NOTICES characteristics or financial condition of the applicant or borrower, and the Bureau believes that applicants and borrowers are unlikely to consider the disclosure of this information to be sensitive. Further, the Bureau is aware of no clear advantage provided by most of these data fields for targeted marketing of products and services that may pose risks that are not apparent. The Bureau believes that certain fields about the loan, such as the pricing data fields, and certain fields about the borrower, such as ethnicity and race, may create relatively more risk of harm or sensitivity, but that these fields still present low privacy risk. Second, the Bureau believes that disclosure of most of these data fields would likely create minimal, if any, risk of substantially facilitating the re-identification of applicants and borrowers in the HMDA data. Most of these data fields are not found in publicly available sources of records that contain the identity of an applicant or borrower; without such an identified publicly available record, an adversary would experience substantial difficulty attempting to re-identify an applicant or borrower by matching a HMDA record using these data fields. Certain data fields may create relatively more risk of re-identification because they contain values that are not widely shared among applicants or borrowers, such as an ethnic and racial category, but the Bureau believes these fields still present low re-identification risk.72 As described above, public disclosure of these low-risk data fields benefits users in determining whether financial institutions are serving the housing needs of their communities; in distributing public-sector investment so as to attract private investment to areas where it is needed; and in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. To the extent that disclosure of these fields would create risk to applicant and borrower privacy, the 72 Although the Bureau believes that ethnic and racial categories are not found in publicly available sources of identified records, comparing the ethnicity and race found in the HMDA record to the surname found in an identified public record may help an adversary narrow the range of public records against which to match a HMDA record. Information on surnames, in other contexts, has proven useful to proxy for ethnicity or race. The Bureau also believes that ethnicity and racial category may be more likely to be known by adversaries with personal knowledge of the applicant or borrower than other fields listed above. The Bureau seeks comment in particular on whether this risk is heightened with respect to disaggregated ethnicity and race and whether these disaggregated fields should be treated differently than aggregated ethnicity and race. VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 Bureau believes the risks would be justified by the benefits of disclosure. The Bureau believes that disclosure of the following data fields listed above would likely substantially facilitate the re-identification of applicants or borrowers: LEI, financial institution name, and census tract. The Bureau believes that publicly available real estate transaction records such as mortgages and deeds of trust typically contain the identity of the borrower, the name of the financial institution, and the property address, from which an adversary may derive the census tract. Although the uniqueness of a HMDA record will vary by census tract, the Bureau believes that these data fields could be used by an adversary to match a HMDA record to an identified public record. The Bureau also believes that, if the HMDA data were re-identified, disclosure of the following data fields listed above would likely create a risk of harm or sensitivity: Income, action taken (where the loan is denied), and reasons for denial. These data fields are not otherwise available to the general public in an identified form without barriers to access or use restrictions.73 The Bureau believes that these data fields would likely be considered sensitive by many if not most consumers. Many consumers avoid sharing their incomes, even with personal acquaintances.74 The fact that a financial institution denied an application and some of the reasons for denial, such as employment history, credit history, debt-to-income ratio, or insufficient cash, could reveal negative details about a consumer’s personal financial situation.75 The Bureau also believes that these data fields could be used for harmful purposes, such as targeted marketing of products and services that may pose risks that are not apparent. The Bureau nonetheless believes that these risks to applicant and borrower 73 The Bureau believes that, although estimates of income may be available in private datasets, reliable income information typically is not available to the general public without barriers to access or use restrictions. The HMDA data will include the gross annual income relied on in making the credit decision, which may be more accurate. 74 The Bureau believes that consumers may still consider income information to be sensitive even though it is rounded to the nearest thousand when reported by financial institutions. 75 The Bureau notes that the fact that a loan was denied and the reasons for denial are reported only for applications that have been denied. As discussed above, the Bureau believes that the risk of re-identification of applicants where a loan is not originated is significantly lower than the risk to borrowers. Because these data fields are difficult to associate with an identified applicant or borrower, the Bureau believes that the risk of harm or sensitivity created by their disclosure is reduced. PO 00000 Frm 00044 Fmt 4703 Sfmt 4703 privacy are justified by the benefits of disclosure in light of HMDA’s purposes. For years, these data fields have proven critical for furthering HMDA’s purposes.76 For example, the ability to identify the financial institution by name is critical for users to evaluate the lending practices of a financial institution.77 The census tract is essential for users to determine the availability of credit in certain communities and to identify potentially discriminatory lending patterns at the community level. Information about income ensures that users who are evaluating potential disparities in underwriting or pricing are comparing applicants or borrowers with similar incomes, thereby controlling for a factor that might provide a legitimate explanation for such disparities. Income data can also allow users to determine the availability of credit to consumers and communities of various income levels. Finally, action taken and reasons for denial, combined with underwriting information, help users compare the outcomes received by applicants and borrowers to identify potential disparities between similarly qualified applicants. The reasons for denial also help users understand why a particular loan application was denied and identify potential barriers in access to credit. The Bureau believes that, under the balancing test, the benefits of public disclosure of these data fields to HMDA’s purposes would justify the risks to applicant and borrower privacy such disclosure would likely create. In forming its proposal to publicly disclose these data fields without modification, the Bureau considered modifications that would reduce the risks to applicant and borrower privacy while preserving the benefits of disclosure. However, with the exception of income and census tract, which have for years proven critical for furthering HMDA’s purposes, no modifications other than exclusion from the public loan-level HMDA data are reasonably available for these data fields. Therefore, modification in these circumstances 76 Several data fields adopted in the 2015 HMDA Final Rule are closely related to, or extensions of, data fields reported under current Regulation C. Specifically, the LEI will replace the current reporter’s ID, and reasons for denial may currently be reported at the option of the financial institution. However, financial institutions supervised by the OCC and the FDIC currently are required by those agencies to report denial reasons. 12 CFR 27.3(a)(1)(i), 128.6, 390.147. 77 The LEI would enhance identification by allowing users to link the reporting financial institution to its corporate family. If the financial institution name is publicly disclosed, the LEI creates minimal, if any, additional privacy risk. E:\FR\FM\25SEN1.SGM 25SEN1 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices Universal Loan Identifier The 2015 HMDA Final Rule requires financial institutions to report a universal loan identifier (ULI) for each covered loan or application that can be used to identify and retrieve the application file.78 The 2015 HMDA Final Rule sets forth detailed requirements concerning the ULI to be assigned and reported.79 A ULI must begin with the financial institution’s LEI, followed by up to 23 additional characters to identify the covered loan or application, and then end with a twocharacter check digit calculated according to the methodology prescribed in appendix C of the 2015 HMDA Final Rule.80 In addition, a ULI must be unique within the institution and must not contain any information that could be used to directly identify the application or borrower.81 Institutions reporting a loan for which a ULI was previously assigned and reported must report the ULI that was previously assigned and reported for the loan. The ULI will be submitted as an alphanumeric field.82 The requirement to report a ULI replaces the requirement under current Regulation C that a financial institution report an identifying number for the loan or loan application.83 The loan or loan application number is currently excluded from both the modified loan/ application register that each financial institution makes available to the public and the agencies’ loan-level release. The Bureau added the requirement to report a ULI to implement the Dodd-Frank Act’s amendment to HMDA providing for the collection and reporting of, ‘‘as the Bureau may determine to be appropriate, a universal loan identifier.’’ 84 For the reasons given below, the Bureau believes that, depending on how financial institutions will use ULIs once they are adopted for HMDA purposes, disclosing the ULI in the loan-level HMDA data could substantially facilitate the re-identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, until information is available concerning how financial institutions use ULIs other than for HMDA purposes, the Bureau proposes to modify the loan-level HMDA dataset made available to the public by excluding the ULI. A ULI would allow users to track over time a loan reported in HMDA data by different financial institutions. Using a ULI, a user could identify a loan originated by a HMDA reporter that is later purchased by another HMDA reporter, then sold and purchased again by yet another HMDA reporter. Understanding a loan’s history would assist in identifying whether financial institutions are serving the housing needs of their communities. Widespread adoption of ULIs to identify mortgage loans in other datasets also could allow users to track a loan from ‘‘cradle to grave,’’ i.e., to link information disclosed in the public HMDA data with information found in other datasets, such as datasets reflecting loan performance. The Bureau believes that, depending on how financial institutions use ULIs other than for HMDA purposes, public disclosure of a ULI in the loan-level HMDA data could create a significant risk of re-identification. If financial institutions include ULIs on loan documents that are made publicly available, the Bureau believes that disclosure of the ULI in the public loanlevel HMDA data would substantially facilitate the re-identification of HMDA records. As discussed above, many jurisdictions publicly disclose real estate transaction records in an identified form, such as mortgages and deeds of trust, and the Bureau believes that many financial institutions include loan numbers on these publiclyrecorded documents.85 The Bureau believes that financial institutions may replace the loan numbers currently 78 12 CFR 1003.4(a)(1)(i) (effective January 1, 2018). 79 Id. 80 12 CFR 1003.4(a)(1)(i)(A) through (C). 81 12 CFR 1003.4(a)(1)(i)(B)(3). 82 Bureau of Consumer Fin. Prot., ‘‘Filing instructions guide for HMDA data collected in 2018—OMB Control #3170–0008,’’ at 14, 48 (Jan. 2017), available at http://www.consumerfinance. gov/data-research/hmda/static/for-filers/2018/ 2018-HMDA-FIG.pdf. 83 See 12 CFR 1003.4(a)(1). 84 12 U.S.C. 2803(b)(6)(G). 85 For example, in response to concerns about implications under the Gramm-Leach-Bliley Act (GLBA) of the ‘‘longstanding common practice for a mortgage lender to place the borrower’s account number on a mortgage loan document to enable the document to be tracked and place in the proper file once the document is recorded and returned from the recording office,’’ Federal regulators issued guidance in 2001 opining that such practice does not violate the GLBA. See Letter from Fed. Reserve Board, Fed. Dep. Ins. Corp., Nat’l Credit Union Admin., Off. of the Comptroller of the Currency, Off. of Thrift Supervision, and Fed. Trade Comm’n (Sept. 4, 2001). would eliminate public utility of these data fields entirely. The Bureau seeks comment on its proposal to publicly disclose these fields without modification in the loan-level HMDA data. asabaliauskas on DSKBBXCHB2PROD with NOTICES Data To Be Excluded or Otherwise Modified in the Loan Level HMDA Data VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 PO 00000 Frm 00045 Fmt 4703 Sfmt 4703 44599 assigned to mortgage loans with ULIs 86 and that, if they do, the ULI likely will be included on publicly-recorded loan documents. Especially in light of the uniqueness of a ULI, a ULI on a publicly-recorded loan document could be used to match a HMDA record to an identified public record directly and reliably. The Bureau notes that the FFIEC excluded identifying numbers for loans and applications from the agencies’ loan-level HMDA data release because the data field could be used to identify an applicant or borrower in the data.87 Similarly, Congress later identified applicant ‘‘identification number’’ as a field that the Board should consider deleting from the modified loan/ application register in order to protect the privacy of applicants and borrowers.88 In implementing this amendment to HMDA, the Board required that financial institutions remove ‘‘application or loan number’’ from the modified loan/application register before making it available to the public.89 The Bureau believes that a ULI would disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. A ULI is associated with a particular application or loan. As noted above, the 2015 HMDA Final Rule prohibits a financial institution from including in a ULI assigned to an application or loan information about the applicant or borrower that could be used to directly identify the applicant or borrower. Commentary to this provision clarifies that ‘‘information that could be used to directly identify the applicant or borrower includes but is not limited to the applicant’s or borrower’s name, date of birth, Social Security number, official government-issued driver’s license or identification number, alien registration number, government passport number, or employer or taxpayer identification number.’’ 90 Although the Bureau 86 In response to comments, the Bureau noted in the supplementary information to the 2015 HMDA Final Rule that a financial institution may use a ULI for both HMDA purposes and the loan identification number prescribed by Regulation Z § 1026.37(a)(12). 80 FR 66128, 66177 (Oct. 28, 2015). 87 The FFIEC noted that ‘‘[a]n unedited form of the data would contain information that could be used to identify individual loan applicants’’ and that the data would be edited prior to public release to remove the application identification number, the date of application, and the date of final action. 55 FR 27886, 27888 (July 6, 1990). 88 HMDA section 304(j), added by the Housing and Community Development Act, section 932(a), 106 Stat. 3672, 3889 (1992). 89 12 CFR 1003.5(c). 90 Comment 4(a)(1)(i)–2 (effective Jan. 1, 2018). E:\FR\FM\25SEN1.SGM 25SEN1 44600 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices believes that financial institutions may include information within a ULI that is pertinent to the institution’s operations, as some do now with respect to loan numbers, it does not believe that such information would be considered sensitive or could be used for harmful purposes. The Bureau has considered whether a modification to the public loan-level HMDA dataset other than exclusion of the ULI would appropriately reduce the privacy risks created by the disclosure of the ULI in the loan-level data while maintaining some utility for HMDA’s purposes. For example, the Bureau has considered whether it could, in the loan-level HMDA data disclosed to the public, replace the reported ULI with a different unique number, such as a hashed value.91 The Bureau also has considered whether it might use some other means to link HMDA records sharing the same ULI without revealing the ULI itself. The Bureau is unable to identify a feasible modification at this time, however. The Bureau believes at this time that, under the balancing test, excluding the ULI is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. Application Date asabaliauskas on DSKBBXCHB2PROD with NOTICES The 2015 HMDA Final Rule requires financial institutions to report, except for purchased covered loans, the date the application was received or the date shown on the application form.92 This date will be submitted by financial institutions as the exact year, month, and day, in the format of YYYYMMDD.93 Financial institutions are required to report this data field under current Regulation C. The Board amended Regulation C in 1989 to require reporting of the date the application was received as part of its implementation of the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA), which expanded HMDA to include data on applications, as well as data on the race, gender, and income of individual applicants and borrowers.94 The 91 A hashed value would be based on the ULI and created by a secure hash algorithm. A hash algorithm is designed to be non-invertible, meaning that the original value, in this case the actual ULI, could not be derived from the hashed value. The hashed value would only appear in the HMDA data; as it would not appear in public records, it could not be used to re-identify the HMDA record. 92 12 CFR 1003.4(a)(1)(ii) (effective Jan. 1, 2018). 93 Supra note 83 at 49. 94 Financial Institutions Reform, Recovery, and Enforcement Act, Public Law 101–73, section 1211, VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 application date is currently excluded from both the modified loan/application register that each financial institution makes available to the public and the agencies’ loan-level release.95 For the reasons given below, the Bureau believes that disclosing the application date in the loan-level HMDA data released to the public would likely substantially facilitate the re-identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA data made available to the public by excluding the date the application was received. The application date may be useful for identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. In enacting the FIRREA amendments to HMDA, Congress sought to improve the ability of HMDA users to identify possible discriminatory lending patterns by expanding HMDA to allow for comparison of accepted and rejected applications.96 The date of application furthered the purposes underlying this expansion. The application date helps ensure that users are comparing applicants or borrowers who applied for loans during similar dates, thereby controlling for factors that might provide a legitimate explanation for disparities, such as different market interest rates over different time periods. Users of HMDA data may also use the application date, in combination with the action taken date, to screen for delays between application and action dates that appear to exist on prohibited bases. The Bureau believes that public disclosure of application date would likely substantially facilitate the reidentification of an applicant or borrower in the HMDA data. Disclosing the date of application would increase the ability of an adversary to associate a HMDA record with an applicant or borrower by matching it to an identified publicly available record. As discussed above, many jurisdictions publicly disclose real estate transaction records in an identified form, such as mortgages or deeds of trust. These records contain the date that the lender and borrower entered into or executed the agreement. This date is correlated with the application date data field, which reflects either the date the application was received or the date shown on the 103 Stat. 183, 524–26 (1989); 54 FR 51356 (Dec. 15, 1989). 95 See 12 U.S.C. 2803(j)(2)(B)(i); 12 CFR 1003.5(c). 96 H. Rept. 101–209, at 463–65 (1989). PO 00000 Frm 00046 Fmt 4703 Sfmt 4703 application form. Therefore, an adversary could use the date of application, combined with other data fields, to narrow the range of identified public records against which to compare the HMDA data, increasing the likelihood of matching records. The Bureau notes that the FFIEC excluded the application date from the agencies’ loan-level HMDA data release because the data field could be used to re-identify a particular applicant or borrower in the data.97 Similarly, when Congress directed that the Board require deletions from the loan-level HMDA data financial institutions must make available to the public to protect the privacy of applicants and borrowers, it identified the application date in particular as one field to be considered for deletion.98 If the HMDA data were re-identified, the Bureau believes that application date would likely disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. Application date is not an inherently sensitive data field. Unlike other dates, such as date of birth, the date of application contains no intrinsic connection to an individual. Instead, the information is associated with an applicant or borrower for only a single transaction in the context of mortgage lending. Further, the Bureau believes that the date of application would be unlikely to be used for targeted marketing of products and services that may pose risks that are not apparent. HMDA data is disclosed annually based on the calendar year in which action is taken on an application. Although the Bureau proposes not to disclose the application date, the year of the loan-level HMDA data will often correspond to the year in which the application was received. The Bureau considered binning the values reported for the application date into quarterly or semi-annual intervals. However, the Bureau believes that quarterly intervals would fail to reduce re-identification risk adequately and that, compared to not disclosing application date, the gains in data utility that semi-annual intervals might allow do not justify the increase in privacy risk. Disclosing the date of application in quarterly intervals would provide an individual with a 97 The FFIEC noted that ‘‘[a]n unedited form of the data would contain information that could be used to identify individual loan applicants’’ and that the data would be edited prior to public release to remove the application identification number, the date of application, and the date of final action. 55 FR 27886, 27888 (July 6, 1990). 98 Housing and Community Development Act, Public Law 102–550, section 932(a), 106 Stat. 3672, 3889 (1992). E:\FR\FM\25SEN1.SGM 25SEN1 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices asabaliauskas on DSKBBXCHB2PROD with NOTICES narrower range of identified public records against which to compare the HMDA data.99 And although disclosing application dates in semi-annual intervals would reduce re-identification risk as compared to quarterly intervals, the Bureau believes it would only marginally increase the utility over the current, annual intervals while still increasing privacy risk. Users would need a narrower range to help ensure that they were comparing applicants who applied under similar market conditions. The Bureau believes at this time that, under the balancing test, excluding the application date is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. Loan Amount The 2015 HMDA Final Rule requires financial institutions to report the amount of the covered loan or the amount applied for.100 For closed-end mortgage loans, open-end lines of credit, and reverse mortgages, this amount is the amount to be repaid as disclosed on the legal obligation, the amount of credit available to the borrower, and the initial principal limit, respectively. The loan amount will be submitted by financial institutions in numeric form reflecting the exact dollar amount of the loan.101 Financial institutions are required to report this data field under current Regulation C rounded to the nearest thousand.102 Although HMDA has always required financial institutions to report information about the dollar amount of a financial institution’s mortgage lending activity,103 the Board amended Regulation C in 1989 to require reporting of the loan amount on a loan-level basis as part of its implementation of FIRREA.104 For the reasons given below, the Bureau believes that disclosing the loan amount in the loan-level HMDA data released to the public would likely substantially facilitate the reidentification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA dataset disclosed to the public 99 The Bureau previously identified quarterly release of the loan-level HMDA data as a potential privacy concern. 80 FR 66128, 66243 (Oct. 28, 2015). 100 12 CFR 1003.4(a)(7) (effective Jan. 1, 2018). 101 Supra note 83, at 51. 102 12 CFR 1003, Appendix A, I.A.20. 103 12 U.S.C. 2803 104 12 U.S.C. 2803 VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 by disclosing the midpoint for the $10,000 interval into which the reported loan amount falls and by indicating whether the loan amount exceeds the applicable dollar amount limitation on the original principal obligation in effect at the time of application or origination as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2) (‘‘GSE conforming loan limit’’).105 For example, for a reported loan amount of $117,834, the Bureau would disclose $115,000 as the midpoint between values equal to $110,000 and less than $120,000. The loan amount is useful for determining whether financial institutions are serving the housing needs of their communities. By examining loan amount, users can better understand the amount of credit that financial institutions have made available to consumers in certain communities and the extent to which such institutions are providing credit in varying amounts. Loan amount is also beneficial for identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. For example, the loan amount allows users to divide the population of applicants or borrowers into segments that may be subject to different underwriting or pricing policies, such as those applying for non-conforming mortgage loans. Combined with the property value, the loan amount would also allow users to calculate a loan-tovalue ratio, an important variable in underwriting. The loan amount and loan-to-value ratio would help ensure that users who are evaluating potential disparities in underwriting outcomes, pricing, or other terms and conditions are comparing applicants or borrowers who applied for or obtained loans with similar loan amount and loan-to-value ratios, thereby controlling for factors that might provide a legitimate explanation for disparities. The Bureau believes that disclosing the exact loan amount would likely substantially facilitate the reidentification of an applicant or borrower. The loan amount is a numeric 105 The dollar amount limitation on the original principal obligation as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2) refers to the annual maximum principal loan balance for a mortgage acquired by Fannie Mae and Freddie Mac (the ‘‘GSEs’’). The Federal Housing Finance Agency is responsible for determining the maximum conforming loan limits for mortgages acquired by the GSEs. See Press Release, Fed. Hous. Fin. Agency, ‘‘FHFA Announces Increase in Maximum Conforming Loan Limits for Fannie Mae and Freddie Mac in 2017’’ (Nov. 23, 2016) https:// www.fhfa.gov/Media/PublicAffairs/Pages/FHFAAnnounces-Increase-in-Maximum-ConformingLoan-Limits-for-Fannie-Mae-and-Freddie-Mac-in2017.aspx. PO 00000 Frm 00047 Fmt 4703 Sfmt 4703 44601 data field that will often consist of at least six digits, which increases its contribution to the uniqueness of a particular HMDA record. As discussed above, this information is also found in identified real estate transaction records such as mortgages and deeds of trust that are publicly disclosed by many jurisdictions. Therefore, in many cases, an adversary could use the exact loan amount, combined with other fields, to match a HMDA record to an identified publicly available record. If the HMDA data were re-identified, the Bureau believes that loan amount would likely disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. In some cases, high loan amounts, combined with other information, may be considered sensitive or may indicate financial vulnerability that could form the basis for targeted marketing of products and services that may pose risks that are not apparent. The loan amount may also at least theoretically be used for phishing attacks. However, the Bureau believes that loan amount is often already included in identified publicly available documents, such as the mortgage or deed of trust. The Bureau believes that this existing public availability decreases any potential sensitivity and harmfulness of disclosing loan amount in the HMDA data. The Bureau believes that the loanlevel HMDA data may be modified to appropriately reduce the privacy risks created by the public disclosure of the loan amount while preserving much of the benefits of the data field. The Bureau believes that disclosing the midpoint for the $10,000 interval into which the reported loan amount falls, and indicating whether the loan amount exceeds the applicable GSE conforming loan limit, provides enough precision to allow users to rely on loan amount to achieve HMDA’s purposes. For example, $10,000 intervals will allow users to segment applicants and borrowers that may be subject to different underwriting or pricing policies. In fact, for intervals that include the applicable GSE conforming loan limit, an indication of whether the loan amount is above the applicable limit may provide greater precision than is provided by the loan-level HMDA data currently disclosed to the public, in which certain loan amounts above and below the applicable limit will round to the same thousand. $10,000 intervals will not allow users to calculate an exact loan-to-value ratio, although users may still derive an estimated loan-tovalue ratio. However, the Bureau believes that releasing the combined E:\FR\FM\25SEN1.SGM 25SEN1 asabaliauskas on DSKBBXCHB2PROD with NOTICES 44602 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices loan-to-value ratio, as it proposes to do, will be more beneficial for fair lending purposes than the loan-to-value ratio that users would have calculated from the exact loan amount and property value. Disclosing loan amount in $10,000 intervals also decreases the ability of adversaries to match HMDA data to identified public records by reducing the uniqueness of a data field common to both datasets. Because the Bureau is also proposing to modify reported property value similarly, adversaries will be unable to use the combined loan-to-value ratio to reduce the effectiveness of the proposed modification by deriving the reported loan amount. Although the proposed modifications do not entirely eliminate the risk of re-identification that the Bureau believes would likely be created by the disclosure of loan amount information, the Bureau believes that the remaining risk would be justified by the benefits of disclosing loan amount with the proposed modifications. Therefore, the Bureau believes at this time that, under the balancing test, modifying loan amount as described above appropriately balances the privacy risks and disclosure benefits. The Bureau seeks comment on this proposal, including the proposed $10,000 intervals to be used for binning, the proposal to disclose the midpoint for each interval, and the proposal to indicate whether the reported loan amount exceeds the applicable GSE conforming loan limit. Additionally, the Bureau seeks comment on whether to indicate that a reported loan amount exceeds the applicable limit for loans eligible for insurance by the Federal Housing Administration (FHA conforming loan limit).106 Factors not reflected in the HMDA data may affect the accuracy of any such indicator, such as whether the loan amount has been increased by the amount of any onetime or up-front mortgage insurance premium that will be financed as part of the loan, in which case the loan may be eligible for insurance despite appearing in the HMDA data to exceed the applicable FHA conforming loan limit.107 The Bureau seeks comment on the value of indicating whether the reported loan amount exceeds the FHA conforming loan limit in light of these limitations. Action Taken Date The 2015 HMDA Final Rule requires financial institutions to report the date of action taken by the financial institution on a covered loan or 106 See 107 24 24 CFR 203.18. CFR 203.18c. VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 application.108 For originated loans, this date is generally the date of closing or account opening.109 Regulation C provides some flexibility in reporting the date for other types of actions taken, such as applications denied, withdrawn, or approved by the institution but not accepted by the applicant. For example, for applications approved but not accepted, a financial institution may report ‘‘any reasonable date, such as the approval date, the deadline for accepting the offer, or the date the file was closed,’’ provided it adopts a generally consistent approach.110 This date is submitted by financial institutions as the exact year, month, and day, in the format of YYYYMMDD.111 Financial institutions are required to report this data field under current Regulation C. As with the application date, the Board added the requirement to report the action taken date as part of the amendments to Regulation C that implemented FIRREA.112 The action taken date is also currently excluded from both the modified loan/application register that each financial institution makes available to the public and the agencies’ loan-level release.113 For the reasons given below, the Bureau believes that disclosing the action taken date in the loan-level HMDA data released to the public would likely substantially facilitate the identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA dataset made available to the public by excluding the date of action taken by the financial institution. The action taken date may be useful for identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. The fair lending benefits provided by the date of action taken are similar to those provided by the date of application, described above. The action taken date helps ensure that users who are evaluating potential disparities in pricing or other terms and conditions are comparing applicants or borrowers who obtained loans on similar dates, thereby controlling for factors that might provide a legitimate explanation for such disparities, such as different market interest rates or different 108 12 CFR 1003.4(a)(8)(ii) (effective Jan. 1, 2018). 4(a)(8)(ii)–5 (effective Jan. 1, 2018). 110 Comment 4(a)(8)(ii)–4 (effective Jan. 1, 2018). 111 Supra note 83, at 52. 112 54 FR 51356 (Dec. 15, 1989). 113 See 12 U.S.C. 2803(j)(2)(B)(i); 12 CFR 1003.5(c). 109 Comment PO 00000 Frm 00048 Fmt 4703 Sfmt 4703 institutional practices over different time periods. Users of HMDA data may also use the date of action taken, in combination with application date, to screen for delays between application and action dates that appear to exist on prohibited bases. The Bureau believes that disclosing the action taken date would likely substantially facilitate the reidentification of an applicant or borrower in the HMDA data. Disclosing the action taken date would increase the ability of an adversary to associate a HMDA record with an individual by matching it to an identified publicly available record. As explained above, many jurisdictions publicly disclose real estate transaction records in an identified form, such as mortgages or deeds of trust. These records contain the date that the lender and borrower entered into or executed the agreement, which, like the application date, is closely correlated with the action taken date. Indeed, because the action taken date for originated loans is generally the date of closing or account opening, in most cases these dates will be identical. Therefore, in many cases, an adversary could use the action taken date, combined with other data fields, to match a HMDA record to an identified public record. The Bureau notes that, as with the application date, the FFIEC excluded the action taken date from the agencies’ loan-level HMDA data release because the data field could be used to reidentify a particular applicant or borrower in the data.114 Similarly, Congress later identified the action taken date as one field that the Board should consider deleting from the modified loan/application register to protect the privacy of applicants and borrowers.115 If the HMDA data were re-identified, the Bureau believes that, similar to the application date, the action taken date would likely disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. As with the application date, the action taken date is not an inherently sensitive data field; it is associated with an applicant or borrower for only a single transaction in the context of mortgage lending and 114 The FFIEC noted that ‘‘[a]n unedited form of the data would contain information that could be used to identify individual loan applicants’’ and that the data would be edited prior to public release to remove the application identification number, the date of application, and the date of final action. 55 FR 27886, 27888 (July 6, 1990). 115 Housing and Community Development Act, Public Law 102–550, section 932(a), 106 Stat. 3672, 3889 (1992). E:\FR\FM\25SEN1.SGM 25SEN1 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices does not reflect an intrinsic connection to an individual. Further, the Bureau believes that the action taken date would be unlikely to be used for targeted marketing of products and services that pose risks that may not be apparent. Although the Bureau proposes not to disclose the action taken date, the loanlevel data will disclose the year in which final action was taken. As with application date, the Bureau considered binning the values reported for action taken date into quarterly or semi-annual intervals. However, the Bureau believes that quarterly intervals would fail to reduce re-identification risk adequately and that, compared to not disclosing action taken date, the gains in data utility that semi-annual intervals might allow do not justify the increase in privacy risk. Disclosing the action taken date in quarterly intervals would still provide an individual with a narrow range of identified public records against which to compare the HMDA data. And although disclosing action taken dates in semi-annual intervals would reduce re-identification risk as compared to quarterly intervals, it would only marginally increase the utility over the current, annual intervals, while still increasing privacy risk. Users would need a narrower range to help ensure that they were comparing borrowers who obtained loans under similar market conditions. The Bureau believes at this time that, under the balancing test, excluding action taken date is a modification to the public loanlevel HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure.116 The Bureau seeks comment on this proposal. asabaliauskas on DSKBBXCHB2PROD with NOTICES Property Address The 2015 HMDA Final Rule requires financial institutions to report the address of the property securing the loan or, in the case of an application, proposed to secure the loan.117 This address corresponds to the property identified on the legal obligation related to the covered loan.118 The format of the 116 However, as described above, the year of the loan-level HMDA data will disclose the year in which the action was taken. With respect to quarterly release of the HMDA data, the Bureau stated in the 2015 HMDA Final Rule that, based on its analysis to date, ‘‘disclosure of loan-level data with more granular date information than year of final action would create risks to applicant and borrower privacy that are not outweighed by the benefits of such disclosure.’’ 80 FR 66128, 66243 n.389 (Oct. 28, 2015). 117 12 CFR 1003.4(a)(9)(i) (effective Jan. 1, 2018). 118 Comment 4(a)(9)(i)–1 (effective Jan. 1, 2018). For applications ‘‘the address should correspond to the location of the property proposed to secure the loan as identified by the applicant.’’ VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 property address submitted by financial institutions will include, as applicable, the street address, city name, State name, and zip code.119 Financial institutions are not required to report this data field under current Regulation C. The Bureau added the requirement to report property address in the 2015 HMDA Final Rule to implement the Dodd-Frank Act’s amendment to HMDA providing for the collection and reporting of, ‘‘as the Bureau may determine to be appropriate, the parcel number that corresponds to the real property pledged or proposed to be pledged as collateral.’’ 120 For the reasons given below, the Bureau believes that disclosing the property address in the loan-level HMDA data released to the public would substantially facilitate the reidentification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA dataset made available to the public by excluding the property address. The address of the property securing the loan would be useful for identifying possible discriminatory lending patterns. With the exact property address, users could examine these patterns at a finer level of detail than that permitted by the census tract or other geographic boundaries. More precise geographic identification would also better allow public officials to target geographic areas that might benefit from public or private sector investment. Users could also better determine whether financial institutions are serving the housing needs of their communities with information that would enable identification of specific neighborhoods and communities smaller than census tracts. Finally, the property address would allow users to understand better the amount of equity retained in that property over time by tracking multiple liens associated with the same dwelling. This information would help identify communities with overleveraged properties. The Bureau believes that disclosure of the property address itself would likely present minimal, if any, risk of harm or sensitivity. Property owners’ addresses are generally widely publicly available.121 As explained above, the 119 Comment 4(a)(9)(i)–2 (effective Jan. 1, 2018). U.S.C. 2803(b)(6)(H). 121 The Bureau understands that some jurisdictions may allow borrowers to prevent their identities from being disclosed in public records, and some applicants or borrowers, such as victims of domestic violence, may hide their addresses to prevent certain individuals from locating them in 120 12 PO 00000 Frm 00049 Fmt 4703 Sfmt 4703 44603 Bureau considers this public availability to reduce the risk of harm and sensitivity from the release of this data field. However, the Bureau believes that the widespread availability of property addresses creates a significant risk of reidentification. The Bureau believes that adversaries could easily match the property address contained in the HMDA data to identified publicly available property address information. Property addresses are publicly available through a number of sources, including real estate transaction records, property tax records, reverse phone directories, online real estate databases, and online ‘‘people search’’ Web sites. Because the address disclosed under Regulation C typically would be identical to the address contained in these publicly available records, an adversary would know that any match was likely to be accurate. Therefore, disclosing the property address in the loan-level HMDA data would substantially facilitate the reidentification of an applicant or borrower. Further, even if disclosing the property address would not permit matching, the Bureau believes that the disclosure of the property address alone could be used in harmful ways. For example, disclosure of property address would allow an applicant or borrower to be targeted with marketing for products and services that may pose risks that are not apparent. As an alternative to excluding the property address data field from the loan-level HMDA data released to the public, the Bureau considered releasing property address in a less granular form. For example, the Bureau could release geographic information that identifies the property securing the loan with less specificity. However, for most reportable transactions, Regulation C already requires reporting of three additional, less-precise geographic identifiers: (1) State; (2) county; and (3) census tract. As discussed above, the Bureau proposes to release these data fields without modification. Further, as discussed below in part IV.A, the Bureau proposes to identify in the public loan-level HMDA data the MSA or MD for each reported record. Other geographic identifiers exist with a level of precision between census tract and property address to which property addresses could be mapped, such as census block and census block group. However, the Bureau believes that these identifiers present similar reidentification risk to property address because they are sufficiently precise to person or to prevent other unwanted intrusions upon the sanctuary or seclusion of their homes. E:\FR\FM\25SEN1.SGM 25SEN1 44604 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices asabaliauskas on DSKBBXCHB2PROD with NOTICES enable an adversary to match them to publicly available property address information. The Bureau believes at this time that, under the balancing test, excluding property address is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. Age The 2015 HMDA Final Rule requires financial institutions to report the age of an applicant or borrower.122 A financial institution complies with this requirement by reporting age, as of the application date reported, as the number of whole years derived from the date of birth as shown on the application form.123 The Bureau added the requirement in the 2015 HMDA Final Rule to report age to implement the Dodd-Frank Act’s amendment to HMDA providing for the collection and reporting of age.124 For the reasons given below, the Bureau believes that disclosing the applicant or borrower age in the loanlevel HMDA data released to the public would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA dataset disclosed to the public by binning and top- and bottom-coding age and by indicating whether the reported value is 62 or higher. Applicant or borrower age would assist users in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Age would be useful to evaluate potential age discrimination in lending.125 Disclosure of applicant or borrower age also would assist in identifying whether financial institutions are serving the housing needs of their communities, including the needs of various age cohorts. The Bureau believes that, if the HMDA data were re-identified, disclosure of applicant or borrower age would likely reveal information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. The Bureau believes that, 122 12 CFR 1003.4(a)(10)(ii) (effective Jan. 1, 2018). 123 Comment 4(a)(1)(ii)–1 (effective Jan. 1, 2018). 124 12 U.S.C. 2803(b)(4). 125 For example, ECOA and Regulation B generally prohibit creditors from discriminating against applicants in credit transactions on the basis of age. 12 U.S.C. 1691(b)(1); 12 CFR 1002.4(a). VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 although information about an individual’s age may be available for purchase under some circumstances, birth and similarly reliable records reflecting age typically are not available to the general public without barriers to access or use restrictions. The Bureau believes that age likely would be considered sensitive by many if not most consumers and that disclosure of an identified applicant’s or borrower’s age could lead to dignity harm or embarrassment. The Bureau believes that many consumers would consider the disclosure of identified age to the general public to be outside of societal and cultural expectations. The Bureau also believes that identified age could be used to target marketing to applicants and borrowers, including marketing for products and services that may pose risks that are not apparent, and that the inclusion of this data field in the public loan-level HMDA data would increase the risk of such uses compared to today. The Bureau notes that in section 304(h)(3)(A), added by the Dodd-Frank Act, Congress specifically identified age as a data field to which a modification under section 304(h)(1)(E) should apply if the Bureau determines it to be necessary to protect the privacy interests of applicants or borrowers.126 The Bureau believes that public disclosure in the loan-level HMDA dataset of unmodified applicant or borrower age may create some risk of facilitating the re-identification of applicants and borrowers in the HMDA data, but that this field likely would not substantially facilitate re-identification. For example, though information about an individual’s age may be available for purchase under some circumstances, the Bureau believes that an adversary typically would face difficulty attempting to re-identify an applicant or borrower in the HMDA data by using age to match HMDA records to other identified records. An applicant’s or borrower’s age may be more likely to be known than other HMDA data by a person with pre-existing knowledge of a specific applicant or borrower, however, and may help such an adversary to reidentify a particular applicant or borrower. The Bureau believes that the loanlevel HMDA data may be modified to appropriately reduce the privacy risks created by the public disclosure of age while preserving much of the benefits of the data field. The Bureau proposes to disclose age binned into the following ranges, as applicable: 25 to 34; 35 to 44; 45 to 54; 55 to 64; and 65 to 74. For example, a reported age of 52 would be 126 12 PO 00000 U.S.C. 2803(h)(3)(A)(ii). Frm 00050 Fmt 4703 Sfmt 4703 shown in the public loan-level HMDA data as between 45 and 54. The Bureau also proposes to bottom-code age under 25 and to top-code age over 74. For example, a reported age of 22 would be shown in the public loan-level HMDA data as 24 or under. The Bureau proposes the particular intervals described above to allow HMDA data users to analyze HMDA data in combination with data found in other public data sources, such as U.S. Census Bureau data.127 Finally, the Bureau proposes to indicate whether a reported age is 62 or higher to enhance the utility of the data for identifying the particular fair lending risks that may be posed with regard to elderly populations. The Bureau recognizes that an effect of this indicator would be to divide the 55 to 64 bin into two bins, 55 to 61 and 62 to 64. The Bureau seeks comment on whether privacy risks created by such increased precision are justified by the benefits of disclosure in the proposed ranges. Specifically, the Bureau seeks comment on whether, instead of binning as proposed and indicating whether a reported age is 62 or higher, the Bureau should structure the bins to disclose reported ages of 55 to 74 in ranges of 55 to 61 and 62 to 74. The Bureau believes at this time that, under the balancing test, the proposed modifications to the public loan-level HMDA dataset would appropriately balance the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal, including the proposal to bin age and the proposed intervals to be used for binning. Credit Score The 2015 HMDA Final Rule requires financial institutions to report, except for purchased covered loans, the credit score or scores relied on in making the credit decision and the name and version of the scoring model used to generate each credit score.128 It also provides that, for purposes of this requirement, ‘‘credit score’’ has the meaning set forth in section 609(f)(2)(A) of the Fair Credit Reporting Act (FCRA).129 The credit score or scores relied on in making the credit decision will be submitted as a numeric field, e.g., 650.130 A financial institution will submit a code from a specified list to indicate the name and version of the 127 See, e.g., U.S. Census Bureau, ‘‘Age and Sex Composition: 2010,’’ at tbl. 2, available at https:// www.census.gov/prod/cen2010/briefs/c2010br03.pdf (disclosing age in five-year intervals, i.e., 25 to 29, 30 to 34, 35 to 40, etc.). 128 12 CFR 1003.4(a)(15)(i) (effective Jan. 1, 2018). 129 15 U.S.C. 1681g(f)(2)(A). 130 Supra note 83, at 62–63. E:\FR\FM\25SEN1.SGM 25SEN1 asabaliauskas on DSKBBXCHB2PROD with NOTICES Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices scoring model used to generate each credit score reported.131 The Bureau added the requirement in the 2015 HMDA Final Rule to report information about the credit score or scores relied on to implement the Dodd-Frank Act’s amendment to HMDA providing for the collection and reporting of ‘‘the credit score of mortgage applicants and mortgagors, in such form as the Bureau may prescribe.’’ 132 For the reasons given below, the Bureau believes that disclosing the credit score or scores relied on in making the credit decision in the loanlevel HMDA data released to the public would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the public loan-level HMDA dataset by excluding the credit score or scores relied on in making the credit decision.133 The credit score or scores relied on in making the credit decision would assist users in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Applicants’ credit scores generally are considered to be important indicators of creditworthiness and are used in mortgage underwriting and pricing decisions. Disclosure of the credit score in the public loan-level HMDA data would help ensure that users are comparing applicants and borrowers with similar credit profiles, thereby controlling for factors that might provide a legitimate explanation for disparities in credit and pricing decisions. Credit scores would also assist in identifying whether financial institutions are serving the housing needs of their communities. For example, in order to serve the housing needs of particular communities, a financial institution may offer different types of loan products in communities with high numbers of borrowers with high credit scores than in communities with high numbers of borrowers with low credit scores. The Bureau believes that, if the HMDA data were re-identified, disclosure of the credit score relied on in making the credit decision would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. A credit score is a numerical 131 Supra note 83, at 63–64. U.S.C. 2803(b)(6)(I). 133 As noted above, the Bureau proposes to disclose without modification the reported name and version of the credit score model used. 132 12 VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 summary of a consumer’s apparent creditworthiness, based on the consumer’s credit report, and reflects the likelihood relative to other consumers that the consumer will default on a credit obligation. Identified consumer credit scores and the consumer reports upon which they are based are not available to the general public. To the extent credit scores based on consumer reports are available for commercial purposes, they may be obtained under limited circumstances and are subject to restrictions on their use.134 The Bureau believes that most consumers consider their credit score to be very sensitive information. The Bureau believes that public disclosure of an applicant’s or borrower’s identified credit score could lead to dignity or reputational harm or embarrassment, and that many consumers would consider the disclosure of identified credit scores to the general public to be outside of societal and cultural expectations. The Bureau also believes that an identified credit score could be used to target marketing to applicants and borrowers, including marketing for products and services that may pose risks that are not apparent, and that the inclusion of this data field in the public loan-level HMDA data would increase the risk of such uses compared to today.135 The Bureau notes that in section 304(h)(3)(A), added by the Dodd-Frank Act, Congress specifically identified credit score as a data field to which a modification under section 304(h)(1)(E) should apply if the Bureau determines it to be necessary to protect the privacy interests of applicants or borrowers.136 The Bureau has considered the extent to which the age of the loan-level HMDA data at the time it is disclosed may reduce the risk of harm or sensitivity created by the public disclosure of credit score were the HMDA data to be re-identified. For example, as noted above, timely data are essential for most marketing or advertising efforts, and the delay between the date a reported credit score is obtained by the financial institutions and public disclosure of the loan-level 134 Credit scores based on consumer credit reports are consumer reports for purposes of the Fair Credit Reporting Act (FCRA). Accordingly, for example, they may be obtained from a consumer reporting agency only for a permissible purpose under the statute, such as in connection with an application for credit. See 12 U.S.C. 1681b(a). 135 For example, a marketer currently may obtain from a consumer reporting agency a ‘‘prescreened’’ list of consumers meeting certain criteria, such as a minimum credit score, only for the purpose of making a ‘‘firm offer of credit or insurance.’’ 15 U.S.C. 1681b(c), 1681a(l). 136 12 U.S.C. 2803(h)(3)(A)(i). PO 00000 Frm 00051 Fmt 4703 Sfmt 4703 44605 HMDA data on the modified loan/ application register ranges from to 3 to 15 months. An applicant’s or borrower’s credit score may change enough over these time periods to reduce the usefulness of a score disclosed in the public HMDA data for marketing purposes. However, the Bureau does not believe that the passage of these time periods would reduce the risk of sensitivity created by the disclosure of credit score. For example, the Bureau does not believe that a borrower would consider the disclosure of her identified six-month-old credit score to be much less sensitive than disclosure of her current credit score; the potential for dignity or reputational harm or embarrassment from a neighbor or other acquaintance learning the information remains significant. The Bureau believes that disclosure in the loan-level HMDA data of the credit score or scores relied on in making the credit decision creates minimal risk, if any, of substantially facilitating the reidentification of applicants and borrowers in the HMDA data. As discussed above, credit scores are not included in identified records available to the general public. A creditor or marketer may possess identified credit score information obtained in connection with, for example, an application for credit or a request for a prescreened list, but the Bureau does not believe that such information would be useful for purposes of re-identifying an applicant or borrower in the loanlevel HMDA data. The variation in credit scoring models and versions, along with the likely difference in the dates that a credit score in the HMDA data and the credit score information in possession of a creditor or marketer were created, would make matching the credit score in loan-level HMDA data to such privately held information challenging and unreliable. The Bureau believes an adversary would face substantial difficulty attempting to reidentify an applicant or borrower by using credit score or scores relied on to match HMDA records to other identified records. The Bureau considered whether modifications to the public loan-level HMDA dataset other than excluding credit score, such as binning or rounding of credit score, would appropriately reduce the privacy risks created by the disclosure of credit score in the loan-level data while maintaining some utility for HMDA’s purposes. However, the Bureau believes that these strategies would not appropriately reduce the risk of harm or sensitivity and that the gains in data utility that these strategies might allow would not E:\FR\FM\25SEN1.SGM 25SEN1 44606 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices asabaliauskas on DSKBBXCHB2PROD with NOTICES justify the privacy risk created by the disclosure of the modified field. For example, the Bureau believes that, even if it were to disclose in the loan-level HMDA data the credit score for a particular record as being in one of two or three large bins, this information would still create a significant sensitivity risk if the record were reidentified. The Bureau believes that the utility to HMDA’s purposes of such binned credit score information would not justify these risks. The Bureau believes at this time that, under the balancing test, excluding credit score is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. Debt-to-Income Ratio The 2015 HMDA Final Rule requires financial institutions to report, except for purchased covered loans, the ratio of the applicant’s or borrower’s total monthly debt to the total monthly income relied on in making the credit decision (debt-to-income ratio).137 The debt-to-income ratio relied on in making the credit decision will be submitted as a percentage.138 The Bureau added the requirement in the 2015 HMDA Final Rule to report information about the debt-to-income ratio relied on using its discretionary authority to require the reporting of ‘‘such other information as the Bureau may require’’ provided by the Dodd-Frank Act’s amendment to HMDA.139 For the reasons given below, the Bureau believes that disclosing the debtto-income ratio relied on in making the credit decision in the loan-level HMDA data released to the public would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive and that, for certain debt-to-income ratio values, this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA dataset by binning and top- and bottom-coding certain debt-to-income ratio values. The debt-to-income ratio relied on in making the credit decision would assist users in identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Applicants’ debt-to-income ratios generally are considered to be important indicators of ability to repay and are used in mortgage underwriting 137 12 CFR 1003.4(a)(23) (effective Jan. 1, 2018). note 83, at 36, 38. 139 HMDA section 304(b)(6). 138 Supra VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 decisions and some pricing decisions. Disclosure of debt-to-income ratio in the public loan-level HMDA data would help ensure that users are comparing applicants and borrowers with similar profiles, thereby controlling for factors that might provide a legitimate explanation for disparities in credit and pricing decisions. Debt-to-income ratio values that are at or close to regulatory or program benchmarks are especially critical to identifying possible discriminatory lending patterns. These benchmarks include, for example, the 43 percent debt-to-income limit for a qualified mortgage under Regulation Z 140 and the debt-to-income ratio limits imposed by guarantors and investors.141 Disclosure of debt-to-income ratio also would assist in identifying whether financial institutions are serving the housing needs of their communities. For example, in order to serve the housing needs of particular communities, financial institutions may offer different types of loan products in communities with high numbers of borrowers with high debt-to-income ratios than in communities with high numbers of borrowers with low debt-to-income ratios. The Bureau believes that, if the HMDA data were re-identified, disclosure of an applicant’s or borrower’s debt-to-income ratio relied on in making the credit decision would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. The debt-to-income ratio generally reflects the amount of an applicant’s or borrower’s monthly debt, including the payment for the mortgage loan sought or originated, relative to his or her monthly income. In addition, when combined with other information that the Bureau proposes to publicly disclose in the loan-level HMDA data, such as information about the mortgage loan sought or originated and applicant or borrower income relied on in making the credit decision, disclosure of debtto-income ratio may permit a user to approximate the amount of the applicant’s or borrower’s monthly debt excluding mortgage debt. Information about a consumer’s debt is not available to the general public without barriers to access and restrictions on use. The Bureau believes that most consumers consider information about their debt to be sensitive information and that the public disclosure of an identified 140 12 CFR 1026.43(e)(2)(vi). e.g., Fannie Mae, ‘‘B3–6–02: Debt to Income Ratios,’’ (Aug. 30, 2016), available at https://www.fanniemae.com/content/guide/selling/ b3/6/02.html. 141 See, PO 00000 Frm 00052 Fmt 4703 Sfmt 4703 applicant’s or borrower’s debt-to-income ratio, especially at higher ratios, could lead to dignity or reputational harm or embarrassment. The Bureau also believes that, especially with respect to higher or lower debt-to-income ratios, identified information about an identified applicant’s or borrower’s debt could be used to target marketing to the applicant or borrower, including marketing for products and services that may pose risks that are not apparent. The Bureau believes that disclosure in the loan-level HMDA data of the debtto-income ratio relied on in making the credit decision creates minimal risk, if any, of substantially facilitating the reidentification of applicants and borrowers in the HMDA data. As mentioned above, information about a consumer’s debts is not included in identified records available to the general public and, to the extent such information is available for commercial purposes, it generally may be obtained under limited circumstances and is subject to restrictions on its use. To the extent that a creditor possessed information about an applicant or borrower’s debt or debt-to-income ratio, the Bureau does not believe that such information would be useful for purposes of re-identifying an applicant or borrower in the loan-level HMDA data. The variation in methods of calculating debt-to-income ratio along with changes in the ratio or the amount of debt over time would make using debt-to-income ratio in the public loanlevel HMDA data to match to any privately held debt or debt-to-income ratio information challenging and unreliable. The Bureau believes an adversary would face substantial difficulty attempting to re-identify an applicant or borrower by using debt-toincome ratio or debt amount to match HMDA records to other identified records. The Bureau believes that disclosing unmodified debt-to-income ratio values in the loan-level HMDA data released to the public would create risks to applicant and borrower privacy but that, with respect to debt-to-income values greater than or equal to 40 percent and less than 50 percent, these risks would be justified by the benefits of disclosure to HMDA’s purposes. Debt-to-income ratio values in this range are generally at or close to regulatory and guarantor and investor program benchmarks and are especially critical to identifying possible discriminatory lending patterns because they may reveal nondiscriminatory explanations for differential treatment. Accordingly, the Bureau proposes to release reported debt-to-income values of greater than or E:\FR\FM\25SEN1.SGM 25SEN1 asabaliauskas on DSKBBXCHB2PROD with NOTICES Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices equal to 40 percent and less than 50 percent without modification. With respect to all other debt-toincome ratio values, the Bureau believes that the risks to applicant and borrower privacy that would be created by the disclosure of the unmodified field likely would not be justified by the benefits of the disclosure, but that the loan-level HMDA data may be modified to appropriately reduce the privacy risks while preserving some of the benefits of the data field. The Bureau proposes to bin reported debt-to-income ratio values into the following ranges, as applicable: 20 percent to less than 30 percent; 30 percent to less than 40 percent; and 50 percent to less than 60 percent. For example, a reported debt-to-income ratio of 35 percent would be shown in the loan-level HMDA data disclosed to the public as a debt-to-income ratio of between 30 percent and less than 40 percent. The Bureau also proposes to bottom-code reported debt-to-income ratio values under 20 percent and to top-code reported debt-to-income ratios of 60 percent or higher. For example, a reported debt-to-income ratio of 63 percent would be shown in the public loan-level HMDA data as 61 percent or higher. The Bureau believes at this time that, under the balancing test, these modifications to the public loan-level HMDA data would appropriately balance the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau has considered whether it should disclose debt-to-income ratio at or close to 36 percent without modification.142 It is the Bureau’s understanding that, for many financial institutions, debt-to-income ratio of 36 percent serves as an internal underwriting benchmark, so that the ability to identify whether an applicant’s debt-to-income ratio is above or below this value would help users seeking to identify possible discriminatory lending patterns to control for factors that might provide a legitimate explanation for disparities in credit or pricing decisions. The Bureau seeks comment on whether the benefits of disclosing more granular information concerning debt-to-income ratio values at or around 36 percent would justify the risks to applicant and borrower privacy such disclosure would likely create and how such information should be disclosed. 142 For example, debt-to-income values of between 35 percent and 40 percent could be disclosed without modification, or the Bureau could indicate in the loan-level HMDA data disclosed to the public whether the reported debtto-income ratio is 36 percent or higher. VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 The Bureau seeks comment on this proposal, including both the proposal to bin and top- and bottom-code certain debt-to-income values and the proposed intervals to be used for binning. Property Value The 2015 HMDA Final Rule requires financial institutions to report the value of the property securing the covered loan or, in the case of an application, proposed to secure the covered loan.143 Financial institutions will report the value relied on in making the credit decision, such as an appraisal value or the purchase price of the property.144 The property value will be reported in numeric form reflecting the exact dollar amount of the value relied on.145 The Bureau added the requirement to report the property value relied on in the 2015 HMDA Final Rule to implement the Dodd-Frank Act’s amendment to HMDA providing for the collection and reporting of the value of the real property pledged or proposed to be pledged as collateral.146 For the reasons given below, the Bureau believes that disclosing the property value in the loan-level HMDA data released to the public would likely substantially facilitate the reidentification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA data by disclosing the midpoint for the $10,000 interval into which the reported property value falls. For example, for a property value of $117,834, the Bureau would disclose $115,000 as the midpoint between values equal to $110,000 and less than $120,000. The property value data field would be useful for determining whether financial institutions are serving the housing needs of their communities. Users could better understand the values of properties for which financial institutions are (and are not) providing financing to consumers in certain communities. The property value, combined with the loan amount and combined loan-to-value ratio, can also be used to determine whether the property is subject to a second lien. Property value would also be beneficial for identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. Combined with the loan amount, the property 143 12 CFR 1003.4(a)(28) (effective Jan. 1, 2018). 144 Id. 145 Supra note 83, at 71. Act section 1094(3)(A)(iv), 12 U.S.C. 2803(b)(6)(A). 146 Dodd-Frank PO 00000 Frm 00053 Fmt 4703 Sfmt 4703 44607 value would allow users to calculate a loan-to-value ratio, an important variable in underwriting. The loan-tovalue ratio would help ensure that users who are evaluating potential disparities in underwriting outcomes, pricing, or other terms and conditions are comparing applicants or borrowers who obtained or applied for loans with similar loan-to-value ratios, thereby controlling for factors that might provide a legitimate explanation for disparities. The Bureau believes that disclosing the exact property value would likely substantially facilitate the reidentification of an applicant or borrower. As with loan amount, property value is a numeric data field that will often consist of at least six digits, which increases its contribution to the uniqueness of a particular HMDA record. As discussed above, many jurisdictions publicly disclose property tax records or real estate transaction records in an identified form, such as mortgages or deeds of trust. These records contain estimates of property value or information that is closely related to property value. Although the value of the property reflected in these public records generally will not be identical to the property value relied on by the financial institution in making the credit decision, the Bureau believes that it may be close enough to permit matching. Therefore, in many cases, an adversary could use the exact property value, combined with other fields, to match a HMDA record to an identified publicly available record. If the HMDA data were re-identified, the Bureau believes that the property value would likely disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. In some cases, the property value may be combined with other information to identify borrowers with high levels of equity, which information could be used to target borrowers with predatory lending offers. For most consumers, however, the Bureau believes that property value would be unlikely to be used for targeted marketing of products and services that pose risks that may not be apparent. Indeed, the Bureau believes that information about borrower equity is already available to many marketers and may be calculated or estimated from publicly available property tax or real estate transaction records that include loan amounts and property values, such as mortgages and real estate sales records. Estimates of property value are also available through online real estate databases. E:\FR\FM\25SEN1.SGM 25SEN1 44608 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices asabaliauskas on DSKBBXCHB2PROD with NOTICES The Bureau believes that the loanlevel HMDA data may be modified to appropriately reduce the privacy risks created by the public disclosure of the property value while preserving much of the benefits of the data field. The Bureau believes that disclosing the midpoint for the $10,000 interval into which the reported property value falls provides enough precision to allow users to rely on property value to achieve HMDA’s purposes. For example, $10,000 intervals will provide general information about values of properties for which financial institutions are providing financing. Such intervals will not allow users to calculate an exact loan-to-value ratio, although users may still derive an estimated loan-to-value ratio. However, the Bureau believes that releasing the combined loan-to-value ratio, as it proposes to do, will be more beneficial for fair lending purposes than the loanto-value ratio that users would have calculated from the exact loan amount and property value. Disclosing the midpoint for the $10,000 interval into which the reported property value falls also decreases the ability of adversaries to match HMDA data to identified public records by reducing the uniqueness of a data field common to both datasets. Because the Bureau is also proposing to bin loan amount similarly, adversaries will be unable to use the combined loan-to-value ratio to reduce the effectiveness of the proposed modification by deriving the reported property value. Although such modifications do not entirely eliminate the risk of re-identification, the Bureau believes that the remaining risk would be justified by the benefits of disclosing the property value in $10,000 intervals. Therefore, the Bureau believes at this time that, under the balancing test, modifying property value as described above appropriately balances the privacy risks and disclosure benefits. The Bureau seeks comment on this proposal, including both the proposed $10,000 intervals to be used for binning and the proposal to disclose the midpoint for each interval. Nationwide Mortgage Licensing System and Registry Identifier The 2015 HMDA Final Rule requires financial institutions to report ‘‘the unique identifier assigned by the Nationwide Mortgage Licensing System and Registry [NMLSR ID] for the mortgage loan originator, as defined in Regulation G, 12 CFR 1007.102, or Regulation H, 12 CFR 1008.23, as applicable.’’ 147 The NMLSR ID will be 147 12 CFR 1003.4(a)(34) (effective Jan. 1, 2018). VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 submitted by financial institutions in numeric form, such as 123450.148 The Bureau added the requirement to report the NMLSR ID in the 2015 HMDA Final Rule to implement the Dodd-Frank Act’s requirement that financial institutions report, ‘‘as the Bureau may determine to be appropriate, a unique identifier that identifies the loan originator as set forth in section 1503 of the [Secure and Fair Enforcement for] Mortgage Licensing Act of 2008.’’ 149 For the reasons given below, the Bureau believes that disclosing the NMLSR ID in the loan-level HMDA data released to the public would likely substantially facilitate the reidentification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the loan-level HMDA data by excluding the NMLSR ID. The NMLSR ID would be useful for identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes. The NMLSR ID would allow users to identify individual mortgage loan originators with primary responsibility over applications, originations, and purchased loans. This information would help public officials and members of the public to identify loan originators that are engaged in problematic business practices, which would provide a greater level of precision for understanding and correcting possible discriminatory lending patterns. The Bureau believes that disclosing the NMLSR ID would likely substantially facilitate the reidentification of an applicant or borrower in the HMDA data. The NMLSR ID is required to appear on various documents associated with the loan, including the security instrument.150 As explained above, many jurisdictions publicly disclose these real estate transaction records in an identified form. Although the NMLSR ID is not unique to an individual HMDA record, it is unique to the mortgage loan originator who is unlikely to be associated with many loans for which the other HMDA data fields are identical. Therefore, in many cases, an adversary could use the NMLSR ID, combined with other data fields, to match a HMDA record to an identified public record. 148 Supra note 83, at 75. Dodd-Frank Act section 1094(3)(A)(iv), 12 U.S.C. 2803(b)(6)(F). 150 12 CFR 1026.36(g). 149 PO 00000 Frm 00054 Fmt 4703 Sfmt 4703 If the HMDA data were re-identified, the Bureau believes that the NMLSR ID would likely disclose minimal, if any, information about an applicant or borrower that may be harmful or sensitive. The Bureau understands that the NMLSR ID may allow users to determine information that loan originators may consider sensitive. However, as explained in the 2015 HMDA Final Rule, because the DoddFrank Act explicitly amended HMDA to add a loan originator identifier, while at the same time directing the Bureau to modify or require modification of itemized information ‘‘for the purpose of protecting the privacy interests of the mortgage applicants or mortgagors,’’ the Bureau believes it is reasonable to interpret HMDA as not requiring modifications of itemized information to protect the privacy interests of mortgage loan originators, and that that interpretation best effectuates the purposes of HMDA.151 Rather, under the balancing test, the Bureau evaluates the risks to applicant and borrower privacy interests and the benefits of public disclosure in light of the statutory purposes. Because the NMLSR ID conveys no sensitive information about applicants or borrowers, the Bureau believes that disclosure of this data field would create minimal, if any, risk of harm or sensitivity under the balancing test. However, because the Bureau believes that disclosing the NMLSR ID in the loan-level HMDA data released to the public would likely substantially facilitate the re-identification of an applicant or borrower and that this risk would not be justified by the benefits of the disclosure, the Bureau proposes not to disclose in the loan-level HMDA data the NMLSR ID. The Bureau has considered whether a modification to the public loan-level HMDA dataset other than exclusion of the NMLSR ID would appropriately reduce the privacy risks created by disclosure while maintaining some utility for HMDA’s purposes. For example, as with the ULI, the Bureau has considered whether it could, in the loan-level HMDA data disclosed to the public, replace the NMLSR ID reported to the regulators with a different unique number, such as a hashed value. The Bureau is unable to identify a feasible modification at this time, however. The Bureau believes at this time that, under the balancing test, excluding the NMLSR ID is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the 151 80 E:\FR\FM\25SEN1.SGM FR 66128, 66232 (Oct. 28, 2015). 25SEN1 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices benefits of disclosure. The Bureau seeks comment on this proposal. Automated Underwriting System Result The 2015 HMDA Final Rule requires that, except for purchased covered loans, financial institutions report ‘‘the name of the automated underwriting system used by the financial institution to evaluate the application and the result generated by that automated underwriting system.’’ 152 The 2015 HMDA Final Rule defines ‘‘automated underwriting system’’ for the purposes of this requirement as ‘‘an electronic tool developed by a securitizer, Federal government insurer, or Federal government guarantor that provides a result regarding the credit risk of the applicant and whether the covered loan is eligible to be originated, purchased, insured, or guaranteed by that securitizer, Federal government insurer, or Federal government guarantor.’’ 153 A financial institution will submit a code from a specified list to indicate the result or results generated by the AUS or AUSs used.154 Up to five AUS names and five AUS results may be reported.155 The Bureau added these requirements in the 2015 HMDA Final Rule using its discretionary authority to require the reporting of ‘‘such other information as the Bureau may require’’ provided by the Dodd-Frank Act’s amendment to HMDA.156 For the reasons given below, the Bureau believes that disclosing in the loan-level HMDA data released to the public the AUS result field would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive and that this risk would not be justified by the benefits of the disclosure. Therefore, the Bureau proposes to modify the public loan-level HMDA dataset by excluding the AUS result field.157 The AUS result would assist users in identifying possible discriminatory 152 12 asabaliauskas on DSKBBXCHB2PROD with NOTICES 153 12 CFR 1003.4(a)(35)(i) (effective Jan. 1, 2018). CFR 1003.4(a)(35)(ii) (effective Jan. 1, 2018). 154 Supra note 8, at 74–75. AUS result will be reported using the following codes: Code 1— Approve/Eligible; Code 2—Approve/Ineligible; Code 3—Refer/Eligible; Code 4—Refer/Ineligible; Code 5—Refer with Caution; Code 6—Out of Scope; Code 7—Error; Code 8—Accept; Code 9—Caution; Code 10—Ineligible; Code 11—Incomplete; Code 12—Invalid; Code 13—Refer; Code 14—Eligible; Code 15—Unable to Determine; Code 16—Other; Code 17—Not applicable. If the AUS result is not listed, the financial institution will submit code 16 for ‘‘other’’ and will report in a free-form text field the name and version of the scoring model used. 155 Comment 4(a)(35)–3 (concerning reporting of multiple AUS results); supra note 83, at 37–39, 73. 156 HMDA section 304(b)(6). 157 As discussed above, the Bureau proposes to disclose AUS name. VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 lending patterns and enforcing antidiscrimination statutes. The AUS result would assist in understanding a financial institution’s underwriting decision-making and would help ensure that users are comparing applicants and borrowers with similar profiles, thereby controlling for factors that might provide a legitimate explanation for disparities in credit and pricing decisions. The Bureau believes that, if the HMDA data were re-identified, disclosure of AUS result would likely disclose information about the applicant or borrower that is not otherwise public and may be harmful or sensitive. Applicants’ AUS results are not available to the general public. An AUS result is based on a complex set of factors used to evaluate the credit risk associated with a loan. The traditional underwriting process often uses, among other things, loan-to-value ratio to evaluate collateral, credit score to evaluate creditworthiness and willingness to pay, and debt-to-income ratio to evaluate ability to pay. The result from an AUS reflects in a single indicator these and other factors used to evaluate the risk of the borrower and the eligibility of the loan to be purchased, insured, or guaranteed. The Bureau believes that, if a HMDA record were associated with an identifiable applicant or borrower, disclosure of a ‘‘negative’’ AUS result 158 would reveal information that would likely be perceived as reflecting negatively on the applicant or borrower’s willingness or ability to pay. The Bureau believes that most consumers would consider such information sensitive and that disclosure of this information could lead to dignity harm or embarrassment. The Bureau believes that this field also could be used to target marketing to applicants or borrowers, including marketing of products and services that may pose risks that are not apparent. The Bureau believes that disclosure in the loan-level HMDA data of AUS result would create minimal, if any, risk of facilitating the re-identification of applicants and borrowers in the HMDA data. The Bureau believes that AUS results are not included in any public records or found in other datasets available to the public and that an adversary would face substantial difficulty attempting to re-identify an applicant or borrower by using AUS result to match HMDA records to other identified records. 44609 The Bureau has considered whether modifications to the public loan-level HMDA data other than the exclusion of AUS result would appropriately reduce the privacy risks created by the disclosure of the AUS result while maintaining some utility for HMDA’s purposes. However, the Bureau does not believe that AUS result can be modified in a manner that appropriately protects privacy and that also preserves utility. AUS result is a categorical field, as opposed to a numerical one, and thus cannot be binned or rounded. The Bureau believes at this time that, under the balancing test, excluding AUS result is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. Free-Form Text Fields The 2015 HMDA Final Rule requires financial institutions to use free-form text fields to report certain data. For example, the 2015 HMDA Final Rule requires financial institutions to report, except for purchased covered loans, the credit score or scores relied on in making the credit decision and the name and version of the scoring model used to generate each credit score.159 A financial institution will submit a code from a specified list to indicate the name and version of the scoring model used to generate each credit score reported.160 If the name and version of the scoring model used to generate a credit score is not listed, the financial institution will submit the code for ‘‘other credit scoring model’’ and will report in a free-form text field the name and version of the scoring model used.161 Free-form text fields may also be used to report race,162 ethnicity,163 reason for denial,164 and AUS system name.165 The maximum number of characters for the AUS system name free-form text field and for the reason for denial free-form text field, including spaces, is 255; the maximum number of characters including spaces for all other free-form text fields is 100. Free-form text fields used to report race and ethnicity will be completed by 159 12 CFR 1003.4(a)(15)(i) (effective Jan. 1, 2018). note 83, at 33–34, 63–64. 160 Supra 161 Id. 162 12 CFR 1003.4(a)(10)(i); supra note 83, at 21– 31. 163 12 CFR 1003.4(a)(10)(i); supra note 83, at 17– 20. 158 For example, a ‘‘refer with caution’’ result would indicate that the loan would need to be manually underwritten. PO 00000 Frm 00055 Fmt 4703 Sfmt 4703 164 12 165 12 CFR 1003.4(a)(16); supra note 83, at 35–36. CFR 1003.4(a)(35)(i); supra note 83, at 38– 40. E:\FR\FM\25SEN1.SGM 25SEN1 44610 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices applicants; 166 all other free-form text fields will be completed by the financial institution. Free-form text fields will allow the reporting of any information, including information that creates risks to applicant and borrower privacy. Given the volume of HMDA data reported each year, it will not be feasible for the Bureau to review the contents of each free-form text field submitted before disclosing the loan-level HMDA data to the public. The Bureau believes at this time that, under the balancing test, excluding free-form text fields is a modification to the public loan-level HMDA data that appropriately balances the risks to applicant and borrower privacy and the benefits of disclosure. The Bureau seeks comment on this proposal. asabaliauskas on DSKBBXCHB2PROD with NOTICES IV. Other Considerations Related to Disclosure A. Additional Data Current Regulation C requires financial institutions to report the location of the property to which the loan or application relates, by MSA or by Metropolitan Division, by State, by county, and by census tract, if the institution has a home or branch office in that MSA or Metropolitan Division.167 To reduce burden on financial institutions, the 2015 HMDA Final Rule eliminates from this provision the requirement to report the MSA or Metropolitan Division in which the property is located.168 The Bureau proposes to identify for each loan and application subject to this provision the MSA or Metropolitan Division in which the property securing or proposed to secure the loan is located and to include this information in the loan-level HMDA data disclosed to the public so that the utility of these currently disclosed data fields are preserved. The Bureau seeks comment on this proposal. The FFIEC currently includes with the agencies’ loan-level release the following census and income data: Population (total population in tract); Minority Population Percent (percentage of minority population to total population for tract, carried to two decimal places); FFIEC Median Family Income (FFIEC Median family income in dollars for the MSA/MD in which the tract is located (adjusted annually by FFIEC)); Tract to MSA/MD Median Family Income Percentage (percentage of tract median family income compared 166 Appendix B, paragraph 8 (effective Jan. 1, 2018). 167 12 CFR 1003.4(a)(9). 168 12 CFR 1003.4(a)(9)(ii) (effective Jan. 1, 2018); 80 FR 66128, 66187 (Oct. 28, 2015). VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 to MSA/MD median family income, carried to two decimal places); Number of Owner Occupied Units (number of dwellings, including individual condominiums, that are lived in by the owner); and Number of 1- to 4-Family units (dwellings that are built to house fewer than five families).169 These data are intended to provide additional context to the reported HMDA data. The Bureau proposes to continue to include these data in the loan-level HMDA data disclosed to the public. The Bureau seeks comment on this proposal. The FFIEC also currently includes with the agencies’ loan-level release an application date indicator reflecting whether the application date was before January 1, 2004, on or after January 1, 2004, or not available. The Bureau believes that this indicator is no longer useful to analysis of the HMDA data and proposes to no longer include the application date indicator in the loanlevel HMDA data disclosed to the public. The Bureau seeks comment on this proposal. B. The Modified LAR and the Agencies’ Loan-Level Release As discussed above, HMDA requires that financial institutions make available to the public, upon request, ‘‘loan application register information’’ as defined by the Bureau and in the form required under regulations prescribed by the Bureau.170 This information must be made available as early as March 31 following the calendar year for which the information was compiled.171 In addition to the loan-level data made available by each financial institution on its modified loan/application register, the FFIEC currently makes available in September of each year the agencies’ loan-level release, which is a loan-level dataset containing all reported HMDA data for the preceding calendar year. Under the 2015 HMDA Final Rule, financial institutions will no longer be required to provide their modified loan/ application registers directly to the public and will be required instead to provide a notice advising members of the public seeking their data that it may be obtained on the Bureau’s Web site.172 169 For more information concerning these data, including the sources of these data, see Federal Financial Institutions Examination Council, ‘‘FFIEC Census and Demographic Data,’’ https:// www.ffiec.gov/censusproducts.htm (last visited Mar. 20, 2017). 170 HMDA section 304(j)(1). This requirement is implemented in 12 CFR 1003.5(c), which requires that each financial institution make available to the public its modified loan/application register, sometimes referred to as a ‘‘modified LAR.’’ 171 HMDA section 304(j)(5). 172 12 CFR 1003.5(c) (effective Jan. 1, 2018). PO 00000 Frm 00056 Fmt 4703 Sfmt 4703 By March 31 following the calendar year for which the data was compiled, the Bureau will make available on the Bureau’s Web site a modified loan/ application register for each financial institution that timely submits its HMDA data.173 With respect to data compiled in 2018 or later, this proposed Policy Guidance describes the modifications the Bureau proposes to apply to each financial institution’s modified loan/application register as well as to the agencies’ loan-level release, with the possible exception of modifications to reflect whether the loan amount is above the applicable GSE conforming loan limit, which may be released later than March 31.174 C. Aggregate and Disclosure Reports HMDA and Regulation C require the FFIEC to make available a disclosure statement for each financial institution each year.175 The statute and regulation also require the FFIEC to compile aggregate data by census tract for all financial institutions reporting under HMDA and to produce tables indicating aggregate lending patterns for various categories of census tracts grouped according to location, age of housing stock, income level, and racial characteristics.176 The FFIEC currently makes these aggregate data products available in September of each year reflecting HMDA data reported for the preceding calendar year. The FFIEC, the Bureau, and the other agencies continue to evaluate options for making available the disclosure statements and aggregate data required by HMDA and the 2015 HMDA Final Rule. The Bureau may also consider making available other data products to enhance understanding of the HMDA data and otherwise further the goals of the statute. D. Restricted Access Program As indicated in the supplementary information to the 2014 HMDA Proposed Rule and the 2015 HMDA Final Rule, the Bureau believes that HMDA’s public disclosure purposes may be furthered by allowing academics 173 With respect to data that is submitted late, the Bureau intends to make available a modified loan/ application register by March 31 whenever possible, or as soon thereafter as is feasible. 174 As noted above, HMDA data is reported by March 1 of the year following the calendar year for which the information was compiled, leaving the Bureau as little as 30 days to prepare each financial institution’s modified loan/application register. The Bureau is exploring how best to provide the public with information concerning whether a loan is above the applicable GSE conforming loan limit. 175 12 U.S.C. 2803(k); 12 CFR 1003.5(b)(1) (effective Jan. 1, 2018). 176 12 U.S.C. 2809(a); 12 CFR 1003.5(f) (effective Jan. 1, 2018). E:\FR\FM\25SEN1.SGM 25SEN1 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices and industry and community researchers to access the unmodified HMDA dataset through a restricted access program, for research purposes. The Bureau continues to evaluate whether access to unmodified HMDA data should be permitted through such a program, the options for such a program, and the risks and costs that may be associated with such a program. V. Regulatory Requirements The Bureau concludes that the proposed Policy Guidance on Disclosure of Loan-Level HMDA Data is a nonbinding general statement of policy and/ or a rule of agency organization, procedure, or practice exempt from notice and comment rulemaking requirements under the Administrative Procedure Act pursuant to 5 U.S.C. 553(b). Notwithstanding this conclusion, the Bureau invites public comment on the proposed Policy Guidance. Because no notice of proposed rulemaking is required, the Regulatory Flexibility Act does not require an initial or final regulatory flexibility analysis.177 The existing information collections contained in Regulation C have been approved by the Office of Management and Budget (OMB) and assigned OMB control number 3170–0008. The Bureau has determined that this proposed Policy Guidance does not impose any new or revise any existing recordkeeping, reporting, or disclosure requirements on covered entities or members of the public that would be collections of information requiring OMB approval under the Paperwork Reduction Act, 44 U.S.C. 3501, et seq. The Bureau has a continuing interest in the public’s opinions regarding this determination. At any time, comments regarding this determination may be sent to the Consumer Financial Protection Bureau (Attention: PRA Office), 1700 G Street NW., Washington, DC 20552, or by email to CFPB_Public_PRA@cfpb.gov. asabaliauskas on DSKBBXCHB2PROD with NOTICES VI. Proposed Policy Guidance on Disclosure of Loan-Level HMDA Data The text of the proposed Policy Guidance is as follows: Policy Guidance on Disclosure of LoanLevel HMDA Data A. Background The Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et seq., requires certain financial institutions to collect, report, and disclose data about their mortgage lending activity. HMDA is implemented by Regulation C, 12 CFR part 1003. HMDA identifies its purposes 177 5 U.S.C. 603(a), 604(a). VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 as providing the public and public officials with sufficient information to enable them to determine whether financial institutions are serving the housing needs of the communities in which they are located, and to assist public officials in their determination of the distribution of public sector investments in a manner designed to improve the private investment environment.178 In 1989, the Board of Governors of the Federal Reserve System (Board) recognized a third HMDA purpose of identifying possible discriminatory lending patterns and enforcing antidiscrimination statutes, which now appears with HMDA’s other purposes in Regulation C.179 In 2010, Congress enacted the DoddFrank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act).180 Among other changes, the Dodd-Frank Act expanded the scope of information relating to mortgage applications and loans that must be collected, reported, and disclosed under HMDA and authorized the Bureau to require financial institutions to collect, report, and disclose additional information. The Dodd-Frank Act amendments to HMDA also added new section 304(h)(1)(E), which directs the Bureau to develop regulations, in consultation with the agencies identified in section 304(h)(2),181 that ‘‘modify or require modification of itemized information, for the purpose of protecting the privacy interests of the mortgage applicants or mortgagors, that is or will be available to the public.’’ Section 304(h)(3)(B), also added by the Dodd-Frank Act, directs the Bureau to ‘‘prescribe standards for any modification under paragraph (1)(E) to effectuate the purposes of [HMDA], in light of the privacy interests of mortgage applicants or mortgagors. Where necessary to protect the privacy interests of mortgage applicants or mortgagors, the Bureau shall provide for the disclosure of information . . . in aggregate or other reasonably modified form, in order to effectuate the purposes of [HMDA].’’ 182 178 12 U.S.C. 2801(b). FR 51356, 51357 (Dec. 15, 1989) (codified at 12 CFR 1003.1(b)(1)) (Bureau’s post-Dodd-Frank Act Regulation C). 180 Dodd-Frank Wall Street Reform and Consumer Protection Act, Public Law 111–203, 124 Stat. 1376, 1980, 2035–38, 2097–101 (2010). 181 These agencies are the prudential regulators— the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency—and the Department of Housing and Urban Development. Together with the Bureau, these agencies are referred to herein as ‘‘the agencies.’’ 182 Section 304(h)(3)(A) provides that a modification under section 304(h)(1)(E) shall apply to information concerning ‘‘(i) credit score data . . . 179 54 PO 00000 Frm 00057 Fmt 4703 Sfmt 4703 44611 On October 28, 2015, the Bureau published a final rule amending Regulation C (2015 HMDA Final Rule) to implement the Dodd-Frank Act amendments and make other changes.183 Most provisions of the 2015 HMDA Final Rule go into effect on January 1, 2018,184 and apply to data financial institutions will collect beginning in 2018 and will report beginning in 2019. B. The Balancing Test In the 2015 HMDA Final Rule, in consultation with the agencies and after notice and comment, the Bureau interpreted HMDA, as amended by the Dodd-Frank Act, to require that the Bureau use a balancing test to determine whether and how HMDA data should be modified prior to its disclosure to the public in order to protect applicant and borrower privacy while also fulfilling HMDA’s public disclosure purposes. The Bureau interpreted HMDA to require that public HMDA data be modified when the release of the unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such release to the public in light of the statutory purposes. In such circumstances, the need to protect the privacy interests of mortgage applicants or mortgagors requires that the itemized information be modified. This binding interpretation implemented HMDA sections 304(h)(1)(E) and 304(h)(3)(B) because it prescribed standards for requiring modification of itemized information, for the purpose of protecting the privacy interests of mortgage applicants and borrowers, that is or will be available to the public.185 The Bureau has applied the balancing test to determine whether and how to modify the HMDA data reported under the 2015 HMDA Final Rule before it is disclosed on the loan level to the public. This Policy Guidance describes the loan-level HMDA data that the Bureau intends to make available to the public beginning in 2019, with respect to data compiled by financial institutions in or after 2018, including modifications that in a manner that is consistent with the purpose described in paragraph (1)(E); and (ii) age or any other category of data described in paragraph (5) or (6) of subsection (b), as the Bureau determines to be necessary to satisfy the purpose described in paragraph (1)(E), and in a manner consistent with that purpose.’’ 183 80 FR 66128 (Oct. 28, 2015); see also 80 FR 69567 (Nov. 10, 2015) (making technical corrections). 184 Certain amendments to the definition of financial institution went into effect on January 1, 2017. See 12 CFR 1003.2 (effective Jan. 1, 2017); 80 FR 66128, 66308 (Oct. 28, 2015). 185 80 FR 66128, 66134 (Oct. 28, 2015). E:\FR\FM\25SEN1.SGM 25SEN1 44612 Federal Register / Vol. 82, No. 184 / Monday, September 25, 2017 / Notices asabaliauskas on DSKBBXCHB2PROD with NOTICES the Bureau intends to apply to the data. The Bureau intends to continue to monitor developments affecting the application of the balancing test to the HMDA data and may reconsider whether and how to modify the HMDA data, based on the application of the balancing test, in order to ensure the appropriate protection of applicant and borrower privacy in light of HMDA’s purposes. This Policy Guidance is nonbinding in part because flexibility to revise the modifications to be applied to the public loan-level HMDA data is necessary to maintain a proper balancing of the privacy risks and benefits of disclosure. C. Loan-Level HMDA Data To Be Disclosed to the Public The Bureau intends to publicly disclose loan-level HMDA data reported pursuant to the 2015 HMDA Rule as follows: 1. Except as provided in paragraphs 2 through 6 below, the Bureau intends to disclose all data as reported, without modification. 2. The Bureau intends to exclude the following from the public loan-level HMDA data: a. Universal loan identifier, collected pursuant to 12 CFR 1003.4(a)(1)(i); b. The date the application was received or the date shown on the application form, collected pursuant to 12 CFR 1003.4(a)(1)(ii); c. The date of action taken by the financial institution on a covered loan or application, collected pursuant to 12 CFR 1003.4(a)(8)(ii); d. The address of the property securing the loan or, in the case of an application, proposed to secure the loan, collected pursuant to 12 CFR 1003.4(a)(9)(i); e. The credit score or scores relied on in making the credit decision, collected pursuant to 12 CFR 1003.4(a)(15)(i); f. The unique identifier assigned by the Nationwide Mortgage Licensing System and Registry for the mortgage loan originator, as defined in Regulation G, 12 CFR 1007.102, or Regulation H, 12 CFR 1008.23, as applicable, collected pursuant to 12 CFR 1003.4(a)(34); g. The result generated by the automated underwriting system used by the financial institution to evaluate the application, collected pursuant to 12 CFR 1003.4(a)(35)(i); and h. Free-form text fields used to report the following data: Applicant or borrower race, collected pursuant to 12 CFR 1003.4(a)(10)(i); applicant or borrower ethnicity, collected pursuant to 12 CFR 1003.4(a)(10)(i); name and version of the credit scoring model used to generate each credit score or credit VerDate Sep<11>2014 19:45 Sep 22, 2017 Jkt 241001 scores relied on in making the credit decision, collected pursuant to 12 CFR 1003.4(a)(15)(i); the principal reason or reasons the financial institution denied the application, if applicable, collected pursuant to 12 CFR 1003.4(a)(16); and automated underwriting system name, collected pursuant to 12 CFR 1003.4(a)(35)(i). 3. With respect to the amount of the covered loan or the amount applied for, collected pursuant to 12 CFR 1003.4(a)(7), the Bureau intends to: a. Disclose the midpoint for the $10,000 interval into which the reported value falls, e.g., for a reported value of $117,834, disclose $115,000 as the midpoint between values equal to $110,000 and less than $120,000; and b. Indicate whether the reported value exceeds the applicable dollar amount limitation on the original principal obligation in effect at the time of application or origination as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2). 4. With respect to the age of an applicant or borrower, collected pursuant to 12 CFR 1003.4(a)(10)(ii), the Bureau intends to: a. Bin reported values into the following ranges, as applicable: 25 to 34; 35 to 44; 45 to 54; 55 to 64; and 65 to 74; b. Bottom-code reported values under 25; c. Top-code reported values over 74; and d. Indicate whether the reported value is 62 or higher. 5. With respect to the ratio of the applicant’s or borrower’s total monthly debt to the total monthly income relied on in making the credit decision, collected pursuant to 12 CFR 1003.4(a)(23), the Bureau intends to: a. Bin reported values into the following ranges, as applicable: 20 percent to less than 30 percent; 30 percent to less than 40 percent; and 50 percent to less than 60 percent; b. Bottom-code reported values under 20 percent; c. Top-code reported values of 60 percent or higher; and d. Disclose, without modification, reported values greater than or equal to 40 percent and less than 50 percent. 6. With respect to the value of the property securing the covered loan or, in the case of an application, proposed to secure the covered loan, collected pursuant to 12 CFR 1003.4(a)(28), the Bureau intends to disclose the midpoint for the $10,000 interval into which the reported value falls, e.g., for a reported value of $117,834, disclose $115,000 as the midpoint between values equal to $110,000 and less than $120,000. PO 00000 Frm 00058 Fmt 4703 Sfmt 4703 Dated: September 8, 2017. Richard Cordray, Director, Bureau of Consumer Financial Protection. [FR Doc. 2017–20409 Filed 9–22–17; 8:45 am] BILLING CODE 4810–AM–P ENVIRONMENTAL PROTECTION AGENCY [FRL–9966–90–ORD] Ambient Air Monitoring Reference and Equivalent Methods: Designation of Three New Reference Methods Environmental Protection Agency (EPA). ACTION: Notice. AGENCY: Notice is hereby given that the Environmental Protection Agency (EPA) has designated three new reference methods for measuring concentrations of PM2.5, PM10, and PM10-2.5 in the ambient air. FOR FURTHER INFORMATION CONTACT: Robert Vanderpool, Exposure Methods and Measurement Division (MD–D205– 03), National Exposure Research Laboratory, U.S. EPA, Research Triangle Park, North Carolina 27711. Phone: 919–541–7877. Email: Vanderpool.Robert@epa.gov. SUPPLEMENTARY INFORMATION: In accordance with regulations at 40 CFR part 53, the EPA evaluates various methods for monitoring the concentrations of those ambient air pollutants for which EPA has established National Ambient Air Quality Standards (NAAQSs) as set forth in 40 CFR part 50. Monitoring methods that are determined to meet specific requirements for adequacy are designated by the EPA as either reference methods or equivalent methods (as applicable), thereby permitting their use under 40 CFR part 58 by States and other agencies for determining compliance with the NAAQSs. The EPA hereby announces the designation of three new reference methods for measuring concentrations of PM2.5, PM10, and PM10-2.5 in the ambient air. These designations are made under the provisions of 40 CFR part 53, as amended on August 31, 2011 (76 FR 54326- 54341). The new reference method for PM2.5 is a manual monitoring method based on a specific PM2.5 sampler and is identified as follows: RFPS–0717–245, ‘‘Met One Instruments, Inc. E–SEQ–FRM,’’ sequential sampler configured for multievent filter sampling of ambient SUMMARY: E:\FR\FM\25SEN1.SGM 25SEN1

Agencies

[Federal Register Volume 82, Number 184 (Monday, September 25, 2017)]
[Notices]
[Pages 44586-44612]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2017-20409]


=======================================================================
-----------------------------------------------------------------------

BUREAU OF CONSUMER FINANCIAL PROTECTION

[Docket No. CFPB-2017-0025]


Disclosure of Loan-Level HMDA Data

AGENCY: Bureau of Consumer Financial Protection.

ACTION: Notice of proposed policy guidance with request for public 
comment.

-----------------------------------------------------------------------

SUMMARY: The Bureau of Consumer Financial Protection (Bureau) is 
proposing policy guidance that would describe modifications that the 
Bureau intends to apply to the loan-level HMDA data that financial 
institutions will report under the Home Mortgage Disclosure (Regulation 
C) before the data is disclosed to the public. The proposed policy 
guidance applies to HMDA data to be reported under Regulation C 
effective January 1, 2018. The Bureau will make this data available to 
the public beginning in 2019.

DATES: Comments must be received on or before November 24, 2017.

ADDRESSES: You may submit comments, identified by Docket No. CFPB-2017-
0025, by any of the following methods:
     Email: FederalRegisterComments@cfpb.gov. Include Docket 
No. CFPB-2017-0025 in the subject line of the email.
     Federal eRulemaking Portal: http://www.regulations.gov. 
Follow the instructions for submitting comments.
     Mail: Monica Jackson, Office of the Executive Secretary, 
Consumer Financial Protection Bureau, 1700 G Street NW., Washington, DC 
20552.
     Hand Delivery/Courier: Monica Jackson, Office of the 
Executive Secretary, Consumer Financial Protection Bureau, 1700 G 
Street NW., Washington, DC 20552.
    Instructions: All submissions should include the agency name and 
docket number or Regulatory Information Number (RIN). Because paper 
mail in the Washington, DC area and at the Bureau is subject to delay, 
commenters are encouraged to submit comments electronically. In 
general, all comments received will be posted without change to http://www.regulations.gov. In addition, comments will be available for public 
inspection and copying at 1700 G Street NW., Washington, DC 20552, on 
official business days between the hours of 10 a.m. and 5:00 p.m. 
Eastern Time. You can make an appointment to inspect the documents by 
telephoning 202-435-7275.
    All comments, including attachments and other supporting materials, 
will become part of the public record and subject to public disclosure. 
Sensitive personal information, such as account numbers or Social 
Security numbers, should not be included. Comments will not be edited 
to remove any identifying or contact information.

FOR FURTHER INFORMATION CONTACT: David Jacobs, Counsel, or Laura Stack, 
Senior Counsel, Office of Regulations, at 202-435-7700 or https://reginquiries.consumerfinance.gov/.

SUPPLEMENTARY INFORMATION: 

I. Summary

    The Home Mortgage Disclosure Act (HMDA) requires certain financial 
institutions to collect, report, and disclose data about their mortgage 
lending activity on an ongoing basis to both Federal regulators and the 
general public. The home mortgage market is the country's single 
largest market for consumer financial products and services, with $10 
trillion outstanding.\1\ It is a critical source of wealth-building for 
both individual families and communities, and has a substantial impact 
on the nation's economy as evidenced by its role in triggering in 2008, 
the worst financial crisis since the Great Depression. As of 2015, 48 
million consumers had a mortgage, representing 65 percent of all owner-
occupied homes.\2\
---------------------------------------------------------------------------

    \1\ Federal Reserve Bank of St. Louis, Board of Governors of the 
Federal Reserve System (US), ``Mortgage Debt Outstanding by Type of 
Property: One- to Four-Family Residences (MDOTP1T4FR),'' https://fred.stlouisfed.org/series/MDOTP1T4FR (last updated June 9, 2017).
    \2\ U.S. Census Bureau, ``Selected Housing Characteristics: 
2011-2015 American Community Survey 5-Year Characteristics,'' 
https://factfinder.census.gov/faces/tableservices/jsf/pages/productview.xhtml?src=bkmk (last visited Aug. 31, 2017).
---------------------------------------------------------------------------

    HMDA is implemented by Regulation C, which describes its purposes 
as helping to determine whether financial institutions are serving the 
housing needs of their communities; assisting public officials in 
distributing public-sector investment so as to attract private 
investment to areas where it is needed; and assisting in identifying 
possible discriminatory lending patterns and enforcing 
antidiscrimination statutes. As described further below, public 
disclosure of HMDA data is central to

[[Page 44587]]

the achievement of the statutory goals established by Congress.
    In 2010, Congress enacted the Dodd-Frank Wall Street Reform and 
Consumer Protection Act (Dodd-Frank Act), which amended HMDA to require 
collection of additional mortgage market data and transferred HMDA 
rulemaking authority and other functions from the Board of Governors of 
the Federal Reserve System (Board) to the Bureau. On October 28, 2015, 
the Bureau published a final rule amending Regulation C (2015 HMDA 
Final Rule) to implement the Dodd-Frank Act amendments. In the 2015 
HMDA Final Rule, the Bureau interpreted HMDA, as amended by the Dodd-
Frank Act, to require that the Bureau use a balancing test to determine 
whether and how HMDA data should be modified prior to its disclosure to 
the public in order to protect applicant and borrower privacy while 
also fulfilling HMDA's public disclosure purposes. The Bureau 
interpreted HMDA to require that public HMDA data be modified when the 
release of the unmodified data creates risks to applicant and borrower 
privacy interests that are not justified by the benefits of such 
release to the public in light of the statutory purposes.
    This proposed Policy Guidance describes the Bureau's application of 
the balancing test to date and the loan-level HMDA data that it 
proposes to make available to the public beginning in 2019, with 
respect to data compiled by financial institutions in or after 2018, 
including modifications that the Bureau intends to apply to the data. 
In developing this guidance, the Bureau has consulted with the 
prudential regulators--Board, the Federal Deposit Insurance 
Corporation, the National Credit Union Administration, and the Office 
of the Comptroller of the Currency--the Department of Housing and Urban 
Development, and the Federal Housing Finance Agency. The Bureau 
proposes to publicly disclose the loan-level HMDA data reported under 
the 2015 HMDA Final Rule with the following modifications. First, the 
Bureau proposes to modify the public loan-level HMDA data to exclude: 
The universal loan identifier; the date the application was received or 
the date shown on the application form; the date of action taken by the 
financial institution on a covered loan or application; the address of 
the property securing the loan or, in the case of an application, 
proposed to secure the loan; the credit score or scores relied on in 
making the credit decision; the unique identifier assigned by the 
Nationwide Mortgage Licensing System and Registry for the mortgage loan 
originator; and the result generated by the automated underwriting 
system used by the financial institution to evaluate the application. 
The Bureau also intends to exclude free-form text fields used to report 
the following data: Applicant or borrower race; applicant or borrower 
ethnicity; the name and version of the credit scoring model used to 
generate each credit score or credit scores relied on in making the 
credit decision; the principal reason or reasons the financial 
institution denied the application, if applicable; and the automated 
underwriting system name.
    Second, the Bureau proposes to modify the public loan-level HMDA 
data to reduce the precision of most of the values reported for the 
following data fields. With respect to the amount of the covered loan 
or the amount applied for, the Bureau proposes to disclose the midpoint 
for the $10,000 interval into which the reported value falls. The 
Bureau also proposes to indicate whether the reported value exceeds the 
applicable dollar amount limitation on the original principal 
obligation in effect at the time of application or origination as 
provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 1454(a)(2). With 
respect to the age of an applicant or borrower, the Bureau proposes to 
bin reported values into the following ranges, as applicable: 25 to 34, 
35 to 44, 45 to 54, 55 to 64, and 65 to 74; bottom-code reported values 
under 25; top-code reported values over 74; and indicate whether the 
reported value is 62 or higher. With respect to the ratio of the 
applicant's or borrower's total monthly debt to the total monthly 
income relied on in making the credit decision, the Bureau proposes to 
disclose without modification reported values greater than or equal to 
40 percent and less than 50 percent; bin reported values into the 
following ranges, as applicable: 20 percent to less than 30 percent; 30 
percent to less than 40 percent; and 50 percent to less than 60 
percent; bottom-code reported values under 20 percent; and top-code 
reported values of 60 percent or higher. With respect to the value of 
the property securing the covered loan or, in the case of an 
application, proposed to secure the covered loan, the Bureau proposes 
to disclose the midpoint for the $10,000 interval into which the 
reported value falls.
    This proposed Policy Guidance is exempt from notice and comment 
rulemaking requirements under the Administrative Procedure Act pursuant 
to 5 U.S.C. 553(b). It is non-binding in part to preserve flexibility 
to revise the modifications to be applied to the public loan-level HMDA 
data as necessary to maintain a proper balancing of the privacy risks 
and benefits of disclosure, especially in the event the Bureau becomes 
aware of new facts and circumstances that might contribute to privacy 
risks. However, the Bureau invites public comment on the proposed 
Policy Guidance to provide transparency, obtain public feedback on its 
application of the balancing test, and improve the Bureau's 
decisionmaking. This proposal does not re-open any portion of the 2015 
HMDA Final Rule, and the Bureau does not intend in this proposal to 
revisit any decisions made in that rulemaking.

II. Background

A. HMDA's Purposes and the Public Disclosure of HMDA Data

    The Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et seq., 
requires certain financial institutions to collect, report, and 
disclose data about their mortgage lending activity on an ongoing basis 
to both Federal regulators and the general public. HMDA is implemented 
by Regulation C, 12 CFR part 1003. HMDA identifies its purposes as 
providing the public and public officials with sufficient information 
to enable them to determine whether financial institutions are serving 
the housing needs of the communities in which they are located, and to 
assist public officials in their determination of the distribution of 
public sector investments in a manner designed to improve the private 
investment environment.\3\ In 1989, Congress expanded HMDA to require, 
among other things, financial institutions to report racial 
characteristics, gender, and income information on applicants and 
borrowers.\4\ In light of these amendments, the Board subsequently 
recognized a third HMDA purpose of identifying possible discriminatory 
lending patterns and enforcing antidiscrimination statutes, which now 
appears with HMDA's other purposes in Regulation C.\5\
---------------------------------------------------------------------------

    \3\ 12 U.S.C. 2801(b).
    \4\ Financial Institutions Reform, Recovery, and Enforcement 
Act, Public Law 101-73, section 1211, 103 Stat. 183, 524-26 (1989).
    \5\ 54 FR 51356, 51357 (Dec. 15, 1989) (codified at 12 CFR 
1003.1(b)(1)) (Bureau's post-Dodd-Frank Act Regulation C).
---------------------------------------------------------------------------

    Public disclosure of HMDA data is central to the achievement of 
HMDA's goals. Since HMDA's enactment in 1975, the data financial 
institutions are required to disclose under HMDA and Regulation C have 
been expanded, public access to HMDA data has increased, and the 
formats in which

[[Page 44588]]

HMDA data have been disclosed to the public have evolved to provide 
more useful information to the public and public officials. Amendments 
to the statute and Regulation C over time illustrate the importance of 
public access to HMDA data to fulfill the statute's purposes.
    As originally promulgated, HMDA and Regulation C required a covered 
financial institution to make available to the public at its home and 
branch offices a ``disclosure statement'' reflecting aggregates of 
certain mortgage loan data.\6\ In 1980, Congress amended HMDA to 
increase the public's access to and the utility of the aggregated HMDA 
data. First, Congress amended HMDA section 304 to require that the 
Federal Financial Institutions Examination Council (FFIEC) implement a 
system to facilitate public access to the data required to be disclosed 
under the statute, and provided that such system must include 
arrangements for a ``central depository of data'' in each standard 
metropolitan statistical area (MSA).\7\ In amending Regulation C to 
implement this requirement, the Board noted that ``the principal 
benefit of the central repository system is that users of HMDA data 
will be able to obtain all of the various institutions' disclosure 
statements at one location. The current system requires users to 
contact the institutions on an individual basis to obtain the 
disclosure data.\8\ Second, the 1980 HMDA amendments required that the 
FFIEC compile annually for each MSA aggregate data by census tract for 
all financial institutions required to disclose data under HMDA, and 
produce tables indicating, for each MSA, aggregate lending patterns for 
various categories of census tracts grouped according to location, age 
of housing stock, income level, and racial characteristics.\9\ A 
principal benefit cited to support these requirements was that the 
utility of individual institutions' disclosure statements ``would be 
enhanced if they could be compared to aggregate [MSA] lending 
patterns.'' \10\
---------------------------------------------------------------------------

    \6\ 12 CFR part 203.
    \7\ Housing and Community Development Act, Public Law 96-399, 
section 340, 94 Stat. 1614 (1980).
    \8\ 46 FR 11780, 11786 (Feb. 10, 1981).
    \9\ Housing and Community Development Act, Public Law 96-399, 
section 34010, Sec.  340, 94 Stat. 1614 (1980).
    \10\ 46 FR 11780, 11786 (Feb. 10, 1981).
---------------------------------------------------------------------------

    In 1989, as noted above, Congress amended HMDA to expand the data 
financial institutions were required to disclose to the public.\11\ In 
addition to requiring that financial institutions disclose data 
concerning the race, sex, and income of applicants and borrowers, the 
1989 amendments required that institutions disclose data on loan 
applications in addition to originations and purchases. In implementing 
these amendments in Regulation C, the Board required financial 
institutions to report HMDA data to their supervisory agencies on a 
loan-by-loan and application-by-application basis using the ``loan/
application register'' format.\12\ Commenters on the Board's proposal 
to amend Regulation C to implement the 1989 amendments urged the Board 
to require that financial institutions make their loan/application 
registers available to the public to provide for more meaningful 
analysis of the data than that permitted by the required aggregate 
disclosures.\13\ The Board declined to require that financial 
institutions make available to the public their loan/application 
registers, but in 1990 the FFIEC announced that it believed public 
disclosure of the reported loan-level HMDA data to be ``consistent with 
the congressional intent to maximize the utilization of lending data'' 
and that it would make all reported HMDA data available to the public 
in a loan-level format, after deleting three fields to protect 
applicant and borrower privacy.\14\ The FFIEC first disclosed the 
reported loan-level HMDA data to the public in October 1991.
---------------------------------------------------------------------------

    \11\ Financial Institutions Reform, Recovery and Enforcement 
Act, Public Law 101-73, section 1211, 103 Stat. 183 (1989).
    \12\ 12 CFR 203.4, 203.5; see also 54 FR 51356, 51359-60 (Dec. 
15, 1989).
    \13\ 54 FR 51356, 51360-61 (Dec. 15, 1989).
    \14\ 55 FR 27886, 27888 (July 6, 1990). In announcing that the 
loan-level data submitted to the supervisory agencies on the loan/
application register would be made available to the public, the 
FFIEC noted that ``[a]n unedited form of the data would contain 
information that could be used to identify individual loan 
applicants'' and that the data would be edited prior to public 
release to remove the application identification number, the date of 
application, and the date of final action.
---------------------------------------------------------------------------

    The following year, Congress amended HMDA to require that each 
financial institution make available to the public its ``loan 
application register information'' for each year as early as March 31 
of the succeeding year, as required under regulations prescribed by the 
Board.\15\ New section 304(j) directed the Board to require such 
deletions from the loan application register information made available 
to the public as the Board determined to be appropriate to protect any 
privacy interest of any applicant, and identified as appropriate for 
deletion the same three fields the FFIEC had determined should be 
deleted from the loan-level HMDA data it disclosed to the public.\16\ A 
House Report characterizes the 1992 amendment to HMDA as making 
``changes . . . to ensure that the public receives useful and timely 
information regarding the lending records of financial institutions.'' 
\17\ The Board implemented this amendment by requiring that financial 
institutions make their ``modified'' loan/application registers 
available to the public after deleting the same fields deleted from the 
loan-level HMDA data disclosed by the FFIEC.\18\
---------------------------------------------------------------------------

    \15\ Housing and Community Development Act, Public Law 102-550, 
section 932, 106 Stat. 3672 (1992).
    \16\ HMDA section 304(j) identifies as appropriate for deletion 
``the applicant's name and identification number, the date of the 
application, and the date of any determination by the institution 
with respect to such application.''
    \17\ H. Rept. 102-760 (1992).
    \18\ See 12 CFR 1003.5(c) (Bureau's successor Regulation C, 
which restates the Board's predecessor Regulation C). Section 
1003.5(c) requires that, before making its loan/application register 
available to the public, a financial institution must delete three 
fields to protect applicant and borrower privacy: Application or 
loan number, the date that the application was received, and the 
date action was taken.
---------------------------------------------------------------------------

    Today, HMDA data are the preeminent data source that regulators, 
researchers, economists, industry, and advocates use to achieve HMDA's 
purposes and to analyze the mortgage market. HMDA and current 
Regulation C \19\ continue to require that data be made available to 
the public in both aggregate and loan-level formats. Each financial 
institution is required to make its modified loan/application register 
available to the public, with three fields deleted to protect applicant 
and borrower privacy,\20\ and also make available to the public a 
disclosure statement prepared by the FFIEC that shows the financial 
institution's HMDA data in aggregate form.\21\ In addition, the FFIEC 
makes available to the public disclosure statements for each financial 
institution,\22\ aggregate reports for each MSA and metropolitan 
division (MD) showing lending patterns by certain property and 
applicant characteristics,\23\ and the loan-level dataset containing 
all reported HMDA data for the preceding calendar year, modified to 
protect

[[Page 44589]]

applicant and borrower privacy (the agencies' loan-level release).\24\
---------------------------------------------------------------------------

    \19\ Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et 
seq., as implemented by Regulation C, 12 CFR part 1003. ``Current 
Regulation C'' as used herein refers to Regulation C in effect as of 
the date of publication of this proposed Policy Guidance.
    \20\ HMDA section 304(j)(2)(B); 12 CFR 1003.5(c).
    \21\ HMDA section 304(k); 12 CFR 1003.5(b).
    \22\ HMDA section 304(f); 12 CFR 1003.5(f).
    \23\ HMDA section 310; 12 CFR 1003.5(f).
    \24\ 55 FR 27886 (July 6, 1990) (announcing that the loan-level 
HMDA data submitted on the loan/application register would be made 
available to the public after deletion of three fields to protect 
applicant and borrower privacy).
---------------------------------------------------------------------------

B. The Dodd-Frank Act and Amendments to HMDA and Regulation C

    In 2010, the Dodd-Frank Act, which amended HMDA and also 
transferred HMDA rulemaking authority and other functions from the 
Board to the Bureau, was enacted into law.\25\ Among other changes, the 
Dodd-Frank Act again expanded the scope of information relating to 
mortgage applications and loans that must be collected, reported, and 
disclosed under HMDA and authorized the Bureau to require financial 
institutions to collect, report, and disclose additional information. 
The Dodd-Frank Act amendments to HMDA also added new section 
304(h)(1)(E), which directs the Bureau to develop regulations, in 
consultation with the agencies identified in section 304(h)(2),\26\ 
that ``modify or require modification of itemized information, for the 
purpose of protecting the privacy interests of the mortgage applicants 
or mortgagors, that is or will be available to the public.'' Section 
304(h)(3)(B), also added by the Dodd-Frank Act, directs the Bureau to 
``prescribe standards for any modification under paragraph (1)(E) to 
effectuate the purposes of [HMDA], in light of the privacy interests of 
mortgage applicants or mortgagors. Where necessary to protect the 
privacy interests of mortgage applicants or mortgagors, the Bureau 
shall provide for the disclosure of information . . . in aggregate or 
other reasonably modified form, in order to effectuate the purposes of 
[HMDA].'' \27\
---------------------------------------------------------------------------

    \25\ Dodd Frank Wall Street Reform and Consumer Protection Act, 
Public Law 111-203, 124 Stat. 1376, 1980, 2035-38, 2097-101 (2010).
    \26\ These agencies are the prudential regulators--the Board of 
Governors of the Federal Reserve System, the Federal Deposit 
Insurance Corporation, the National Credit Union Administration, and 
the Office of the Comptroller of the Currency--and the Department of 
Housing and Urban Development. Together with the Bureau, these 
agencies are referred to herein as ``the agencies.''
    \27\ Section 304(h)(3)(A) provides that a modification under 
section 304(h)(1)(E) shall apply to information concerning ``(i) 
credit score data . . . in a manner that is consistent with the 
purpose described in paragraph (1)(E); and (ii) age or any other 
category of data described in paragraph (5) or (6) of subsection 
(b), as the Bureau determines to be necessary to satisfy the purpose 
described in paragraph (1)(E), and in a manner consistent with that 
purpose.''
---------------------------------------------------------------------------

    On August 29, 2014, the Bureau published proposed amendments to 
Regulation C (2014 HMDA Proposed Rule) to implement the Dodd-Frank Act 
amendments and to make additional changes.\28\ After careful 
consideration of comments received on its proposal, the Bureau 
published a final rule on October 28, 2015 (2015 HMDA Final Rule) 
amending Regulation C.\29\ The 2015 HMDA Final Rule implements the 
Dodd-Frank Act amendments and makes other changes to Regulation C. Most 
provisions of the 2015 HMDA Final Rule go into effect on January 1, 
2018 \30\ and apply to data financial institutions will collect 
beginning in 2018 and will report beginning in 2019.\31\
---------------------------------------------------------------------------

    \28\ 79 FR 51732 (Aug. 29, 2014).
    \29\ Home Mortgage Disclosure (Regulation C), 80 FR 66128 (Oct. 
28, 2015); see also 80 FR 69567 (Nov. 10, 2015) (making technical 
corrections).
    \30\ Certain amendments to the definition of financial 
institution went into effect on January 1, 2017. See 12 CFR 1003.2; 
80 FR 66128, 66308 (Oct. 28, 2015).
    \31\ Beginning in 2018, with respect to data compiled in 2017 
and later, financial institutions will file their HMDA data with the 
Bureau. The Bureau will collect and process HMDA data on behalf of 
the FFIEC and the agencies.
---------------------------------------------------------------------------

    The 2015 HMDA Final Rule addressed the public disclosure of HMDA 
data in two ways. First, the 2015 HMDA Final Rule made changes to 
financial institutions' public disclosure obligations under Regulation 
C. Under the 2015 HMDA Final Rule, the public disclosure of HMDA data 
is shifted entirely to the agencies. Effective with respect to HMDA 
data compiled in 2017 and later, financial institutions will no longer 
be required to provide their modified loan/application registers and 
disclosure statements directly to the public and will be required 
instead to provide only a notice advising members of the public seeking 
their data that it may be obtained on the Bureau's Web site. In 
addition to reducing burden on financial institutions associated with 
their disclosure of HMDA data, the 2015 HMDA Final Rule eliminates 
risks to financial institutions associated with errors in preparing 
their modified loan/application registers that could result in the 
unintended disclosure of data. Further, the 2015 HMDA Final Rule allows 
decisions with respect to what to include on the modified loan/
application register to be made in conjunction with decisions regarding 
the agencies' loan-level data release, providing flexibility and 
allowing for consistency with respect to both releases. This shift of 
responsibility also permits the Bureau to consider modifications to 
protect applicant and borrower privacy that preserve data utility but 
that may be burdensome for financial institutions to implement. 
Finally, shifting the disclosure of HMDA data to the agencies will 
allow for easier adjustment of privacy protections applied to 
disclosures of loan-level HMDA data as privacy risks and potential uses 
of HMDA data evolve.
    Also in the 2015 HMDA Final Rule, in consultation with the agencies 
and after notice and comment, the Bureau interpreted HMDA, as amended 
by the Dodd-Frank Act, to require that the Bureau use a balancing test 
to determine whether and how HMDA data should be modified prior to its 
disclosure to the public in order to protect applicant and borrower 
privacy while also fulfilling HMDA's public disclosure purposes. The 
Bureau interpreted HMDA to require that public HMDA data be modified 
when the release of the unmodified data creates risks to applicant and 
borrower privacy interests that are not justified by the benefits of 
such release to the public in light of the statutory purposes.\32\ In 
such circumstances, the need to protect the privacy interests of 
mortgage applicants or mortgagors requires that the itemized 
information be modified. This binding interpretation implemented HMDA 
sections 304(h)(1)(E) and 304(h)(3)(B) because it prescribed standards 
for requiring modification of itemized information, for the purpose of 
protecting the privacy interests of mortgage applicants and borrowers, 
that is or will be available to the public.\33\ The 2015 HMDA Final 
Rule's interpretation of HMDA section 304(h)(1)(E) and 304(h)(3)(B) to 
require a balancing test is a regulation that limits the Bureau's 
discretion with respect to public release of HMDA data. The standards 
impose binding obligations on the Bureau to evaluate the HMDA data, 
individually and in combination, to assess whether and how HMDA data 
should be modified prior to its disclosure to the public in order to 
protect applicant and borrower privacy while also fulfilling HMDA's 
public disclosure purposes. The standards for modification of itemized 
information that is or will be available to the public apply to all 
data reported under the 2015 HMDA Final Rule.\34\
---------------------------------------------------------------------------

    \32\ 80 FR 66128, 66134 (Oct. 28, 2015).
    \33\ Id.
    \34\ Id. at 66133, 66252 (noting that the Bureau's application 
of the balancing test would include data fields currently disclosed 
on the modified loan/application register and in the agencies' loan-
level release).
---------------------------------------------------------------------------

    Part III of this proposed Policy Guidance describes the Bureau's 
application of the balancing test to date and its proposals concerning 
the public disclosure of the loan-level HMDA data that will be reported 
to the agencies pursuant to Regulation C as amended by

[[Page 44590]]

the 2015 HMDA Final Rule.\35\ Part IV of this proposed Policy Guidance 
addresses other considerations related to the disclosure of HMDA data, 
including the disclosure of aggregate HMDA data.\36\
---------------------------------------------------------------------------

    \35\ The Bureau received some comments on the 2014 HMDA Proposed 
Rule suggesting that disclosure of certain HMDA data fields could 
reveal confidential business information and that such data fields 
should not be disclosed to the public in order to protect such 
information. The Bureau notes that HMDA requires modification of the 
HMDA data to protect the privacy interests of applicants and 
borrowers without mentioning the protection of confidential business 
information. Although the balancing test adopted in the 2015 HMDA 
Final Rule addresses risks to applicant and borrower privacy created 
by the disclosure of HMDA data, the modifications resulting from its 
application may mitigate some of the confidentiality concerns raised 
by commenters.
    \36\ As discussed above and also below in part IV.C, HMDA and 
Regulation C require the FFIEC to make available to the public 
certain aggregated data. The FFIEC, the Bureau, and the other 
agencies continue to evaluate options for disclosure of the required 
aggregates of data that will be reported under the 2015 HMDA Final 
Rule.
---------------------------------------------------------------------------

III. Application of the Balancing Test

A. The Balancing Test

    As noted above, in the 2015 HMDA Final Rule, the Bureau interpreted 
HMDA to require that public HMDA data be modified when the disclosure 
of the unmodified data creates risks to applicant and borrower privacy 
interests that are not justified by the benefits of such disclosure to 
the public in light of the statutory purposes. Considering the public 
disclosure of the loan-level HMDA dataset as a whole, risks to 
applicant and borrower privacy interests arise under the balancing test 
only where the disclosure of the unmodified loan-level HMDA dataset may 
both substantially facilitate the identification of an applicant or 
borrower in the data and disclose information about the applicant or 
borrower that is not otherwise public and may be harmful or 
sensitive.\37\ Thus, under the balancing test, risks to applicant and 
borrower privacy interests would not arise if a loan-level dataset 
substantially facilitated the identification of applicants and 
borrowers in the data but revealed no information about applicants and 
borrowers that was harmful or sensitive and not otherwise public. 
Alternatively, risks to applicant and borrower privacy interests would 
not arise under the balancing test if a loan-level dataset contained 
harmful or sensitive information about applicants and borrowers that 
was not otherwise public but it was not possible to identify an 
applicant or borrower in the dataset.
---------------------------------------------------------------------------

    \37\ 80 FR 66128, 66134 (Oct. 28, 2015).
---------------------------------------------------------------------------

    Accordingly, under the balancing test, the disclosure of the loan-
level HMDA dataset creates risks to applicant and borrower privacy 
interests only where at least one data field or a combination of data 
fields in the dataset substantially facilitates the identification of 
an applicant or borrower, and at least one data field or combination of 
data fields discloses information about the applicant or borrower that 
is not otherwise public and may be harmful or sensitive. At the 
individual data field level, a field may create ``re-identification 
risk'' by substantially facilitating the identification of an applicant 
or borrower in the HMDA data (for example, as discussed below, because 
it may be used to match a HMDA record to an identified record), or may 
create ``risk of harm or sensitivity'' by disclosing information about 
the applicant or borrower that is not otherwise public and may be 
harmful or sensitive. Assessing the risks to applicant and borrower 
privacy under the balancing test requires an evaluation of the 
unmodified HMDA dataset as a whole and of the individual data fields 
contained in the dataset.
    Where the public disclosure of the unmodified loan-level HMDA 
dataset would create risks to applicant and borrower privacy, the 
balancing test requires that the Bureau consider the benefits of 
disclosure to HMDA's purposes and, where these benefits do not justify 
the privacy risks the disclosure would create, modify the dataset to 
appropriately balance the privacy risks and disclosure benefits. An 
individual data field is a candidate for potential modification under 
the balancing test if its disclosure in unmodified form would create a 
risk of re-identification or a risk of harm or sensitivity.
    As discussed further below, with respect to the HMDA data that will 
be reported to the agencies under the 2015 HMDA Final Rule and based on 
its analysis to date, the Bureau believes that public disclosure of the 
unmodified loan-level dataset, as a whole, would create risks to 
applicant and borrower privacy interests under the HMDA balancing test. 
This is due to the presence in the dataset of individual data fields 
that the Bureau believes would create re-identification risk and the 
presence of individual data fields that the Bureau believes are not 
currently public and would create a risk of harm or sensitivity. The 
Bureau thus has applied the balancing test to determine whether and how 
it should modify the HMDA data that will be reported under the 2015 
HMDA Final Rule before it is disclosed to the public. Based on its 
analysis, the Bureau believes that the balancing test requires the 
loan-level HMDA dataset to be modified before it is disclosed to the 
public to reduce risks to applicant and borrower privacy created by 
disclosure and appropriately balance them with the benefits of 
disclosure for HMDA's purposes. The Bureau proposes to modify the 
public loan-level dataset as described in this proposed Policy 
Guidance.\38\ The Bureau believes that the modifications to the loan-
level HMDA dataset proposed in this Policy Guidance would reduce risks 
to applicant and borrower privacy and appropriately balance them with 
the benefits of disclosure for HMDA's purposes. The Bureau seeks 
comment on all aspects of this proposed Policy Guidance, including its 
analysis of risks to applicant and borrower privacy, its application of 
the balancing test, and its proposed modifications.
---------------------------------------------------------------------------

    \38\ With respect to data compiled in 2018 or later, this 
proposed Policy Guidance describes the modifications the Bureau 
proposes to apply to the agencies' loan-level release and to each 
financial institution's modified loan/application register. The 
terms ``loan-level dataset'' and ``loan-level data'' used herein 
refer to HMDA data disclosed on the loan level, whether the data are 
those submitted by an individual financial institution or by all 
reporting financial institutions.
---------------------------------------------------------------------------

    This part III.A describes the benefits of public disclosure of the 
data that will be reported under the 2015 HMDA Final Rule, the risks to 
applicant and borrower privacy that may be created by the public 
disclosure of the unmodified HMDA data that the Bureau has considered, 
and the Bureau's approach to balancing these benefits and risks. Part 
III.B describes the application of the balancing test to the data that 
will be reported under the 2015 HMDA Final Rule and the Bureau's 
proposed modifications to the loan-level HMDA data that will be 
disclosed to the public.
Disclosure Benefits
    Under the balancing test, the Bureau considers the benefits of 
disclosure of the loan-level HMDA data to the public. As described 
above, HMDA has a long history of providing the public with information 
about mortgage lending activity, and Congress has repeatedly amended 
the statute to increase the scope and utility of the data disclosed to 
the public. Users of HMDA data have relied on this information to help 
achieve HMDA's purposes: Helping to determine whether financial 
institutions are serving the housing needs of their communities; 
assisting public officials in distributing public-sector investment so 
as to attract private investment to areas where it is needed; and 
assisting in identifying possible discriminatory lending patterns and 
enforcing antidiscrimination statutes. Today,

[[Page 44591]]

HMDA data are the preeminent data source that regulators, researchers, 
economists, industry, and advocates rely on to achieve HMDA's purposes 
and to analyze the mortgage market.\39\
---------------------------------------------------------------------------

    \39\ For more information about the history and benefits of 
HMDA, see the supplementary information to the Bureau's 2014 HMDA 
Proposed Rule, 79 FR 51732, 51735-36 (Aug. 29, 2014), and the 
Bureau's 2015 HMDA Final Rule, 80 FR 66128, 66129-31 (Oct. 28, 
2015).
---------------------------------------------------------------------------

    Community groups, researchers, and public officials have used HMDA 
data to help determine whether financial institutions are serving the 
housing needs of their communities. For example, HMDA data have enabled 
community groups to understand the magnitude of disinvestment within 
minority neighborhoods.\40\ Public officials have relied on HMDA data 
to compare the lending activity of financial institutions to the credit 
needs of communities and to examine whether minority communities were 
disproportionately affected by foreclosures following the financial 
crisis.\41\ Further, community groups relied on HMDA data to document 
the rise in subprime lending among minority communities in the years 
before the financial crisis.\42\
---------------------------------------------------------------------------

    \40\ See John Goering and Ron Wienk, ``Mortgage Lending, Racial 
Discrimination and Federal Policy,'' at 10 (Urban Inst. Press 1996).
    \41\ Robert B. Avery & Thomas M. Buynak, ``Economic Review--
Mortgage Redlining: Some New Evidence,'' at 18-32 (Fed. Reserve Bank 
of Cleveland, Working Paper No. 0013-0281, 1981), available at 
https://fraser.stlouisfed.org/scribd/?item_id=4183&filepath=/files/docs/publications/frbclevreview/rev_frbclev_198102.pdf; Carolina 
Reid and Elizabeth Laderman, ``The Untold Costs of Subprime Lending: 
Examining the Links Among Higher-Priced Lending, Foreclosures and 
Race in California'' (Fed. Reserve Bank of S.F., Working Paper No. 
2009-09, 2009), available at https://iasp.brandeis.edu/pdfs/Author/reid-carolina/The%20Untold%20Costs%20of%20Subprime%20Lending%203.pdf.
    \42\ ``Home Mortgage Disclosure Act: Newly Collected Data and 
What It Means,'' Hearing on the 2004 Home Mortgage Disclosure Act 
before the Subcomm. on Fin. Servs. and Consumer Credit of the H. 
Comm. on Fin. Servs., 109th Cong. 4 (2006) (written testimony of 
Calvin Bradford, President, Calvin Bradford Assocs., Ltd., on behalf 
of the Nat'l Fair Hous. Alliance).
---------------------------------------------------------------------------

    Public officials also have used HMDA data to develop and allocate 
housing and community development investments. For example, local 
governments have used HMDA data to characterize neighborhoods for 
purposes of determining the most effective use of housing grants, to 
select financial institutions for contracts and participation in local 
programs, and to identify a need for homebuyer counseling and 
education.\43\ Similarly, the Department of Housing and Urban 
Development used HMDA data to develop the formula by which funding 
would be provided to communities suffering from foreclosures and 
abandonment under the Neighborhood Stabilization Program.\44\
---------------------------------------------------------------------------

    \43\ See City of Albuquerque, Dep't of Family and Comty. Hous., 
``Five Year Consolidated Housing Plan and Workforce Housing Plan 
(2008-2012),'' at 100 (2008), available at http://www.cabq.gov/family/documents/ConsolidatedWorkforceHousingPlan20082012final.pdf; 
City of Antioch, Cal., ``Fiscal Year 2012-2013: Consolidated Annual 
Performance Evaluation Report,'' at 29 (2012), available at http://ci.antioch.ca.us/CitySvcs/CDBGdocs/CAPER%20FY%2012-13.pdf; City of 
Lawrence, Mass., ``HUD Consolidated Plan 2010-2015,'' at 68 (2010), 
available at http://www.cityoflawrence.com/Data/Sites/1/documents/cd/Lawrence_Consolidated_Plan_Final.pdf.
    \44\ See U.S. Dep't of Housing and Urban Dev., ``Neighborhood 
Stabilization Program Formula Methodology'' (2008), available at 
https://www.huduser.gov/portal/datasets/NSP.html.
---------------------------------------------------------------------------

    HMDA data have also been used by public officials, researchers, and 
community groups to identify potentially discriminatory lending 
patterns and to enforce antidiscrimination statutes. For example, 
researchers, journalists, and public officials relied on HMDA data 
along with other publicly available data to identify racial disparities 
in mortgage lending between neighborhoods in Atlanta, Detroit, and 
Boston.\45\ Since Congress amended HMDA to require reporting of the 
race, gender, and income of individual applicants and borrowers,\46\ 
the expanded HMDA data have been used to identify potential 
discriminatory lending practices.\47\ Community groups have used the 
data to monitor fair lending within their communities and enter into 
agreements with financial institutions to ensure that the local needs 
were being served in a responsible manner.\48\ HMDA data also played an 
important role in recent enforcement actions by the Illinois and New 
York Attorneys General related to discriminatory mortgage lending.\49\ 
The Bureau and other regulators regularly rely on HMDA data in fair 
lending analyses, including in identifying possible discriminatory 
practices such as illegal redlining.\50\
---------------------------------------------------------------------------

    \45\ Bill Dedman, ``The Color of Money,'' (parts 1-4), Atlanta 
Journal-Const., May 1-4, 1988; David Everett et al., ``The Race for 
Money,'' (parts 1-4), Detroit Free Press, July 24-27, 1988; Bill 
Dedman, ``Blacks Turned Down for Home Loans from S&Ls Twice as Often 
as Whites,'' Atlanta Journal-Const., Jan. 22, 1989; Katharine 
Bradbury et al., ``Geographic Patterns of Mortgage Lending in 
Boston, 1982-1987,'' New Eng. Econ. Rev., (1989). These reports and 
studies helped motivate Congress to amend HMDA to improve publicly 
available information about lending practices through the Financial 
Institutions Reform, Recovery, and Enforcement Act of 1989.
    \46\ Federal Institutions Reform, Recovery, and Enforcement Act, 
Public Law 101-73, section 1211, Sec.  304, 103 Stat. 183, 524-26 
(1989).
    \47\ For example, researchers have found evidence that, in many 
cases, an applicant's race alone influenced whether the applicant 
was denied credit. See, e.g., Alicia H. Munnell et al., ``Mortgage 
Lending in Boston: Interpreting the HMDA Data,'' at 22 (Am. Econ. 
Rev., Fed. Reserve Bank of Boston Working Paper 92-7 (1992); James 
H. Carr & Isaac F. Megbolugbe, ``The Federal Reserve Bank of Boston: 
Study on Mortgage Lending Revisited,'' 4 J. of Hous. Res. 2, at 277 
(1993).
    \48\ See Adam Rust, ``A Principle-Based Redesign of HMDA and CRA 
Data in Revisiting the Community Reinvestment Act: Perspectives on 
the Future of the Community Reinvestment Act,'' at 179 (Fed. Reserve 
Banks of Bos. and S.F. 2009).
    \49\ Yana Kunichoff, ``Lisa Madigan credits Reporter with 
initiating largest discriminatory lending settlements in U.S. 
history,'' Chicago Rep. (June 14, 2013), available at http://www.chicagonow.com/chicago-muckrakers/2013/06/lisa-madigan-credits-reporter-with-initiating-largest-discriminatory-lending-settlements-in-u-s-history/; Press Release, N.Y. State Off. of the Att'y Gen., 
``Attorney General Cuomo Obtains Approximately $1 Million For 
Victims Of Greenpoint's Discriminatory Lending Practices'' (July 16, 
2008), available at http://www.ag.ny.gov/press-release/attorney-general-cuomo-obtains-approximately-1-million-victims-greenpoints.
    \50\ Although certain regulators have access to the non-public 
HMDA data, their analyses also rely heavily on data fields that are 
publicly disclosed.
---------------------------------------------------------------------------

    In enacting the Dodd-Frank Act in 2010, Congress expanded the data 
financial institutions are required to collect, report, and disclose 
under HMDA and authorized the Bureau to require additional information. 
The Bureau's 2015 HMDA Final Rule amended Regulation C to implement the 
Dodd-Frank Act amendments and address the informational shortcomings 
exposed by the financial crisis to better meet the needs of the public, 
public officials, and regulators. Although the 2015 HMDA Final Rule did 
not address the specific data fields that would be disclosed to the 
public in the loan-level HMDA data, the rule required the collection 
and reporting of a number of data fields which, if publicly disclosed, 
would improve the ability of HMDA data users to fulfill HMDA's 
purposes.
    For example, mandatory reporting of information about the reasons 
for denial of a loan application, combined with data fields used to 
make underwriting decisions, would improve the ability to understand 
lenders' decision-making and to identify possible discriminatory 
lending patterns in underwriting. Pricing information, such as rate 
spread for additional types of loans, total loan costs, total discount 
points, lender credits, and interest rate, would allow users to better 
understand pricing decisions and the cost of credit to mortgage 
borrowers. Information about manufactured housing and multifamily 
financing would allow users to better understand important sources of 
housing for low-income and potentially financially vulnerable 
borrowers, which helps users determine whether financial institutions 
are serving the housing needs of their communities and helps public 
officials target public investment

[[Page 44592]]

to better attract private investment. Information about the ages of 
applicants or borrowers and disaggregated racial and ethnic information 
would assist in identifying potentially discriminatory lending patterns 
and help determine whether financial institutions are serving the 
housing needs of their communities. Data fields about occupancy status 
and home-equity lines of credit provide information about potentially 
speculative purchases of housing and the degrees of leverage borrowers 
are undertaking. This information would better allow users to identify 
trends in the mortgage market that may increase systemic risk to the 
overall economy. Understanding these risks helps public officials 
distribute public-sector investment and helps users determine whether 
financial institutions are serving the housing needs of their 
communities.
    Today, HMDA data represent a public good that responds to the fact 
that private lenders do not, in the ordinary course, make information 
about their loans and lending decisions publicly available. HMDA 
provides the only source of loan-level mortgage data with comprehensive 
national coverage that is free and easily accessible to the public. 
Other publicly available mortgage datasets lack information crucial for 
HMDA's purposes that is found in the HMDA data, such as the race, 
ethnicity, and sex of applicants and borrowers. Private data vendors 
sell several large datasets that typically contain data collected from 
the largest mortgage loan servicers or securitizers, but none of these 
datasets match the coverage of the HMDA data. These private datasets 
also typically lack information that identifies individual lenders and 
therefore cannot be used to study whether specific lenders are meeting 
community needs or may be making discriminatory credit decisions. 
Additionally, the Bureau is aware of no private dataset that includes 
information about applications that do not result in originated loans. 
By including applications in addition to originated and purchased 
loans, HMDA provides a near-census of the mortgage market that allows 
users to draw a detailed picture of the supply and demand of mortgage 
credit at various levels of geographic and lender aggregation. Finally, 
unlike the HMDA data, private datasets are costly for subscribers, 
creating a substantial hurdle for many community groups, government 
agencies, and researchers that wish to access them.
    HMDA data also benefit users by addressing the information 
asymmetries present in credit markets. The degree of control that 
lenders exercise over the mortgage lending process gives them a 
significant information advantage over borrowers, researchers, and 
other members of the public. This advantage can contribute to certain 
types of lender behavior, such as discrimination or predatory lending, 
that conflict with the best interests of borrowers and the housing 
needs of communities. The relative difference in information may also 
lead to herding behavior where both lenders and consumers pursue risky 
mortgage loans based primarily on the popularity of these products, 
creating substantial systemic risk to the mortgage market and the 
financial system. Publicly available mortgage data increase 
transparency in the mortgage market, narrowing the information gap 
between lenders and borrowers, community groups, and public officials. 
Greater information can enable these latter parties to advocate for 
financial institutions to maintain fair practices and serve the housing 
needs of their communities, and can increase the prospect of self-
correction by financial institutions. Additional information also helps 
to reduce the herding behavior of both lenders and borrowers, reducing 
systemic risk.
Risks to Applicant and Borrower Privacy Interests
    The Bureau has considered the risks to applicant and borrower 
privacy that may be created by the public disclosure of the HMDA data 
that will be reported to the agencies under the 2015 HMDA Final Rule. 
Based on its analysis to date, the Bureau believes that public 
disclosure of the unmodified loan-level dataset, as a whole, would 
create risks to applicant and borrower privacy interests under the HMDA 
balancing test. As described in more detail below, this is due to the 
presence in the dataset of individual data fields that the Bureau 
believes would create re-identification risk and the presence of 
individual data fields that the Bureau believes would create a risk of 
harm or sensitivity. However, the Bureau believes that the 
modifications to the loan-level HMDA dataset proposed in this Policy 
Guidance would reduce these risks to applicant and borrower privacy and 
appropriately balance them with the benefits of disclosure for HMDA's 
purposes.
Re-Identification Risk
    In evaluating the potential re-identification risk presented by the 
disclosure of the unmodified loan-level HMDA data that will be reported 
under the 2015 HMDA Final Rule, the Bureau has considered the data 
fields contained in the dataset, the likely methods by which applicants 
and borrowers could be identified in the dataset, the nature and 
availability of additional datasets that may be useful to the re-
identification of HMDA data, and the incentives and capabilities of 
persons interested in re-identification. The Bureau uses the term 
``adversary'' when referring to such persons.\51\ The term is not 
intended to indicate that the adversary's motives are necessarily 
malicious or adverse to the interests of the individuals in the 
dataset.
---------------------------------------------------------------------------

    \51\ See, e.g., Nat'l Inst. of Standards & Tech., ``De-
Identification of Personal Information (2015),'' available at http://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf (using 
``adversary'' to refer to an entity attempting to re-identify data).
---------------------------------------------------------------------------

    In the HMDA context, the Bureau is concerned about two re-
identification scenarios. First, an adversary may use common data 
fields to match a HMDA record to a record in another dataset that 
contains the identity of the applicant or borrower. Second, an 
individual may rely on pre-existing personal knowledge to recognize an 
applicant or borrower's record in the unmodified HMDA data.
    Under the first scenario, it may be possible to match a HMDA record 
to a record from an identified dataset directly, or data fields from 
additional datasets may need to be matched to the HMDA record to 
complete the match to the identified record. However, successfully re-
identifying a HMDA record would require several steps and may present a 
significant challenge. First, an adversary generally would have to 
isolate a record that is unique within the HMDA data. A HMDA record is 
unique when the values of the data fields associated with it are shared 
by no other HMDA record. But a HMDA record's uniqueness alone would not 
automatically result in its re-identification; an adversary would have 
to find a record corresponding to the applicant or borrower in another 
dataset that shares data fields with the unique HMDA record that permit 
the records to be matched. Once a unique HMDA record has been matched 
to a corresponding record, an adversary would possess any additional 
fields found in the corresponding record but not found in the HMDA 
record, such as the identity of the applicant or borrower.\52\ However, 
even after accomplishing such a match, an adversary might not have 
accurately re-identified the true applicant or borrower to whom the 
HMDA record relates.\53\
---------------------------------------------------------------------------

    \52\ If the corresponding record lacks the name of the applicant 
or borrower, an adversary may be able to use data fields from the 
corresponding record to match to a record in another identified 
dataset.
    \53\ For example, if the corresponding record is not the only 
record in the other dataset that shares certain data fields with the 
unique HMDA record, an adversary would have to make a probabilistic 
determination as to which corresponding record belongs to the 
applicant or borrower. Also, depending on the coverage of the other 
dataset, a corresponding record may be unique in the other dataset 
but not unique in the general population.

---------------------------------------------------------------------------

[[Page 44593]]

    The HMDA data that will be reported under the 2015 HMDA Final Rule, 
like the data reported under current Regulation C, contain data fields 
that create re-identification risk. First, the HMDA data display a high 
level of record uniqueness.\54\ As explained above, record uniqueness 
alone does not mean that a record can be re-identified, but a unique 
HMDA record could be matched to a corresponding record in another 
dataset that is available to an adversary. In the HMDA context, the 
Bureau believes that particularly relevant sources of identified data 
for matching purposes are publicly available real estate transaction 
records and property tax records. Although there is variance by 
jurisdiction, such records are often available electronically and 
typically identify a borrower through documents such as the mortgage or 
deed of trust. These documents typically include the loan amount, the 
financial institution, the unique identifier assigned to the mortgage 
originator, the borrower's name, and the property address, and may 
include other information. Because some of these data fields are also 
present in the HMDA data, the Bureau believes that the release of loan-
level HMDA data without any modifications would create a risk that 
these public records could be directly matched to a HMDA record to re-
identify an applicant \55\ or borrower.
---------------------------------------------------------------------------

    \54\ In 2005, researchers at the Board found that ``[m]ore than 
90 percent of the loan records in a given year's HMDA data are 
unique--that is, an individual lender reported only one loan in a 
given census tract for a specific loan amount.'' Robert B. Avery et 
al., ``New Information Reported under HMDA and Its Application in 
Fair Lending Enforcement,'' at 367 Fed. Reserve Bulletin (Summer 
2005), available at http://www.federalreserve.gov/pubs/bulletin/2005/3-05hmda.pdf.
    \55\ None of the public or private datasets discussed herein 
include information about applications that do not result in 
originated mortgage loans. The Bureau believes that the lack of 
public information about applications would significantly reduce the 
likelihood that an adversary could match the record of a HMDA loan 
application that was not originated to an identified record in 
another dataset. Therefore, the Bureau believes that the risk of re-
identification to applicants is significantly lower than the risk to 
borrowers. However, some of the information contained in the 
unmodified HMDA data for applicants may permit an adversary to re-
identify an applicant despite the lack of publicly available real 
estate records reflecting the transaction. For example, if an 
applicant withdraws an application and obtains a loan secured by the 
same property from another institution, it may be possible to link 
the HMDA data for the withdrawn application with the data for the 
origination, as much of the property and borrower information will 
be identical.
---------------------------------------------------------------------------

    Other publicly available sources of data similar to those included 
in the HMDA data that will be reported under the 2015 HMDA Final Rule 
include loan-level performance datasets made available by the 
Government-Sponsored Enterprises (GSEs) and mortgage-backed securities 
datasets made available by the Securities and Exchange Commission 
through the Electronic Data Gathering, Analysis, and Retrieval (EDGAR) 
system.\56\ The loan-level performance datasets include data fields 
similar to those that will be included in the unmodified HMDA data, 
such as credit score, loan amount, interest rate, debt-to-income ratio, 
combined loan-to-value ratio, and loan-to-value ratio. The mortgage-
backed securities dataset includes similar information, such as the 
credit score, loan amount, lien status, property value, and debt-to-
income ratio. These datasets are available online with limited 
restrictions on access. But these datasets do not include the name of 
the borrower; as described above, this means that an adversary who is 
able to match a record in one of these datasets to a record in HMDA 
would need to make an additional match to an identified dataset to re-
identify a borrower. And some of these datasets contain restrictions on 
use, such as a prohibition on attempting to re-identify individual 
borrowers.\57\
---------------------------------------------------------------------------

    \56\ SE.C., ``Electronic Data Gathering, Analysis, and Retrieval 
(EDGAR),'' https://www.sec.gov/edgar.shtml (last visited January 26, 
2017); Fannie Mae, ``Fannie Mae Single-Family Loan Performance 
Dataset,'' http://www.fanniemae.com/portal/funding-the-market/data/loan-performance-data.html (last visited Jan. 26, 2017); Freddie 
Mac, ``Single Family Loan-Level Dataset,''http://www.freddiemac.com/news/finance/sf_loanlevel_dataset.html (last visited Jan. 26, 2017); 
Ginnie Mae, ``Data Dictionaries,'' http://www.ginniemae.gov/investors/disclosures_and_reports/Pages/Disclosure-Data-Dictionaries.aspx (last visited Jan. 26, 2017).
    \57\ See, e.g., Freddie Mac, ``Terms for Single-Family Loan-
Level Dataset Registration and Login Pages,'' https://freddiemac.embs.com/FLoan/HistoricalDataTerms.html (last visited 
Mar. 20, 2017).
---------------------------------------------------------------------------

    Private datasets that could be matched to the HMDA data are also 
available. For example, data brokers collect information about 
consumers from a wide range of sources and sell it for a variety of 
purposes, including marketing, identity verification, and fraud 
detection.\58\ These datasets typically include data collected from 
commercial, government, and other publicly available sources and may 
contain data about mortgage loan borrowers, including age, income, 
loan-to-value ratio, property value, loan amount, address, race, 
ethnicity, and origination date. Other datasets specific to mortgage 
loans are provided for purposes of evaluating mortgage-backed 
securities, identifying marketing opportunities, or analyzing market 
trends. These datasets may include loan amount, interest rate, credit 
score, negative amortization features, and closing date. Some of these 
datasets include the names of consumers, although others contain de-
identified loan-level mortgage data. However, these datasets may 
contain contractual restrictions on use and re-disclosure, including 
prohibiting their use for re-identification purposes, and may be cost-
prohibitive for many potential adversaries.
---------------------------------------------------------------------------

    \58\ See generally Fed. Trade Comm'n, ``Data Brokers: A Call for 
Transparency and Accountability,'' (May 2014), available at https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf (describing the types of products 
offered and the data sources used by data brokers).
---------------------------------------------------------------------------

    In addition to considering the steps an adversary would need to 
complete to re-identify the HMDA data and the various data sources that 
may be required to accomplish re-identification, including their 
limitations, the Bureau also has considered the capacity, incentives, 
and characteristics of potential adversaries, including those that may 
attempt re-identification for harmful purposes. The Bureau believes 
that some potential adversaries may be interested in re-identifying the 
HMDA data for marketing or other commercial purposes. For example, the 
unmodified HMDA data contain information about applicants and 
borrowers, and features of the loans they obtained or applied for, that 
the Bureau believes would have commercial appeal for marketing and 
advertising. Although extensive data about identified consumers is 
already available to marketers, the Bureau believes that at least some 
of the HMDA data that may be useful to marketers are typically not 
publicly available from any source for marketing purposes, are 
available in limited circumstances,\59\ or may be less reliable or 
precise than the HMDA data may be perceived to be.\60\ These potential 
adversaries could possess the resources to use private

[[Page 44594]]

datasets in addition to publicly available records to re-identify the 
HMDA data. However, the Bureau has considered the extent to which much 
of the commercial benefit to be obtained by re-identifying the HMDA 
data may be more readily available from private datasets to which these 
potential adversaries already have access without the need for recourse 
to the HMDA data. In many cases, information from other datasets may be 
timelier than that found in the HMDA data, where the delay between 
action taken on a loan and disclosure of the loan-level HMDA data 
ranges from 3 to 15 months. Further, some of these potential 
adversaries may refrain from re-identifying the HMDA data for 
reputational reasons or because they have agreed to restrictions on 
using data from the additional datasets described above for re-
identification purposes.
---------------------------------------------------------------------------

    \59\ For example, a marketer currently may obtain from a 
consumer reporting agency a ``prescreened'' list of consumers 
meeting certain criteria, such as a minimum credit score, only for 
the purpose of making a ``firm offer of credit or insurance.'' 15 
U.S.C. 1681b(c), 1681a(l).
    \60\ For example, private datasets may only contain an estimate 
of the household income, while the HMDA data contains the gross 
annual income relied on by the financial institution, which may be 
more accurate.
---------------------------------------------------------------------------

    Additionally, although most academics, researchers, and journalists 
use HMDA data only for HMDA purposes or market monitoring, some may be 
interested in re-identifying the HMDA data for purposes of research. 
These persons may differ in their capacity to re-identify an applicant 
or borrower in the HMDA data. The Bureau believes that those who lack 
resources are likely to attempt to match a HMDA record to publicly 
available datasets such as real estate transaction records, while those 
with relatively greater resources may also rely on private datasets. 
However, as mentioned above, some private datasets may have contractual 
terms prohibiting their use for re-identification purposes. Further, 
those academics or journalists with significant resources may be 
affiliated with organizations that have reputational or institutional 
interests that would not be served by re-identifying the HMDA data. 
These factors may reduce the risk of re-identification by such persons.
    The Bureau has considered whether parties intending to commit 
identity theft or financial fraud may have the incentive and capacity 
to re-identify the HMDA data. As discussed further below, the Bureau 
believes that the HMDA data would be of minimal use for these purposes. 
For example, the HMDA data will not include information typically 
required to open new accounts in a consumer's name, such as Social 
Security number, date of birth, place of birth, passport number, or 
driver's license number, nor will they include information useful to 
perpetrate existing account fraud, such as account numbers or 
passwords. Further, these potential adversaries are not law abiding and 
may have easier, albeit illegal, ways to secure data for these purposes 
than attempting to re-identify loan-level HMDA data. The resources of 
these potential adversaries likely vary, so some may be able to use 
private datasets in addition to publicly available records to re-
identify the HMDA data were they to attempt to do so.
    In addition to the possibility of re-identifying borrowers through 
matching HMDA data to other datasets, some potential adversaries may be 
able to re-identify a particular applicant or borrower in the HMDA data 
by relying on personal knowledge about the applicant or borrower. As 
noted above, the Bureau believes that the HMDA data display a high 
level of record uniqueness, and the unmodified HMDA data include 
location and demographic information, such as race, sex, ethnicity, and 
age, that may be known to a potential adversary who is familiar with a 
specific applicant or borrower. Therefore, such a potential adversary 
may be able to re-identify a known applicant or borrower even if 
traditionally identifying information is not disclosed and without 
attempting to match a HMDA record to an identified record. This 
potential adversary could include a neighbor or acquaintance of the 
applicant or borrower, and the interest in re-identification may range 
from mere curiosity to the desire to embarrass or otherwise harm the 
applicant or borrower. Although these potential adversaries may lack 
the sophistication or resources required to re-identify a HMDA record 
by matching it to other datasets, they may possess a high level of 
specific knowledge about the characteristics of a particular applicant 
or borrower. Because the pre-existing personal knowledge possessed by 
such a potential adversary is typically limited to information about a 
single individual, or a small number of individuals, any re-
identification attempt by such a potential adversary would likely 
target or impact a limited number of individuals. Although the Bureau 
believes that location and demographic information may be more likely 
to be known than other information in the HMDA data, it is impossible 
to predict the exact content of any pre-existing personal knowledge 
that such a potential adversary may possess. This uncertainty creates 
challenges for evaluating the degree to which individual data fields 
contribute to the risk of re-identification by such a potential 
adversary.\61\
---------------------------------------------------------------------------

    \61\ For example, although the Bureau is aware of no dataset 
with detailed information on mortgage loan applicants, an adversary 
with personal knowledge of an applicant could identify an applicant 
in the HMDA data.
---------------------------------------------------------------------------

Risk of Harm or Sensitivity
    The Bureau has considered whether, if a loan-level record in the 
HMDA dataset were re-identified, HMDA data that will be reported under 
the 2015 HMDA Final Rule would disclose information about the applicant 
or borrower that is not otherwise public and may be harmful or 
sensitive. To the extent a HMDA record could be associated with an 
identified applicant or borrower and could also be successfully matched 
to another de-identified dataset to re-identify such a dataset, harmful 
or sensitive information in that dataset that is not otherwise public 
may also be disclosed. The Bureau has considered whether the HMDA data 
could be used for harmful purposes such as perpetrating fraud or 
identity theft against an applicant or borrower or for targeted 
marketing of products and services that may pose risks that are not 
apparent. The Bureau has also considered whether certain HMDA data 
fields may be viewed as sensitive if associated with a particular 
applicant or borrower, even where the disclosure of the data field is 
unlikely to lead to financial or other tangible harms. In evaluating 
the potential sensitivity of a data field, the Bureau has also 
considered whether disclosure of the data field could cause dignity or 
reputational harm or embarrassment, or could be considered outside of 
societal or cultural expectations with respect to what information is 
available to the general public.
    As noted above, today, significant amounts of identifiable data 
concerning consumers is available to the general public, including in 
public records. Identifiable consumer information is also available 
from commercial data sources with varying barriers to access and 
restrictions on use. In evaluating the risk of harm or sensitivity 
created by the public disclosure of loan-level HMDA data, the Bureau's 
analysis has considered the degree to which such disclosure would 
increase these risks to applicant and borrower privacy compared to the 
risks that already exist, absent the public availability of the data in 
HMDA. Accordingly, the Bureau has considered whether the data that will 
be reported under the 2015 HMDA Final Rule are typically publicly 
available in an identifiable form and, if so, any barriers to accessing 
the information or restrictions on its use. Depending on the nature and 
extent of the public availability of a particular data field, the 
Bureau generally considers public

[[Page 44595]]

availability to reduce any risk of harm or sensitivity that may be 
created by the public disclosure of the data field in the loan-level 
HMDA data. For example, although some borrowers may consider the amount 
of their mortgage to be sensitive, the Bureau believes that this 
information is often publicly available and considers such availability 
to reduce the risk of harm or sensitivity that may be created by the 
disclosure of this unmodified data field in the HMDA data. In other 
words, if potentially harmful or sensitive information about an 
applicant or borrower is already available to the general public, 
disclosure of that information in the loan-level HMDA data creates less 
risk of additional harm or sensitivity than if the data were otherwise 
not publicly available about the applicant or borrower.
    In evaluating the risk of harm or sensitivity created by the 
disclosure of the loan-level HMDA data, the Bureau also has considered 
the likelihood that the loan-level HMDA data would be re-identified and 
used for harmful purposes or to embarrass or damage the reputation of 
an applicant or borrower. As discussed above, the Bureau generally 
believes that successful re-identification of loan-level HMDA data 
would require several steps and may represent a significant challenge. 
Even where an adversary is able to match a HMDA record to a record in 
an identified dataset, the adversary still may not have accurately 
identified the true applicant or borrower to whom the HMDA record 
relates. To the extent that the risk that re-identification would be 
accomplished is low, the risk of disclosing harmful or sensitive 
information is reduced.
    The Bureau believes that the unmodified loan-level HMDA data that 
will be reported under the 2015 HMDA Final Rule would be of minimal use 
for purposes of perpetrating identity theft or financial fraud against 
applicants and borrowers. As noted above, the HMDA data will not 
include information typically required to open new accounts in a 
consumer's name, such as Social Security number, date of birth, place 
of birth, passport number, or driver's license number, nor do they 
include information useful to perpetrate existing account fraud, such 
as account numbers or passwords.\62\ Although almost any information 
relating to an individual could at least theoretically be used by an 
adversary seeking to steal the identity of or commit fraud against the 
individual, the Bureau does not believe that disclosure of the HMDA 
data would be likely to increase information available for these 
purposes. For example, the HMDA data will include the name of the 
financial institution and other details about the loan terms that could 
be used in a phishing attack against an applicant or borrower by a 
perpetrator pretending to be the financial institution,\63\ but data 
that could be used for this purpose are often already available in 
publicly available real estate transaction records. The Bureau has also 
considered whether the HMDA data could be used for knowledge-based 
authentication purposes,\64\ but believes the data are unlikely to 
increase information available that is typically used for such 
purposes.
---------------------------------------------------------------------------

    \62\ As noted above, however, to the extent a HMDA record could 
be associated with an identified applicant or borrower and could 
also successfully be matched to a de-identified dataset to re-
identify such a dataset, harmful or sensitive information in that 
dataset that is not otherwise public may also be disclosed.
    \63\ Phishing is an attempt by a perpetrator to obtain sensitive 
information, such as account numbers or passwords, by masquerading 
as a legitimate company. Phishing is typically conducted by 
fraudulent email messages appearing to come from a legitimate 
company that direct the recipient to a spoofed Web site or otherwise 
get the recipient to divulge private information. The perpetrators 
then use this private information to commit identity theft.
    \64\ Knowledge-based authentication (KBA) is a method of 
authentication which seeks to prove the identity of someone 
accessing a service, such as an account at a financial institution. 
KBA requires the knowledge of information about a particular 
individual to prove that a person attempting to access a service is 
the individual. ``Static'' KBA, also known as ``shared secrets,'' 
relies on information initially shared by the individual to the 
provider of the service, such as an answer to a question, which is 
later retrieved when an individual seeks to access the service. 
``Dynamic'' KBA uses knowledge questions to verify identity but does 
not require the individual to have provided the questions and 
answers beforehand. Dynamic KBA questions are compiled from data 
known to or obtained by the institution, such as transaction history 
or data from credit reports.
---------------------------------------------------------------------------

    The Bureau believes that some of the unmodified loan-level HMDA 
data would provide information that is not already public and could be 
used to target applicants and borrowers for marketing, including 
marketing for products and services that may pose risks that are not 
apparent. As noted above, the unmodified HMDA data would provide 
information about an applicant's or borrower's financial condition and, 
with respect to a borrower, details about the loan obtained. The Bureau 
believes that, at least for a period of time after the loan-level HMDA 
data are disclosed, this information may be useful to those looking to 
offer financial products and services or otherwise improve market 
segmentation. Although these data could be used to market products and 
services that would be beneficial for applicants and borrowers, perhaps 
increasing competition among lenders that could help consumers receive 
the best loan terms possible, they could also be used to target 
potentially vulnerable consumers with marketing for products and 
services that may pose risks that are not apparent. For example, 
certain information about a loan might be perceived to reveal 
information about a borrower's sophistication as a consumer of 
financial products and services, and information about a borrower's 
financial condition may suggest vulnerability to scams relating to debt 
relief or credit repair.
    Finally, the Bureau believes that some of the unmodified loan-level 
HMDA data that will be reported to the agencies under the 2015 HMDA 
Final Rule would be considered sensitive by most consumers. In 
assessing whether a data field creates a risk of sensitivity, the 
Bureau has considered if its disclosure could lead to dignity or 
reputational harm or embarrassment, or could be considered outside of 
societal or cultural expectations with respect to what information is 
available to the general public.
Balancing Risks and Benefits
    In applying the balancing test, the Bureau has considered the risks 
to applicant and borrower privacy interests that would be created by 
the public disclosure of the unmodified loan-level HMDA data that will 
be reported under the 2015 HMDA Final Rule and the benefits of such 
disclosure in light of HMDA's purposes. As discussed above, assessing 
risks to applicant and borrower privacy under the balancing test 
requires an evaluation of the unmodified HMDA dataset as a whole and of 
the individual data fields contained in the dataset. In developing this 
proposal, the Bureau reviewed the contribution of each data field, 
individually and in combination, toward the potential re-identification 
of an applicant or borrower in the HMDA dataset. As described above, 
for purposes of the HMDA balancing test, a significant re-
identification risk is created by uniqueness in the HMDA data among 
data fields that are also found in other records that identify an 
applicant or borrower. The Bureau has reviewed the availability of 
public records in several jurisdictions and has also considered 
qualitative factors such as the capacity, incentives, and 
characteristics of potential adversaries that may be interested in re-
identification, the public availability of HMDA data fields in other 
datasets, the barriers to obtaining these datasets, and

[[Page 44596]]

the degree to which the other datasets are identifiable. The Bureau has 
also considered whether certain data fields may be more likely than 
others to be known by a potential adversary with personal knowledge 
about the applicant or borrower.
    The Bureau also considered whether disclosure of the loan-level 
HMDA data, if it were to be re-identified, would reveal information 
about the applicant or borrower that is not otherwise public and may be 
harmful or sensitive. As described above, this consideration involved 
reviewing the potential for disclosure to cause financial fraud or 
identity theft, harmful targeted marketing, or sensitivity concerns. 
The Bureau considered the nature of potential harms that might result 
from disclosure of each data field individually and in combination, and 
the strength of the field's contribution to such harms. The Bureau also 
considered whether each data field is typically publicly available in 
identified records and, if so, any barriers to accessing the 
information or restrictions on its use.
    In addition, the Bureau evaluated the contribution of the data 
fields, both individually and in combination, toward the purposes of 
HMDA: Helping to determine whether financial institutions are serving 
the housing needs of their communities; assisting public officials in 
distributing public-sector investment so as to attract private 
investment to areas where it is needed; and assisting in identifying 
possible discriminatory lending patterns and enforcing 
antidiscrimination statutes. Every HMDA data field provides benefits to 
achieving the statutory purposes, but different data fields may provide 
more value for certain statutory purposes or types of analyses. Data 
fields were examined for both current and potential uses.
    For data fields the public disclosure of which the Bureau 
preliminarily believes would create risks to applicant and borrower 
privacy interests, either because a field increases re-identification 
risk or poses a risk of harm or sensitivity, the Bureau has weighed 
these risks against the benefits of disclosure. Where the Bureau has 
preliminarily determined that the disclosure of an individual data 
field, alone or in combination with other fields, would create risks to 
applicant and borrower privacy that are not justified by the benefits 
of disclosure to HMDA's purposes, the Bureau has considered whether it 
could appropriately balance the privacy risks and disclosure benefits 
through strategies such as binning, rounding, and top- and bottom-
coding,\65\ or whether the public dataset should be modified by 
excluding the field. The Bureau has also evaluated the risks and 
benefits of disclosing a data field in light of the proposed 
modifications considered for the other data fields. The Bureau is 
mindful of the connection between the risk of re-identification and the 
risk of harm or sensitivity. To the extent that the risk of re-
identification created by disclosure of the HMDA data is reduced, the 
risk of disclosing harmful or sensitive information is also reduced. 
Conversely, to the extent that the public loan-level HMDA data do not 
disclose information that is harmful or sensitive, the consequences of 
re-identification are reduced. Where the Bureau has preliminarily 
determined that some modification of a data field is appropriate, the 
Bureau's consideration of the available forms of modification for the 
HMDA data is also informed by the operational challenges associated 
with various forms of modification and the need to make financial 
institutions' modified loan/application registers available to the 
public by March 31 following the calendar year for which the data are 
reported.\66\
---------------------------------------------------------------------------

    \65\ Binning, sometimes known as recoding or interval recoding, 
allows data to be shown clustered into ranges rather than as precise 
values. Top- and bottom-coding masks the precise values of a data 
field that appear above or below a certain threshold.
    \66\ As discussed below in part IV.B, the Bureau will make a 
modified loan/application register for each financial institution 
available on its Web site by March 31 following the calendar year 
for which the information was compiled. With respect to data 
compiled in 2018 or later, this proposed Policy Guidance describes 
the modifications the Bureau proposes to apply to each financial 
institution's modified loan/application register, with the possible 
exception of modifications to reflect whether the loan amount is 
above the applicable dollar amount limitation on the original 
principal obligation in effect at the time of application or 
origination as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 
1454(a)(2), which may be disclosed later than March 31. HMDA data is 
reported by March 1 of the year following the calendar year for 
which the information was compiled, leaving the Bureau as little as 
30 days to prepare each financial institution's modified loan/
application register.
---------------------------------------------------------------------------

B. Application of the Balancing Test to Loan-Level HMDA Data

    As described above, the Bureau has interpreted HMDA to require that 
public HMDA data be modified when the release of the unmodified data 
creates risks to applicant and borrower privacy interests that are not 
justified by the benefits of such release to the public in light of 
HMDA's purposes. Based on its analysis to date, the Bureau believes 
that public disclosure of the unmodified loan-level data that will be 
reported to the agencies under the 2015 HMDA Final Rule, as a whole, 
would create risks to applicant and borrower privacy interests under 
the HMDA balancing test. This is due to the presence in the data of 
individual data fields that the Bureau believes would create re-
identification risk and the presence of individual data fields that the 
Bureau believes would create a risk of harm or sensitivity. The Bureau 
has applied the balancing test to determine whether and how to modify 
the HMDA data that will be reported under the 2015 HMDA Final Rule 
before it is disclosed to the public and is seeking comment on its 
proposed modifications.
    For the reasons discussed below, based on its application of the 
balancing test, the Bureau proposes to exclude or otherwise modify the 
following data fields in the loan-level HMDA data disclosed to the 
public: Universal loan identifier (ULI), application date, loan amount, 
action taken date, property address, age, credit score, debt-to-income 
ratio, property value, the unique identifier assigned by the Nationwide 
Mortgage Licensing System and Registry for the mortgage loan originator 
(NMLS ID); and automated underwriting system (AUS) result. The Bureau 
also proposes to exclude the content of free-form text fields used in 
certain instances to report the following data: Race, ethnicity, name 
and version of credit score model, reason for denial, and AUS system 
name. The Bureau proposes to publicly disclose without modification the 
remaining data reported to the agencies under the 2015 HMDA Final Rule. 
As discussed above, HMDA and Regulation C require the FFIEC to make 
available to the public certain aggregated data. The Bureau, in 
consultation with the other agencies, intends to evaluate options for 
providing the HMDA data, including the modified data, to the public in 
aggregated form, including through the aggregated data products the 
FFIEC is required to make available and other vehicles.\67\
---------------------------------------------------------------------------

    \67\ See part IV.C, below.
---------------------------------------------------------------------------

    The Bureau acknowledges that the proposed modifications would not 
completely eliminate risks to applicant and borrower privacy that would 
likely be created by the disclosure of loan-level HMDA data, but the 
Bureau believes that these modifications would reduce such risks to the 
extent necessary to appropriately balance them with the benefits of 
disclosure for HMDA's purposes. The Bureau believes that, to the extent 
that the public disclosure of the loan-level HMDA data, modified as 
proposed, would create risks to applicant and borrower privacy, such 
risks would be justified by the benefits of such release to the public 
in light of HMDA's purposes.

[[Page 44597]]

    The Bureau has considered whether, in light of what it believes to 
be a reduced risk of re-identification for HMDA records reflecting an 
application where no loan was originated, more data could be disclosed 
without modification for those records. As discussed above, the Bureau 
believes that the lack of publicly available information about 
applications would make it significantly more difficult for an 
adversary to re-identify an applicant by matching a HMDA record to a 
record from an identified dataset. However, the Bureau believes that 
some risk of re-identification by matching may remain in some 
circumstances,\68\ and notes that an adversary's personal knowledge may 
also permit re-identification of an application record. Further, the 
possibility that transactions could be reported as applications in 
error and be subsequently corrected in a resubmission would create risk 
that the previously-applied modifications would no longer be 
appropriate; the previously-disclosed HMDA data would have revealed 
information creating risks to applicant and borrower privacy that would 
not be justified by the benefits of disclosure. Finally, an approach 
requiring that different types of records in the dataset are subject to 
different modifications would be operationally challenging and costly 
to implement. In light of these privacy and operational concerns, the 
Bureau is not proposing this approach at this time, but invites comment 
on it.
---------------------------------------------------------------------------

    \68\ See supra note 53.
---------------------------------------------------------------------------

    The Bureau seeks comment on all aspects of its analysis and the 
modifications it proposes to apply to the public loan-level HMDA 
dataset under the balancing test. The Bureau notes that, even after it 
finalizes this Policy Guidance, it intends to continue to monitor 
developments affecting the application of the balancing test to the 
HMDA data. The privacy landscape is constantly evolving, and risks to 
applicant and borrower privacy created by the disclosure of loan-level 
HMDA data may change as the result of technological advances and other 
external developments. For example, a new source of publicly available 
records may become available, increasing or decreasing privacy risks 
under the balancing test, or the Bureau may discover evidence 
suggesting that individuals are using the HMDA data in unforeseen, 
potentially harmful ways. Potential uses of the loan-level HMDA data in 
furtherance of the statute's purposes may also evolve, such that the 
benefits associated with the disclosure of certain data may increase to 
an extent that justifies providing more information to the public. For 
example, a new loan program may emerge with debt-to-income ratio 
requirements that increase the benefits of releasing more precise 
information about the debt-to-income ratios of applicants or borrowers 
than the Bureau proposes herein to release. Such developments and other 
changed circumstances may require that, even after this proposed Policy 
Guidance is finalized, the Bureau revisit the conclusions previously 
reached based on the application of the balancing test in order to 
ensure the appropriate protection of applicant and borrower privacy in 
light of HMDA's purposes.
    The Bureau is proposing this Policy Guidance to provide 
transparency, obtain public feedback, and improve the Bureau's 
decisionmaking. This proposed Policy Guidance and any final Policy 
Guidance concerning the public disclosure of loan-level HMDA data are 
non-binding in part because flexibility to revise the modifications 
proposed to apply to the public loan-level HMDA data is necessary to 
maintain a proper balancing of the privacy risks and benefits of 
disclosure, especially in the event the Bureau becomes aware of new 
facts and circumstances that might contribute to privacy risks. 
However, except where not practical, unnecessary, or where public 
interest requires otherwise, the Bureau intends to seek public input on 
any future revisions to modifications to the public loan-level HMDA it 
might consider.
Data To Be Disclosed in the Loan-Level HMDA Data Without Modification
    As discussed above, the 2015 HMDA Final Rule requires financial 
institutions to report information about originations and purchases of 
mortgage loans, as well as mortgage loan applications that do not 
result in originations. The Bureau proposes to disclose the following 
data fields to the public as reported, without modification:\69\
---------------------------------------------------------------------------

    \69\ As mentioned above and discussed further below, the Bureau 
proposes not to disclose free-form text fields used in certain 
instances to report the following data: The name and version of the 
credit scoring model, race, ethnicity, reasons for denial, and AUS 
name.
---------------------------------------------------------------------------

     The following information about applicants, borrowers, and 
the underwriting process: Income, sex, race, ethnicity, name and 
version of the credit scoring model, reasons for denial, and AUS name.
     The following information about the property securing the 
loan: Census tract, State, county, occupancy type, construction method, 
manufactured housing secured property type, manufactured housing land 
property interest, and total units.
     The following information about the application or loan: 
Loan term, loan type, loan purpose, application channel, whether the 
loan was initially payable to the financial institution, whether a 
preapproval was requested, action taken, type of purchaser, lien 
status, prepayment penalty term, introductory rate period, interest 
rate, rate spread, total loan costs or total points and fees, 
origination charges, total discount points, lender credits, HOEPA 
status, balloon payment, interest-only payment, negative amortization, 
other non-amortizing features, combined loan-to-value ratio, open-end 
line of credit flag, business or commercial flag, and reverse mortgage 
flag.
     The following information about the lender: Legal Entity 
Identifier (LEI), and financial institution name.\70\
---------------------------------------------------------------------------

    \70\ See 12 CFR 1003.4(a)(2)-(7), (a)(8)(i), a(9)(ii), 
(a)(10)(i), (a)(10)(iii), (a)(11)-(14), (a)(15)(i) (name of scoring 
model), (a)(16)-(22), (a)(24)-(27), (a)(29)-(33), (a)(35)(i) (name 
of system), (a)(36)-(38) (effective Jan. 1, 2018).
---------------------------------------------------------------------------

    Many of these data fields were adopted in the 2015 HMDA Final Rule, 
while several are already required to be reported under current 
Regulation C. All of the data fields required by current Regulation C 
listed above are currently disclosed as reported without modification 
in the modified loan/application register that each financial 
institution makes available to the public and in the agencies' loan-
level release.\71\ For the reasons discussed below, the Bureau proposes 
to publicly disclose the data fields listed above without modification 
in the loan-level HMDA data and requests comment on its proposal.
---------------------------------------------------------------------------

    \71\ The only data fields excluded from the public loan-level 
HMDA data under current Regulation C are the identifying number for 
the loan or loan application, the application date, and the action 
taken date.
---------------------------------------------------------------------------

    With the exception of LEI, financial institution name, census 
tract, income, action taken (where the loan is denied), and reasons for 
denial, which are discussed further below, the Bureau believes that 
disclosure of the data fields listed above would likely present low 
risk to applicant and borrower privacy. First, the Bureau believes 
that, if the HMDA data were re-identified, disclosure of most of these 
data fields would likely create minimal, if any, risk of harm or 
sensitivity to applicants or borrowers. These fields include basic 
information about the features of the loan or the property securing the 
loan--such as the application channel, loan term, and lien status--
rather than information about personal

[[Page 44598]]

characteristics or financial condition of the applicant or borrower, 
and the Bureau believes that applicants and borrowers are unlikely to 
consider the disclosure of this information to be sensitive. Further, 
the Bureau is aware of no clear advantage provided by most of these 
data fields for targeted marketing of products and services that may 
pose risks that are not apparent. The Bureau believes that certain 
fields about the loan, such as the pricing data fields, and certain 
fields about the borrower, such as ethnicity and race, may create 
relatively more risk of harm or sensitivity, but that these fields 
still present low privacy risk. Second, the Bureau believes that 
disclosure of most of these data fields would likely create minimal, if 
any, risk of substantially facilitating the re-identification of 
applicants and borrowers in the HMDA data. Most of these data fields 
are not found in publicly available sources of records that contain the 
identity of an applicant or borrower; without such an identified 
publicly available record, an adversary would experience substantial 
difficulty attempting to re-identify an applicant or borrower by 
matching a HMDA record using these data fields. Certain data fields may 
create relatively more risk of re-identification because they contain 
values that are not widely shared among applicants or borrowers, such 
as an ethnic and racial category, but the Bureau believes these fields 
still present low re-identification risk.\72\ As described above, 
public disclosure of these low-risk data fields benefits users in 
determining whether financial institutions are serving the housing 
needs of their communities; in distributing public-sector investment so 
as to attract private investment to areas where it is needed; and in 
identifying possible discriminatory lending patterns and enforcing 
antidiscrimination statutes. To the extent that disclosure of these 
fields would create risk to applicant and borrower privacy, the Bureau 
believes the risks would be justified by the benefits of disclosure.
---------------------------------------------------------------------------

    \72\ Although the Bureau believes that ethnic and racial 
categories are not found in publicly available sources of identified 
records, comparing the ethnicity and race found in the HMDA record 
to the surname found in an identified public record may help an 
adversary narrow the range of public records against which to match 
a HMDA record. Information on surnames, in other contexts, has 
proven useful to proxy for ethnicity or race. The Bureau also 
believes that ethnicity and racial category may be more likely to be 
known by adversaries with personal knowledge of the applicant or 
borrower than other fields listed above. The Bureau seeks comment in 
particular on whether this risk is heightened with respect to 
disaggregated ethnicity and race and whether these disaggregated 
fields should be treated differently than aggregated ethnicity and 
race.
---------------------------------------------------------------------------

    The Bureau believes that disclosure of the following data fields 
listed above would likely substantially facilitate the re-
identification of applicants or borrowers: LEI, financial institution 
name, and census tract. The Bureau believes that publicly available 
real estate transaction records such as mortgages and deeds of trust 
typically contain the identity of the borrower, the name of the 
financial institution, and the property address, from which an 
adversary may derive the census tract. Although the uniqueness of a 
HMDA record will vary by census tract, the Bureau believes that these 
data fields could be used by an adversary to match a HMDA record to an 
identified public record.
    The Bureau also believes that, if the HMDA data were re-identified, 
disclosure of the following data fields listed above would likely 
create a risk of harm or sensitivity: Income, action taken (where the 
loan is denied), and reasons for denial. These data fields are not 
otherwise available to the general public in an identified form without 
barriers to access or use restrictions.\73\ The Bureau believes that 
these data fields would likely be considered sensitive by many if not 
most consumers. Many consumers avoid sharing their incomes, even with 
personal acquaintances.\74\ The fact that a financial institution 
denied an application and some of the reasons for denial, such as 
employment history, credit history, debt-to-income ratio, or 
insufficient cash, could reveal negative details about a consumer's 
personal financial situation.\75\ The Bureau also believes that these 
data fields could be used for harmful purposes, such as targeted 
marketing of products and services that may pose risks that are not 
apparent.
---------------------------------------------------------------------------

    \73\ The Bureau believes that, although estimates of income may 
be available in private datasets, reliable income information 
typically is not available to the general public without barriers to 
access or use restrictions. The HMDA data will include the gross 
annual income relied on in making the credit decision, which may be 
more accurate.
    \74\ The Bureau believes that consumers may still consider 
income information to be sensitive even though it is rounded to the 
nearest thousand when reported by financial institutions.
    \75\ The Bureau notes that the fact that a loan was denied and 
the reasons for denial are reported only for applications that have 
been denied. As discussed above, the Bureau believes that the risk 
of re-identification of applicants where a loan is not originated is 
significantly lower than the risk to borrowers. Because these data 
fields are difficult to associate with an identified applicant or 
borrower, the Bureau believes that the risk of harm or sensitivity 
created by their disclosure is reduced.
---------------------------------------------------------------------------

    The Bureau nonetheless believes that these risks to applicant and 
borrower privacy are justified by the benefits of disclosure in light 
of HMDA's purposes. For years, these data fields have proven critical 
for furthering HMDA's purposes.\76\ For example, the ability to 
identify the financial institution by name is critical for users to 
evaluate the lending practices of a financial institution.\77\ The 
census tract is essential for users to determine the availability of 
credit in certain communities and to identify potentially 
discriminatory lending patterns at the community level. Information 
about income ensures that users who are evaluating potential 
disparities in underwriting or pricing are comparing applicants or 
borrowers with similar incomes, thereby controlling for a factor that 
might provide a legitimate explanation for such disparities. Income 
data can also allow users to determine the availability of credit to 
consumers and communities of various income levels. Finally, action 
taken and reasons for denial, combined with underwriting information, 
help users compare the outcomes received by applicants and borrowers to 
identify potential disparities between similarly qualified applicants. 
The reasons for denial also help users understand why a particular loan 
application was denied and identify potential barriers in access to 
credit.
---------------------------------------------------------------------------

    \76\ Several data fields adopted in the 2015 HMDA Final Rule are 
closely related to, or extensions of, data fields reported under 
current Regulation C. Specifically, the LEI will replace the current 
reporter's ID, and reasons for denial may currently be reported at 
the option of the financial institution. However, financial 
institutions supervised by the OCC and the FDIC currently are 
required by those agencies to report denial reasons. 12 CFR 
27.3(a)(1)(i), 128.6, 390.147.
    \77\ The LEI would enhance identification by allowing users to 
link the reporting financial institution to its corporate family. If 
the financial institution name is publicly disclosed, the LEI 
creates minimal, if any, additional privacy risk.
---------------------------------------------------------------------------

    The Bureau believes that, under the balancing test, the benefits of 
public disclosure of these data fields to HMDA's purposes would justify 
the risks to applicant and borrower privacy such disclosure would 
likely create. In forming its proposal to publicly disclose these data 
fields without modification, the Bureau considered modifications that 
would reduce the risks to applicant and borrower privacy while 
preserving the benefits of disclosure. However, with the exception of 
income and census tract, which have for years proven critical for 
furthering HMDA's purposes, no modifications other than exclusion from 
the public loan-level HMDA data are reasonably available for these data 
fields. Therefore, modification in these circumstances

[[Page 44599]]

would eliminate public utility of these data fields entirely. The 
Bureau seeks comment on its proposal to publicly disclose these fields 
without modification in the loan-level HMDA data.
Data To Be Excluded or Otherwise Modified in the Loan Level HMDA Data
Universal Loan Identifier
    The 2015 HMDA Final Rule requires financial institutions to report 
a universal loan identifier (ULI) for each covered loan or application 
that can be used to identify and retrieve the application file.\78\ The 
2015 HMDA Final Rule sets forth detailed requirements concerning the 
ULI to be assigned and reported.\79\ A ULI must begin with the 
financial institution's LEI, followed by up to 23 additional characters 
to identify the covered loan or application, and then end with a two-
character check digit calculated according to the methodology 
prescribed in appendix C of the 2015 HMDA Final Rule.\80\ In addition, 
a ULI must be unique within the institution and must not contain any 
information that could be used to directly identify the application or 
borrower.\81\ Institutions reporting a loan for which a ULI was 
previously assigned and reported must report the ULI that was 
previously assigned and reported for the loan. The ULI will be 
submitted as an alphanumeric field.\82\ The requirement to report a ULI 
replaces the requirement under current Regulation C that a financial 
institution report an identifying number for the loan or loan 
application.\83\ The loan or loan application number is currently 
excluded from both the modified loan/application register that each 
financial institution makes available to the public and the agencies' 
loan-level release. The Bureau added the requirement to report a ULI to 
implement the Dodd-Frank Act's amendment to HMDA providing for the 
collection and reporting of, ``as the Bureau may determine to be 
appropriate, a universal loan identifier.'' \84\
---------------------------------------------------------------------------

    \78\ 12 CFR 1003.4(a)(1)(i) (effective January 1, 2018).
    \79\ Id.
    \80\ 12 CFR 1003.4(a)(1)(i)(A) through (C).
    \81\ 12 CFR 1003.4(a)(1)(i)(B)(3).
    \82\ Bureau of Consumer Fin. Prot., ``Filing instructions guide 
for HMDA data collected in 2018--OMB Control #3170-0008,'' at 14, 48 
(Jan. 2017), available at http://www.consumerfinance.gov/data-research/hmda/static/for-filers/2018/2018-HMDA-FIG.pdf.
    \83\ See 12 CFR 1003.4(a)(1).
    \84\ 12 U.S.C. 2803(b)(6)(G).
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that, depending on 
how financial institutions will use ULIs once they are adopted for HMDA 
purposes, disclosing the ULI in the loan-level HMDA data could 
substantially facilitate the re-identification of an applicant or 
borrower and that this risk would not be justified by the benefits of 
the disclosure. Therefore, until information is available concerning 
how financial institutions use ULIs other than for HMDA purposes, the 
Bureau proposes to modify the loan-level HMDA dataset made available to 
the public by excluding the ULI.
    A ULI would allow users to track over time a loan reported in HMDA 
data by different financial institutions. Using a ULI, a user could 
identify a loan originated by a HMDA reporter that is later purchased 
by another HMDA reporter, then sold and purchased again by yet another 
HMDA reporter. Understanding a loan's history would assist in 
identifying whether financial institutions are serving the housing 
needs of their communities. Widespread adoption of ULIs to identify 
mortgage loans in other datasets also could allow users to track a loan 
from ``cradle to grave,'' i.e., to link information disclosed in the 
public HMDA data with information found in other datasets, such as 
datasets reflecting loan performance.
    The Bureau believes that, depending on how financial institutions 
use ULIs other than for HMDA purposes, public disclosure of a ULI in 
the loan-level HMDA data could create a significant risk of re-
identification. If financial institutions include ULIs on loan 
documents that are made publicly available, the Bureau believes that 
disclosure of the ULI in the public loan-level HMDA data would 
substantially facilitate the re-identification of HMDA records. As 
discussed above, many jurisdictions publicly disclose real estate 
transaction records in an identified form, such as mortgages and deeds 
of trust, and the Bureau believes that many financial institutions 
include loan numbers on these publicly-recorded documents.\85\ The 
Bureau believes that financial institutions may replace the loan 
numbers currently assigned to mortgage loans with ULIs \86\ and that, 
if they do, the ULI likely will be included on publicly-recorded loan 
documents. Especially in light of the uniqueness of a ULI, a ULI on a 
publicly-recorded loan document could be used to match a HMDA record to 
an identified public record directly and reliably.
---------------------------------------------------------------------------

    \85\ For example, in response to concerns about implications 
under the Gramm-Leach-Bliley Act (GLBA) of the ``longstanding common 
practice for a mortgage lender to place the borrower's account 
number on a mortgage loan document to enable the document to be 
tracked and place in the proper file once the document is recorded 
and returned from the recording office,'' Federal regulators issued 
guidance in 2001 opining that such practice does not violate the 
GLBA. See Letter from Fed. Reserve Board, Fed. Dep. Ins. Corp., 
Nat'l Credit Union Admin., Off. of the Comptroller of the Currency, 
Off. of Thrift Supervision, and Fed. Trade Comm'n (Sept. 4, 2001).
    \86\ In response to comments, the Bureau noted in the 
supplementary information to the 2015 HMDA Final Rule that a 
financial institution may use a ULI for both HMDA purposes and the 
loan identification number prescribed by Regulation Z Sec.  
1026.37(a)(12). 80 FR 66128, 66177 (Oct. 28, 2015).
---------------------------------------------------------------------------

    The Bureau notes that the FFIEC excluded identifying numbers for 
loans and applications from the agencies' loan-level HMDA data release 
because the data field could be used to identify an applicant or 
borrower in the data.\87\ Similarly, Congress later identified 
applicant ``identification number'' as a field that the Board should 
consider deleting from the modified loan/application register in order 
to protect the privacy of applicants and borrowers.\88\ In implementing 
this amendment to HMDA, the Board required that financial institutions 
remove ``application or loan number'' from the modified loan/
application register before making it available to the public.\89\
---------------------------------------------------------------------------

    \87\ The FFIEC noted that ``[a]n unedited form of the data would 
contain information that could be used to identify individual loan 
applicants'' and that the data would be edited prior to public 
release to remove the application identification number, the date of 
application, and the date of final action. 55 FR 27886, 27888 (July 
6, 1990).
    \88\ HMDA section 304(j), added by the Housing and Community 
Development Act, section 932(a), 106 Stat. 3672, 3889 (1992).
    \89\ 12 CFR 1003.5(c).
---------------------------------------------------------------------------

    The Bureau believes that a ULI would disclose minimal, if any, 
information about an applicant or borrower that may be harmful or 
sensitive. A ULI is associated with a particular application or loan. 
As noted above, the 2015 HMDA Final Rule prohibits a financial 
institution from including in a ULI assigned to an application or loan 
information about the applicant or borrower that could be used to 
directly identify the applicant or borrower. Commentary to this 
provision clarifies that ``information that could be used to directly 
identify the applicant or borrower includes but is not limited to the 
applicant's or borrower's name, date of birth, Social Security number, 
official government-issued driver's license or identification number, 
alien registration number, government passport number, or employer or 
taxpayer identification number.'' \90\ Although the Bureau

[[Page 44600]]

believes that financial institutions may include information within a 
ULI that is pertinent to the institution's operations, as some do now 
with respect to loan numbers, it does not believe that such information 
would be considered sensitive or could be used for harmful purposes.
---------------------------------------------------------------------------

    \90\ Comment 4(a)(1)(i)-2 (effective Jan. 1, 2018).
---------------------------------------------------------------------------

    The Bureau has considered whether a modification to the public 
loan-level HMDA dataset other than exclusion of the ULI would 
appropriately reduce the privacy risks created by the disclosure of the 
ULI in the loan-level data while maintaining some utility for HMDA's 
purposes. For example, the Bureau has considered whether it could, in 
the loan-level HMDA data disclosed to the public, replace the reported 
ULI with a different unique number, such as a hashed value.\91\ The 
Bureau also has considered whether it might use some other means to 
link HMDA records sharing the same ULI without revealing the ULI 
itself. The Bureau is unable to identify a feasible modification at 
this time, however. The Bureau believes at this time that, under the 
balancing test, excluding the ULI is a modification to the public loan-
level HMDA data that appropriately balances the risks to applicant and 
borrower privacy and the benefits of disclosure. The Bureau seeks 
comment on this proposal.
---------------------------------------------------------------------------

    \91\ A hashed value would be based on the ULI and created by a 
secure hash algorithm. A hash algorithm is designed to be non-
invertible, meaning that the original value, in this case the actual 
ULI, could not be derived from the hashed value. The hashed value 
would only appear in the HMDA data; as it would not appear in public 
records, it could not be used to re-identify the HMDA record.
---------------------------------------------------------------------------

Application Date
    The 2015 HMDA Final Rule requires financial institutions to report, 
except for purchased covered loans, the date the application was 
received or the date shown on the application form.\92\ This date will 
be submitted by financial institutions as the exact year, month, and 
day, in the format of YYYYMMDD.\93\ Financial institutions are required 
to report this data field under current Regulation C. The Board amended 
Regulation C in 1989 to require reporting of the date the application 
was received as part of its implementation of the Financial 
Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA), 
which expanded HMDA to include data on applications, as well as data on 
the race, gender, and income of individual applicants and 
borrowers.\94\ The application date is currently excluded from both the 
modified loan/application register that each financial institution 
makes available to the public and the agencies' loan-level release.\95\
---------------------------------------------------------------------------

    \92\ 12 CFR 1003.4(a)(1)(ii) (effective Jan. 1, 2018).
    \93\ Supra note 83 at 49.
    \94\ Financial Institutions Reform, Recovery, and Enforcement 
Act, Public Law 101-73, section 1211, 103 Stat. 183, 524-26 (1989); 
54 FR 51356 (Dec. 15, 1989).
    \95\ See 12 U.S.C. 2803(j)(2)(B)(i); 12 CFR 1003.5(c).
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that disclosing 
the application date in the loan-level HMDA data released to the public 
would likely substantially facilitate the re-identification of an 
applicant or borrower and that this risk would not be justified by the 
benefits of the disclosure. Therefore, the Bureau proposes to modify 
the loan-level HMDA data made available to the public by excluding the 
date the application was received.
    The application date may be useful for identifying possible 
discriminatory lending patterns and enforcing antidiscrimination 
statutes. In enacting the FIRREA amendments to HMDA, Congress sought to 
improve the ability of HMDA users to identify possible discriminatory 
lending patterns by expanding HMDA to allow for comparison of accepted 
and rejected applications.\96\ The date of application furthered the 
purposes underlying this expansion. The application date helps ensure 
that users are comparing applicants or borrowers who applied for loans 
during similar dates, thereby controlling for factors that might 
provide a legitimate explanation for disparities, such as different 
market interest rates over different time periods. Users of HMDA data 
may also use the application date, in combination with the action taken 
date, to screen for delays between application and action dates that 
appear to exist on prohibited bases.
---------------------------------------------------------------------------

    \96\ H. Rept. 101-209, at 463-65 (1989).
---------------------------------------------------------------------------

    The Bureau believes that public disclosure of application date 
would likely substantially facilitate the re-identification of an 
applicant or borrower in the HMDA data. Disclosing the date of 
application would increase the ability of an adversary to associate a 
HMDA record with an applicant or borrower by matching it to an 
identified publicly available record. As discussed above, many 
jurisdictions publicly disclose real estate transaction records in an 
identified form, such as mortgages or deeds of trust. These records 
contain the date that the lender and borrower entered into or executed 
the agreement. This date is correlated with the application date data 
field, which reflects either the date the application was received or 
the date shown on the application form. Therefore, an adversary could 
use the date of application, combined with other data fields, to narrow 
the range of identified public records against which to compare the 
HMDA data, increasing the likelihood of matching records.
    The Bureau notes that the FFIEC excluded the application date from 
the agencies' loan-level HMDA data release because the data field could 
be used to re-identify a particular applicant or borrower in the 
data.\97\ Similarly, when Congress directed that the Board require 
deletions from the loan-level HMDA data financial institutions must 
make available to the public to protect the privacy of applicants and 
borrowers, it identified the application date in particular as one 
field to be considered for deletion.\98\
---------------------------------------------------------------------------

    \97\ The FFIEC noted that ``[a]n unedited form of the data would 
contain information that could be used to identify individual loan 
applicants'' and that the data would be edited prior to public 
release to remove the application identification number, the date of 
application, and the date of final action. 55 FR 27886, 27888 (July 
6, 1990).
    \98\ Housing and Community Development Act, Public Law 102-550, 
section 932(a), 106 Stat. 3672, 3889 (1992).
---------------------------------------------------------------------------

    If the HMDA data were re-identified, the Bureau believes that 
application date would likely disclose minimal, if any, information 
about an applicant or borrower that may be harmful or sensitive. 
Application date is not an inherently sensitive data field. Unlike 
other dates, such as date of birth, the date of application contains no 
intrinsic connection to an individual. Instead, the information is 
associated with an applicant or borrower for only a single transaction 
in the context of mortgage lending. Further, the Bureau believes that 
the date of application would be unlikely to be used for targeted 
marketing of products and services that may pose risks that are not 
apparent.
    HMDA data is disclosed annually based on the calendar year in which 
action is taken on an application. Although the Bureau proposes not to 
disclose the application date, the year of the loan-level HMDA data 
will often correspond to the year in which the application was 
received. The Bureau considered binning the values reported for the 
application date into quarterly or semi-annual intervals. However, the 
Bureau believes that quarterly intervals would fail to reduce re-
identification risk adequately and that, compared to not disclosing 
application date, the gains in data utility that semi-annual intervals 
might allow do not justify the increase in privacy risk. Disclosing the 
date of application in quarterly intervals would provide an individual 
with a

[[Page 44601]]

narrower range of identified public records against which to compare 
the HMDA data.\99\ And although disclosing application dates in semi-
annual intervals would reduce re-identification risk as compared to 
quarterly intervals, the Bureau believes it would only marginally 
increase the utility over the current, annual intervals while still 
increasing privacy risk. Users would need a narrower range to help 
ensure that they were comparing applicants who applied under similar 
market conditions. The Bureau believes at this time that, under the 
balancing test, excluding the application date is a modification to the 
public loan-level HMDA data that appropriately balances the risks to 
applicant and borrower privacy and the benefits of disclosure. The 
Bureau seeks comment on this proposal.
---------------------------------------------------------------------------

    \99\ The Bureau previously identified quarterly release of the 
loan-level HMDA data as a potential privacy concern. 80 FR 66128, 
66243 (Oct. 28, 2015).
---------------------------------------------------------------------------

Loan Amount
    The 2015 HMDA Final Rule requires financial institutions to report 
the amount of the covered loan or the amount applied for.\100\ For 
closed-end mortgage loans, open-end lines of credit, and reverse 
mortgages, this amount is the amount to be repaid as disclosed on the 
legal obligation, the amount of credit available to the borrower, and 
the initial principal limit, respectively. The loan amount will be 
submitted by financial institutions in numeric form reflecting the 
exact dollar amount of the loan.\101\ Financial institutions are 
required to report this data field under current Regulation C rounded 
to the nearest thousand.\102\ Although HMDA has always required 
financial institutions to report information about the dollar amount of 
a financial institution's mortgage lending activity,\103\ the Board 
amended Regulation C in 1989 to require reporting of the loan amount on 
a loan-level basis as part of its implementation of FIRREA.\104\
---------------------------------------------------------------------------

    \100\ 12 CFR 1003.4(a)(7) (effective Jan. 1, 2018).
    \101\ Supra note 83, at 51.
    \102\ 12 CFR 1003, Appendix A, I.A.20.
    \103\ 12 U.S.C. 2803
    \104\ 12 U.S.C. 2803
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that disclosing 
the loan amount in the loan-level HMDA data released to the public 
would likely substantially facilitate the re-identification of an 
applicant or borrower and that this risk would not be justified by the 
benefits of the disclosure. Therefore, the Bureau proposes to modify 
the loan-level HMDA dataset disclosed to the public by disclosing the 
midpoint for the $10,000 interval into which the reported loan amount 
falls and by indicating whether the loan amount exceeds the applicable 
dollar amount limitation on the original principal obligation in effect 
at the time of application or origination as provided under 12 U.S.C. 
1717(b)(2) and 12 U.S.C. 1454(a)(2) (``GSE conforming loan 
limit'').\105\ For example, for a reported loan amount of $117,834, the 
Bureau would disclose $115,000 as the midpoint between values equal to 
$110,000 and less than $120,000.
---------------------------------------------------------------------------

    \105\ The dollar amount limitation on the original principal 
obligation as provided under 12 U.S.C. 1717(b)(2) and 12 U.S.C. 
1454(a)(2) refers to the annual maximum principal loan balance for a 
mortgage acquired by Fannie Mae and Freddie Mac (the ``GSEs''). The 
Federal Housing Finance Agency is responsible for determining the 
maximum conforming loan limits for mortgages acquired by the GSEs. 
See Press Release, Fed. Hous. Fin. Agency, ``FHFA Announces Increase 
in Maximum Conforming Loan Limits for Fannie Mae and Freddie Mac in 
2017'' (Nov. 23, 2016) https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Announces-Increase-in-Maximum-Conforming-Loan-Limits-for-Fannie-Mae-and-Freddie-Mac-in-2017.aspx.
---------------------------------------------------------------------------

    The loan amount is useful for determining whether financial 
institutions are serving the housing needs of their communities. By 
examining loan amount, users can better understand the amount of credit 
that financial institutions have made available to consumers in certain 
communities and the extent to which such institutions are providing 
credit in varying amounts. Loan amount is also beneficial for 
identifying possible discriminatory lending patterns and enforcing 
antidiscrimination statutes. For example, the loan amount allows users 
to divide the population of applicants or borrowers into segments that 
may be subject to different underwriting or pricing policies, such as 
those applying for non-conforming mortgage loans. Combined with the 
property value, the loan amount would also allow users to calculate a 
loan-to-value ratio, an important variable in underwriting. The loan 
amount and loan-to-value ratio would help ensure that users who are 
evaluating potential disparities in underwriting outcomes, pricing, or 
other terms and conditions are comparing applicants or borrowers who 
applied for or obtained loans with similar loan amount and loan-to-
value ratios, thereby controlling for factors that might provide a 
legitimate explanation for disparities.
    The Bureau believes that disclosing the exact loan amount would 
likely substantially facilitate the re-identification of an applicant 
or borrower. The loan amount is a numeric data field that will often 
consist of at least six digits, which increases its contribution to the 
uniqueness of a particular HMDA record. As discussed above, this 
information is also found in identified real estate transaction records 
such as mortgages and deeds of trust that are publicly disclosed by 
many jurisdictions. Therefore, in many cases, an adversary could use 
the exact loan amount, combined with other fields, to match a HMDA 
record to an identified publicly available record.
    If the HMDA data were re-identified, the Bureau believes that loan 
amount would likely disclose minimal, if any, information about an 
applicant or borrower that may be harmful or sensitive. In some cases, 
high loan amounts, combined with other information, may be considered 
sensitive or may indicate financial vulnerability that could form the 
basis for targeted marketing of products and services that may pose 
risks that are not apparent. The loan amount may also at least 
theoretically be used for phishing attacks. However, the Bureau 
believes that loan amount is often already included in identified 
publicly available documents, such as the mortgage or deed of trust. 
The Bureau believes that this existing public availability decreases 
any potential sensitivity and harmfulness of disclosing loan amount in 
the HMDA data.
    The Bureau believes that the loan-level HMDA data may be modified 
to appropriately reduce the privacy risks created by the public 
disclosure of the loan amount while preserving much of the benefits of 
the data field. The Bureau believes that disclosing the midpoint for 
the $10,000 interval into which the reported loan amount falls, and 
indicating whether the loan amount exceeds the applicable GSE 
conforming loan limit, provides enough precision to allow users to rely 
on loan amount to achieve HMDA's purposes. For example, $10,000 
intervals will allow users to segment applicants and borrowers that may 
be subject to different underwriting or pricing policies. In fact, for 
intervals that include the applicable GSE conforming loan limit, an 
indication of whether the loan amount is above the applicable limit may 
provide greater precision than is provided by the loan-level HMDA data 
currently disclosed to the public, in which certain loan amounts above 
and below the applicable limit will round to the same thousand. $10,000 
intervals will not allow users to calculate an exact loan-to-value 
ratio, although users may still derive an estimated loan-to-value 
ratio. However, the Bureau believes that releasing the combined

[[Page 44602]]

loan-to-value ratio, as it proposes to do, will be more beneficial for 
fair lending purposes than the loan-to-value ratio that users would 
have calculated from the exact loan amount and property value. 
Disclosing loan amount in $10,000 intervals also decreases the ability 
of adversaries to match HMDA data to identified public records by 
reducing the uniqueness of a data field common to both datasets. 
Because the Bureau is also proposing to modify reported property value 
similarly, adversaries will be unable to use the combined loan-to-value 
ratio to reduce the effectiveness of the proposed modification by 
deriving the reported loan amount. Although the proposed modifications 
do not entirely eliminate the risk of re-identification that the Bureau 
believes would likely be created by the disclosure of loan amount 
information, the Bureau believes that the remaining risk would be 
justified by the benefits of disclosing loan amount with the proposed 
modifications.
    Therefore, the Bureau believes at this time that, under the 
balancing test, modifying loan amount as described above appropriately 
balances the privacy risks and disclosure benefits. The Bureau seeks 
comment on this proposal, including the proposed $10,000 intervals to 
be used for binning, the proposal to disclose the midpoint for each 
interval, and the proposal to indicate whether the reported loan amount 
exceeds the applicable GSE conforming loan limit. Additionally, the 
Bureau seeks comment on whether to indicate that a reported loan amount 
exceeds the applicable limit for loans eligible for insurance by the 
Federal Housing Administration (FHA conforming loan limit).\106\ 
Factors not reflected in the HMDA data may affect the accuracy of any 
such indicator, such as whether the loan amount has been increased by 
the amount of any one-time or up-front mortgage insurance premium that 
will be financed as part of the loan, in which case the loan may be 
eligible for insurance despite appearing in the HMDA data to exceed the 
applicable FHA conforming loan limit.\107\ The Bureau seeks comment on 
the value of indicating whether the reported loan amount exceeds the 
FHA conforming loan limit in light of these limitations.
---------------------------------------------------------------------------

    \106\ See 24 CFR 203.18.
    \107\ 24 CFR 203.18c.
---------------------------------------------------------------------------

Action Taken Date
    The 2015 HMDA Final Rule requires financial institutions to report 
the date of action taken by the financial institution on a covered loan 
or application.\108\ For originated loans, this date is generally the 
date of closing or account opening.\109\ Regulation C provides some 
flexibility in reporting the date for other types of actions taken, 
such as applications denied, withdrawn, or approved by the institution 
but not accepted by the applicant. For example, for applications 
approved but not accepted, a financial institution may report ``any 
reasonable date, such as the approval date, the deadline for accepting 
the offer, or the date the file was closed,'' provided it adopts a 
generally consistent approach.\110\ This date is submitted by financial 
institutions as the exact year, month, and day, in the format of 
YYYYMMDD.\111\ Financial institutions are required to report this data 
field under current Regulation C. As with the application date, the 
Board added the requirement to report the action taken date as part of 
the amendments to Regulation C that implemented FIRREA.\112\ The action 
taken date is also currently excluded from both the modified loan/
application register that each financial institution makes available to 
the public and the agencies' loan-level release.\113\
---------------------------------------------------------------------------

    \108\ 12 CFR 1003.4(a)(8)(ii) (effective Jan. 1, 2018).
    \109\ Comment 4(a)(8)(ii)-5 (effective Jan. 1, 2018).
    \110\ Comment 4(a)(8)(ii)-4 (effective Jan. 1, 2018).
    \111\ Supra note 83, at 52.
    \112\ 54 FR 51356 (Dec. 15, 1989).
    \113\ See 12 U.S.C. 2803(j)(2)(B)(i); 12 CFR 1003.5(c).
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that disclosing 
the action taken date in the loan-level HMDA data released to the 
public would likely substantially facilitate the identification of an 
applicant or borrower and that this risk would not be justified by the 
benefits of the disclosure. Therefore, the Bureau proposes to modify 
the loan-level HMDA dataset made available to the public by excluding 
the date of action taken by the financial institution.
    The action taken date may be useful for identifying possible 
discriminatory lending patterns and enforcing antidiscrimination 
statutes. The fair lending benefits provided by the date of action 
taken are similar to those provided by the date of application, 
described above. The action taken date helps ensure that users who are 
evaluating potential disparities in pricing or other terms and 
conditions are comparing applicants or borrowers who obtained loans on 
similar dates, thereby controlling for factors that might provide a 
legitimate explanation for such disparities, such as different market 
interest rates or different institutional practices over different time 
periods. Users of HMDA data may also use the date of action taken, in 
combination with application date, to screen for delays between 
application and action dates that appear to exist on prohibited bases.
    The Bureau believes that disclosing the action taken date would 
likely substantially facilitate the re-identification of an applicant 
or borrower in the HMDA data. Disclosing the action taken date would 
increase the ability of an adversary to associate a HMDA record with an 
individual by matching it to an identified publicly available record. 
As explained above, many jurisdictions publicly disclose real estate 
transaction records in an identified form, such as mortgages or deeds 
of trust. These records contain the date that the lender and borrower 
entered into or executed the agreement, which, like the application 
date, is closely correlated with the action taken date. Indeed, because 
the action taken date for originated loans is generally the date of 
closing or account opening, in most cases these dates will be 
identical. Therefore, in many cases, an adversary could use the action 
taken date, combined with other data fields, to match a HMDA record to 
an identified public record.
    The Bureau notes that, as with the application date, the FFIEC 
excluded the action taken date from the agencies' loan-level HMDA data 
release because the data field could be used to re-identify a 
particular applicant or borrower in the data.\114\ Similarly, Congress 
later identified the action taken date as one field that the Board 
should consider deleting from the modified loan/application register to 
protect the privacy of applicants and borrowers.\115\
---------------------------------------------------------------------------

    \114\ The FFIEC noted that ``[a]n unedited form of the data 
would contain information that could be used to identify individual 
loan applicants'' and that the data would be edited prior to public 
release to remove the application identification number, the date of 
application, and the date of final action. 55 FR 27886, 27888 (July 
6, 1990).
    \115\ Housing and Community Development Act, Public Law 102-550, 
section 932(a), 106 Stat. 3672, 3889 (1992).
---------------------------------------------------------------------------

    If the HMDA data were re-identified, the Bureau believes that, 
similar to the application date, the action taken date would likely 
disclose minimal, if any, information about an applicant or borrower 
that may be harmful or sensitive. As with the application date, the 
action taken date is not an inherently sensitive data field; it is 
associated with an applicant or borrower for only a single transaction 
in the context of mortgage lending and

[[Page 44603]]

does not reflect an intrinsic connection to an individual. Further, the 
Bureau believes that the action taken date would be unlikely to be used 
for targeted marketing of products and services that pose risks that 
may not be apparent.
    Although the Bureau proposes not to disclose the action taken date, 
the loan-level data will disclose the year in which final action was 
taken. As with application date, the Bureau considered binning the 
values reported for action taken date into quarterly or semi-annual 
intervals. However, the Bureau believes that quarterly intervals would 
fail to reduce re-identification risk adequately and that, compared to 
not disclosing action taken date, the gains in data utility that semi-
annual intervals might allow do not justify the increase in privacy 
risk. Disclosing the action taken date in quarterly intervals would 
still provide an individual with a narrow range of identified public 
records against which to compare the HMDA data. And although disclosing 
action taken dates in semi-annual intervals would reduce re-
identification risk as compared to quarterly intervals, it would only 
marginally increase the utility over the current, annual intervals, 
while still increasing privacy risk. Users would need a narrower range 
to help ensure that they were comparing borrowers who obtained loans 
under similar market conditions. The Bureau believes at this time that, 
under the balancing test, excluding action taken date is a modification 
to the public loan-level HMDA data that appropriately balances the 
risks to applicant and borrower privacy and the benefits of 
disclosure.\116\ The Bureau seeks comment on this proposal.
---------------------------------------------------------------------------

    \116\ However, as described above, the year of the loan-level 
HMDA data will disclose the year in which the action was taken. With 
respect to quarterly release of the HMDA data, the Bureau stated in 
the 2015 HMDA Final Rule that, based on its analysis to date, 
``disclosure of loan-level data with more granular date information 
than year of final action would create risks to applicant and 
borrower privacy that are not outweighed by the benefits of such 
disclosure.'' 80 FR 66128, 66243 n.389 (Oct. 28, 2015).
---------------------------------------------------------------------------

Property Address
    The 2015 HMDA Final Rule requires financial institutions to report 
the address of the property securing the loan or, in the case of an 
application, proposed to secure the loan.\117\ This address corresponds 
to the property identified on the legal obligation related to the 
covered loan.\118\ The format of the property address submitted by 
financial institutions will include, as applicable, the street address, 
city name, State name, and zip code.\119\ Financial institutions are 
not required to report this data field under current Regulation C. The 
Bureau added the requirement to report property address in the 2015 
HMDA Final Rule to implement the Dodd-Frank Act's amendment to HMDA 
providing for the collection and reporting of, ``as the Bureau may 
determine to be appropriate, the parcel number that corresponds to the 
real property pledged or proposed to be pledged as collateral.'' \120\
---------------------------------------------------------------------------

    \117\ 12 CFR 1003.4(a)(9)(i) (effective Jan. 1, 2018).
    \118\ Comment 4(a)(9)(i)-1 (effective Jan. 1, 2018). For 
applications ``the address should correspond to the location of the 
property proposed to secure the loan as identified by the 
applicant.''
    \119\ Comment 4(a)(9)(i)-2 (effective Jan. 1, 2018).
    \120\ 12 U.S.C. 2803(b)(6)(H).
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that disclosing 
the property address in the loan-level HMDA data released to the public 
would substantially facilitate the re-identification of an applicant or 
borrower and that this risk would not be justified by the benefits of 
the disclosure. Therefore, the Bureau proposes to modify the loan-level 
HMDA dataset made available to the public by excluding the property 
address.
    The address of the property securing the loan would be useful for 
identifying possible discriminatory lending patterns. With the exact 
property address, users could examine these patterns at a finer level 
of detail than that permitted by the census tract or other geographic 
boundaries. More precise geographic identification would also better 
allow public officials to target geographic areas that might benefit 
from public or private sector investment. Users could also better 
determine whether financial institutions are serving the housing needs 
of their communities with information that would enable identification 
of specific neighborhoods and communities smaller than census tracts. 
Finally, the property address would allow users to understand better 
the amount of equity retained in that property over time by tracking 
multiple liens associated with the same dwelling. This information 
would help identify communities with overleveraged properties.
    The Bureau believes that disclosure of the property address itself 
would likely present minimal, if any, risk of harm or sensitivity. 
Property owners' addresses are generally widely publicly 
available.\121\ As explained above, the Bureau considers this public 
availability to reduce the risk of harm and sensitivity from the 
release of this data field. However, the Bureau believes that the 
widespread availability of property addresses creates a significant 
risk of re-identification. The Bureau believes that adversaries could 
easily match the property address contained in the HMDA data to 
identified publicly available property address information. Property 
addresses are publicly available through a number of sources, including 
real estate transaction records, property tax records, reverse phone 
directories, online real estate databases, and online ``people search'' 
Web sites. Because the address disclosed under Regulation C typically 
would be identical to the address contained in these publicly available 
records, an adversary would know that any match was likely to be 
accurate. Therefore, disclosing the property address in the loan-level 
HMDA data would substantially facilitate the re-identification of an 
applicant or borrower. Further, even if disclosing the property address 
would not permit matching, the Bureau believes that the disclosure of 
the property address alone could be used in harmful ways. For example, 
disclosure of property address would allow an applicant or borrower to 
be targeted with marketing for products and services that may pose 
risks that are not apparent.
---------------------------------------------------------------------------

    \121\ The Bureau understands that some jurisdictions may allow 
borrowers to prevent their identities from being disclosed in public 
records, and some applicants or borrowers, such as victims of 
domestic violence, may hide their addresses to prevent certain 
individuals from locating them in person or to prevent other 
unwanted intrusions upon the sanctuary or seclusion of their homes.
---------------------------------------------------------------------------

    As an alternative to excluding the property address data field from 
the loan-level HMDA data released to the public, the Bureau considered 
releasing property address in a less granular form. For example, the 
Bureau could release geographic information that identifies the 
property securing the loan with less specificity. However, for most 
reportable transactions, Regulation C already requires reporting of 
three additional, less-precise geographic identifiers: (1) State; (2) 
county; and (3) census tract. As discussed above, the Bureau proposes 
to release these data fields without modification. Further, as 
discussed below in part IV.A, the Bureau proposes to identify in the 
public loan-level HMDA data the MSA or MD for each reported record. 
Other geographic identifiers exist with a level of precision between 
census tract and property address to which property addresses could be 
mapped, such as census block and census block group. However, the 
Bureau believes that these identifiers present similar re-
identification risk to property address because they are sufficiently 
precise to

[[Page 44604]]

enable an adversary to match them to publicly available property 
address information. The Bureau believes at this time that, under the 
balancing test, excluding property address is a modification to the 
public loan-level HMDA data that appropriately balances the risks to 
applicant and borrower privacy and the benefits of disclosure. The 
Bureau seeks comment on this proposal.
Age
    The 2015 HMDA Final Rule requires financial institutions to report 
the age of an applicant or borrower.\122\ A financial institution 
complies with this requirement by reporting age, as of the application 
date reported, as the number of whole years derived from the date of 
birth as shown on the application form.\123\ The Bureau added the 
requirement in the 2015 HMDA Final Rule to report age to implement the 
Dodd-Frank Act's amendment to HMDA providing for the collection and 
reporting of age.\124\
---------------------------------------------------------------------------

    \122\ 12 CFR 1003.4(a)(10)(ii) (effective Jan. 1, 2018).
    \123\ Comment 4(a)(1)(ii)-1 (effective Jan. 1, 2018).
    \124\ 12 U.S.C. 2803(b)(4).
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that disclosing 
the applicant or borrower age in the loan-level HMDA data released to 
the public would likely disclose information about the applicant or 
borrower that is not otherwise public and may be harmful or sensitive 
and that this risk would not be justified by the benefits of the 
disclosure. Therefore, the Bureau proposes to modify the loan-level 
HMDA dataset disclosed to the public by binning and top- and bottom-
coding age and by indicating whether the reported value is 62 or 
higher.
    Applicant or borrower age would assist users in identifying 
possible discriminatory lending patterns and enforcing 
antidiscrimination statutes. Age would be useful to evaluate potential 
age discrimination in lending.\125\ Disclosure of applicant or borrower 
age also would assist in identifying whether financial institutions are 
serving the housing needs of their communities, including the needs of 
various age cohorts.
---------------------------------------------------------------------------

    \125\ For example, ECOA and Regulation B generally prohibit 
creditors from discriminating against applicants in credit 
transactions on the basis of age. 12 U.S.C. 1691(b)(1); 12 CFR 
1002.4(a).
---------------------------------------------------------------------------

    The Bureau believes that, if the HMDA data were re-identified, 
disclosure of applicant or borrower age would likely reveal information 
about the applicant or borrower that is not otherwise public and may be 
harmful or sensitive. The Bureau believes that, although information 
about an individual's age may be available for purchase under some 
circumstances, birth and similarly reliable records reflecting age 
typically are not available to the general public without barriers to 
access or use restrictions. The Bureau believes that age likely would 
be considered sensitive by many if not most consumers and that 
disclosure of an identified applicant's or borrower's age could lead to 
dignity harm or embarrassment. The Bureau believes that many consumers 
would consider the disclosure of identified age to the general public 
to be outside of societal and cultural expectations. The Bureau also 
believes that identified age could be used to target marketing to 
applicants and borrowers, including marketing for products and services 
that may pose risks that are not apparent, and that the inclusion of 
this data field in the public loan-level HMDA data would increase the 
risk of such uses compared to today. The Bureau notes that in section 
304(h)(3)(A), added by the Dodd-Frank Act, Congress specifically 
identified age as a data field to which a modification under section 
304(h)(1)(E) should apply if the Bureau determines it to be necessary 
to protect the privacy interests of applicants or borrowers.\126\
---------------------------------------------------------------------------

    \126\ 12 U.S.C. 2803(h)(3)(A)(ii).
---------------------------------------------------------------------------

    The Bureau believes that public disclosure in the loan-level HMDA 
dataset of unmodified applicant or borrower age may create some risk of 
facilitating the re-identification of applicants and borrowers in the 
HMDA data, but that this field likely would not substantially 
facilitate re-identification. For example, though information about an 
individual's age may be available for purchase under some 
circumstances, the Bureau believes that an adversary typically would 
face difficulty attempting to re-identify an applicant or borrower in 
the HMDA data by using age to match HMDA records to other identified 
records. An applicant's or borrower's age may be more likely to be 
known than other HMDA data by a person with pre-existing knowledge of a 
specific applicant or borrower, however, and may help such an adversary 
to re-identify a particular applicant or borrower.
    The Bureau believes that the loan-level HMDA data may be modified 
to appropriately reduce the privacy risks created by the public 
disclosure of age while preserving much of the benefits of the data 
field. The Bureau proposes to disclose age binned into the following 
ranges, as applicable: 25 to 34; 35 to 44; 45 to 54; 55 to 64; and 65 
to 74. For example, a reported age of 52 would be shown in the public 
loan-level HMDA data as between 45 and 54. The Bureau also proposes to 
bottom-code age under 25 and to top-code age over 74. For example, a 
reported age of 22 would be shown in the public loan-level HMDA data as 
24 or under. The Bureau proposes the particular intervals described 
above to allow HMDA data users to analyze HMDA data in combination with 
data found in other public data sources, such as U.S. Census Bureau 
data.\127\ Finally, the Bureau proposes to indicate whether a reported 
age is 62 or higher to enhance the utility of the data for identifying 
the particular fair lending risks that may be posed with regard to 
elderly populations. The Bureau recognizes that an effect of this 
indicator would be to divide the 55 to 64 bin into two bins, 55 to 61 
and 62 to 64. The Bureau seeks comment on whether privacy risks created 
by such increased precision are justified by the benefits of disclosure 
in the proposed ranges. Specifically, the Bureau seeks comment on 
whether, instead of binning as proposed and indicating whether a 
reported age is 62 or higher, the Bureau should structure the bins to 
disclose reported ages of 55 to 74 in ranges of 55 to 61 and 62 to 74. 
The Bureau believes at this time that, under the balancing test, the 
proposed modifications to the public loan-level HMDA dataset would 
appropriately balance the risks to applicant and borrower privacy and 
the benefits of disclosure. The Bureau seeks comment on this proposal, 
including the proposal to bin age and the proposed intervals to be used 
for binning.
---------------------------------------------------------------------------

    \127\ See, e.g., U.S. Census Bureau, ``Age and Sex Composition: 
2010,'' at tbl. 2, available at https://www.census.gov/prod/cen2010/briefs/c2010br-03.pdf (disclosing age in five-year intervals, i.e., 
25 to 29, 30 to 34, 35 to 40, etc.).
---------------------------------------------------------------------------

Credit Score
    The 2015 HMDA Final Rule requires financial institutions to report, 
except for purchased covered loans, the credit score or scores relied 
on in making the credit decision and the name and version of the 
scoring model used to generate each credit score.\128\ It also provides 
that, for purposes of this requirement, ``credit score'' has the 
meaning set forth in section 609(f)(2)(A) of the Fair Credit Reporting 
Act (FCRA).\129\ The credit score or scores relied on in making the 
credit decision will be submitted as a numeric field, e.g., 650.\130\ A 
financial institution will submit a code from a specified list to 
indicate the name and version of the

[[Page 44605]]

scoring model used to generate each credit score reported.\131\ The 
Bureau added the requirement in the 2015 HMDA Final Rule to report 
information about the credit score or scores relied on to implement the 
Dodd-Frank Act's amendment to HMDA providing for the collection and 
reporting of ``the credit score of mortgage applicants and mortgagors, 
in such form as the Bureau may prescribe.'' \132\
---------------------------------------------------------------------------

    \128\ 12 CFR 1003.4(a)(15)(i) (effective Jan. 1, 2018).
    \129\ 15 U.S.C. 1681g(f)(2)(A).
    \130\ Supra note 83, at 62-63.
    \131\ Supra note 83, at 63-64.
    \132\ 12 U.S.C. 2803(b)(6)(I).
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that disclosing 
the credit score or scores relied on in making the credit decision in 
the loan-level HMDA data released to the public would likely disclose 
information about the applicant or borrower that is not otherwise 
public and may be harmful or sensitive and that this risk would not be 
justified by the benefits of the disclosure. Therefore, the Bureau 
proposes to modify the public loan-level HMDA dataset by excluding the 
credit score or scores relied on in making the credit decision.\133\
---------------------------------------------------------------------------

    \133\ As noted above, the Bureau proposes to disclose without 
modification the reported name and version of the credit score model 
used.
---------------------------------------------------------------------------

    The credit score or scores relied on in making the credit decision 
would assist users in identifying possible discriminatory lending 
patterns and enforcing antidiscrimination statutes. Applicants' credit 
scores generally are considered to be important indicators of 
creditworthiness and are used in mortgage underwriting and pricing 
decisions. Disclosure of the credit score in the public loan-level HMDA 
data would help ensure that users are comparing applicants and 
borrowers with similar credit profiles, thereby controlling for factors 
that might provide a legitimate explanation for disparities in credit 
and pricing decisions. Credit scores would also assist in identifying 
whether financial institutions are serving the housing needs of their 
communities. For example, in order to serve the housing needs of 
particular communities, a financial institution may offer different 
types of loan products in communities with high numbers of borrowers 
with high credit scores than in communities with high numbers of 
borrowers with low credit scores.
    The Bureau believes that, if the HMDA data were re-identified, 
disclosure of the credit score relied on in making the credit decision 
would likely disclose information about the applicant or borrower that 
is not otherwise public and may be harmful or sensitive. A credit score 
is a numerical summary of a consumer's apparent creditworthiness, based 
on the consumer's credit report, and reflects the likelihood relative 
to other consumers that the consumer will default on a credit 
obligation. Identified consumer credit scores and the consumer reports 
upon which they are based are not available to the general public. To 
the extent credit scores based on consumer reports are available for 
commercial purposes, they may be obtained under limited circumstances 
and are subject to restrictions on their use.\134\ The Bureau believes 
that most consumers consider their credit score to be very sensitive 
information. The Bureau believes that public disclosure of an 
applicant's or borrower's identified credit score could lead to dignity 
or reputational harm or embarrassment, and that many consumers would 
consider the disclosure of identified credit scores to the general 
public to be outside of societal and cultural expectations. The Bureau 
also believes that an identified credit score could be used to target 
marketing to applicants and borrowers, including marketing for products 
and services that may pose risks that are not apparent, and that the 
inclusion of this data field in the public loan-level HMDA data would 
increase the risk of such uses compared to today.\135\ The Bureau notes 
that in section 304(h)(3)(A), added by the Dodd-Frank Act, Congress 
specifically identified credit score as a data field to which a 
modification under section 304(h)(1)(E) should apply if the Bureau 
determines it to be necessary to protect the privacy interests of 
applicants or borrowers.\136\
---------------------------------------------------------------------------

    \134\ Credit scores based on consumer credit reports are 
consumer reports for purposes of the Fair Credit Reporting Act 
(FCRA). Accordingly, for example, they may be obtained from a 
consumer reporting agency only for a permissible purpose under the 
statute, such as in connection with an application for credit. See 
12 U.S.C. 1681b(a).
    \135\ For example, a marketer currently may obtain from a 
consumer reporting agency a ``prescreened'' list of consumers 
meeting certain criteria, such as a minimum credit score, only for 
the purpose of making a ``firm offer of credit or insurance.'' 15 
U.S.C. 1681b(c), 1681a(l).
    \136\ 12 U.S.C. 2803(h)(3)(A)(i).
---------------------------------------------------------------------------

    The Bureau has considered the extent to which the age of the loan-
level HMDA data at the time it is disclosed may reduce the risk of harm 
or sensitivity created by the public disclosure of credit score were 
the HMDA data to be re-identified. For example, as noted above, timely 
data are essential for most marketing or advertising efforts, and the 
delay between the date a reported credit score is obtained by the 
financial institutions and public disclosure of the loan-level HMDA 
data on the modified loan/application register ranges from to 3 to 15 
months. An applicant's or borrower's credit score may change enough 
over these time periods to reduce the usefulness of a score disclosed 
in the public HMDA data for marketing purposes. However, the Bureau 
does not believe that the passage of these time periods would reduce 
the risk of sensitivity created by the disclosure of credit score. For 
example, the Bureau does not believe that a borrower would consider the 
disclosure of her identified six-month-old credit score to be much less 
sensitive than disclosure of her current credit score; the potential 
for dignity or reputational harm or embarrassment from a neighbor or 
other acquaintance learning the information remains significant.
    The Bureau believes that disclosure in the loan-level HMDA data of 
the credit score or scores relied on in making the credit decision 
creates minimal risk, if any, of substantially facilitating the re-
identification of applicants and borrowers in the HMDA data. As 
discussed above, credit scores are not included in identified records 
available to the general public. A creditor or marketer may possess 
identified credit score information obtained in connection with, for 
example, an application for credit or a request for a prescreened list, 
but the Bureau does not believe that such information would be useful 
for purposes of re-identifying an applicant or borrower in the loan-
level HMDA data. The variation in credit scoring models and versions, 
along with the likely difference in the dates that a credit score in 
the HMDA data and the credit score information in possession of a 
creditor or marketer were created, would make matching the credit score 
in loan-level HMDA data to such privately held information challenging 
and unreliable. The Bureau believes an adversary would face substantial 
difficulty attempting to re-identify an applicant or borrower by using 
credit score or scores relied on to match HMDA records to other 
identified records.
    The Bureau considered whether modifications to the public loan-
level HMDA dataset other than excluding credit score, such as binning 
or rounding of credit score, would appropriately reduce the privacy 
risks created by the disclosure of credit score in the loan-level data 
while maintaining some utility for HMDA's purposes. However, the Bureau 
believes that these strategies would not appropriately reduce the risk 
of harm or sensitivity and that the gains in data utility that these 
strategies might allow would not

[[Page 44606]]

justify the privacy risk created by the disclosure of the modified 
field. For example, the Bureau believes that, even if it were to 
disclose in the loan-level HMDA data the credit score for a particular 
record as being in one of two or three large bins, this information 
would still create a significant sensitivity risk if the record were 
re-identified. The Bureau believes that the utility to HMDA's purposes 
of such binned credit score information would not justify these risks. 
The Bureau believes at this time that, under the balancing test, 
excluding credit score is a modification to the public loan-level HMDA 
data that appropriately balances the risks to applicant and borrower 
privacy and the benefits of disclosure. The Bureau seeks comment on 
this proposal.
Debt-to-Income Ratio
    The 2015 HMDA Final Rule requires financial institutions to report, 
except for purchased covered loans, the ratio of the applicant's or 
borrower's total monthly debt to the total monthly income relied on in 
making the credit decision (debt-to-income ratio).\137\ The debt-to-
income ratio relied on in making the credit decision will be submitted 
as a percentage.\138\ The Bureau added the requirement in the 2015 HMDA 
Final Rule to report information about the debt-to-income ratio relied 
on using its discretionary authority to require the reporting of ``such 
other information as the Bureau may require'' provided by the Dodd-
Frank Act's amendment to HMDA.\139\
---------------------------------------------------------------------------

    \137\ 12 CFR 1003.4(a)(23) (effective Jan. 1, 2018).
    \138\ Supra note 83, at 36, 38.
    \139\ HMDA section 304(b)(6).
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that disclosing 
the debt-to-income ratio relied on in making the credit decision in the 
loan-level HMDA data released to the public would likely disclose 
information about the applicant or borrower that is not otherwise 
public and may be harmful or sensitive and that, for certain debt-to-
income ratio values, this risk would not be justified by the benefits 
of the disclosure. Therefore, the Bureau proposes to modify the loan-
level HMDA dataset by binning and top- and bottom-coding certain debt-
to-income ratio values.
    The debt-to-income ratio relied on in making the credit decision 
would assist users in identifying possible discriminatory lending 
patterns and enforcing antidiscrimination statutes. Applicants' debt-
to-income ratios generally are considered to be important indicators of 
ability to repay and are used in mortgage underwriting decisions and 
some pricing decisions. Disclosure of debt-to-income ratio in the 
public loan-level HMDA data would help ensure that users are comparing 
applicants and borrowers with similar profiles, thereby controlling for 
factors that might provide a legitimate explanation for disparities in 
credit and pricing decisions. Debt-to-income ratio values that are at 
or close to regulatory or program benchmarks are especially critical to 
identifying possible discriminatory lending patterns. These benchmarks 
include, for example, the 43 percent debt-to-income limit for a 
qualified mortgage under Regulation Z \140\ and the debt-to-income 
ratio limits imposed by guarantors and investors.\141\ Disclosure of 
debt-to-income ratio also would assist in identifying whether financial 
institutions are serving the housing needs of their communities. For 
example, in order to serve the housing needs of particular communities, 
financial institutions may offer different types of loan products in 
communities with high numbers of borrowers with high debt-to-income 
ratios than in communities with high numbers of borrowers with low 
debt-to-income ratios.
---------------------------------------------------------------------------

    \140\ 12 CFR 1026.43(e)(2)(vi).
    \141\ See, e.g., Fannie Mae, ``B3-6-02: Debt to Income Ratios,'' 
(Aug. 30, 2016), available at https://www.fanniemae.com/content/guide/selling/b3/6/02.html.
---------------------------------------------------------------------------

    The Bureau believes that, if the HMDA data were re-identified, 
disclosure of an applicant's or borrower's debt-to-income ratio relied 
on in making the credit decision would likely disclose information 
about the applicant or borrower that is not otherwise public and may be 
harmful or sensitive. The debt-to-income ratio generally reflects the 
amount of an applicant's or borrower's monthly debt, including the 
payment for the mortgage loan sought or originated, relative to his or 
her monthly income. In addition, when combined with other information 
that the Bureau proposes to publicly disclose in the loan-level HMDA 
data, such as information about the mortgage loan sought or originated 
and applicant or borrower income relied on in making the credit 
decision, disclosure of debt-to-income ratio may permit a user to 
approximate the amount of the applicant's or borrower's monthly debt 
excluding mortgage debt. Information about a consumer's debt is not 
available to the general public without barriers to access and 
restrictions on use. The Bureau believes that most consumers consider 
information about their debt to be sensitive information and that the 
public disclosure of an identified applicant's or borrower's debt-to-
income ratio, especially at higher ratios, could lead to dignity or 
reputational harm or embarrassment. The Bureau also believes that, 
especially with respect to higher or lower debt-to-income ratios, 
identified information about an identified applicant's or borrower's 
debt could be used to target marketing to the applicant or borrower, 
including marketing for products and services that may pose risks that 
are not apparent.
    The Bureau believes that disclosure in the loan-level HMDA data of 
the debt-to-income ratio relied on in making the credit decision 
creates minimal risk, if any, of substantially facilitating the re-
identification of applicants and borrowers in the HMDA data. As 
mentioned above, information about a consumer's debts is not included 
in identified records available to the general public and, to the 
extent such information is available for commercial purposes, it 
generally may be obtained under limited circumstances and is subject to 
restrictions on its use. To the extent that a creditor possessed 
information about an applicant or borrower's debt or debt-to-income 
ratio, the Bureau does not believe that such information would be 
useful for purposes of re-identifying an applicant or borrower in the 
loan-level HMDA data. The variation in methods of calculating debt-to-
income ratio along with changes in the ratio or the amount of debt over 
time would make using debt-to-income ratio in the public loan-level 
HMDA data to match to any privately held debt or debt-to-income ratio 
information challenging and unreliable. The Bureau believes an 
adversary would face substantial difficulty attempting to re-identify 
an applicant or borrower by using debt-to-income ratio or debt amount 
to match HMDA records to other identified records.
    The Bureau believes that disclosing unmodified debt-to-income ratio 
values in the loan-level HMDA data released to the public would create 
risks to applicant and borrower privacy but that, with respect to debt-
to-income values greater than or equal to 40 percent and less than 50 
percent, these risks would be justified by the benefits of disclosure 
to HMDA's purposes. Debt-to-income ratio values in this range are 
generally at or close to regulatory and guarantor and investor program 
benchmarks and are especially critical to identifying possible 
discriminatory lending patterns because they may reveal non-
discriminatory explanations for differential treatment. Accordingly, 
the Bureau proposes to release reported debt-to-income values of 
greater than or

[[Page 44607]]

equal to 40 percent and less than 50 percent without modification.
    With respect to all other debt-to-income ratio values, the Bureau 
believes that the risks to applicant and borrower privacy that would be 
created by the disclosure of the unmodified field likely would not be 
justified by the benefits of the disclosure, but that the loan-level 
HMDA data may be modified to appropriately reduce the privacy risks 
while preserving some of the benefits of the data field. The Bureau 
proposes to bin reported debt-to-income ratio values into the following 
ranges, as applicable: 20 percent to less than 30 percent; 30 percent 
to less than 40 percent; and 50 percent to less than 60 percent. For 
example, a reported debt-to-income ratio of 35 percent would be shown 
in the loan-level HMDA data disclosed to the public as a debt-to-income 
ratio of between 30 percent and less than 40 percent. The Bureau also 
proposes to bottom-code reported debt-to-income ratio values under 20 
percent and to top-code reported debt-to-income ratios of 60 percent or 
higher. For example, a reported debt-to-income ratio of 63 percent 
would be shown in the public loan-level HMDA data as 61 percent or 
higher. The Bureau believes at this time that, under the balancing 
test, these modifications to the public loan-level HMDA data would 
appropriately balance the risks to applicant and borrower privacy and 
the benefits of disclosure.
    The Bureau has considered whether it should disclose debt-to-income 
ratio at or close to 36 percent without modification.\142\ It is the 
Bureau's understanding that, for many financial institutions, debt-to-
income ratio of 36 percent serves as an internal underwriting 
benchmark, so that the ability to identify whether an applicant's debt-
to-income ratio is above or below this value would help users seeking 
to identify possible discriminatory lending patterns to control for 
factors that might provide a legitimate explanation for disparities in 
credit or pricing decisions. The Bureau seeks comment on whether the 
benefits of disclosing more granular information concerning debt-to-
income ratio values at or around 36 percent would justify the risks to 
applicant and borrower privacy such disclosure would likely create and 
how such information should be disclosed.
---------------------------------------------------------------------------

    \142\ For example, debt-to-income values of between 35 percent 
and 40 percent could be disclosed without modification, or the 
Bureau could indicate in the loan-level HMDA data disclosed to the 
public whether the reported debt-to-income ratio is 36 percent or 
higher.
---------------------------------------------------------------------------

    The Bureau seeks comment on this proposal, including both the 
proposal to bin and top- and bottom-code certain debt-to-income values 
and the proposed intervals to be used for binning.
Property Value
    The 2015 HMDA Final Rule requires financial institutions to report 
the value of the property securing the covered loan or, in the case of 
an application, proposed to secure the covered loan.\143\ Financial 
institutions will report the value relied on in making the credit 
decision, such as an appraisal value or the purchase price of the 
property.\144\ The property value will be reported in numeric form 
reflecting the exact dollar amount of the value relied on.\145\ The 
Bureau added the requirement to report the property value relied on in 
the 2015 HMDA Final Rule to implement the Dodd-Frank Act's amendment to 
HMDA providing for the collection and reporting of the value of the 
real property pledged or proposed to be pledged as collateral.\146\
---------------------------------------------------------------------------

    \143\ 12 CFR 1003.4(a)(28) (effective Jan. 1, 2018).
    \144\ Id.
    \145\ Supra note 83, at 71.
    \146\ Dodd-Frank Act section 1094(3)(A)(iv), 12 U.S.C. 
2803(b)(6)(A).
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that disclosing 
the property value in the loan-level HMDA data released to the public 
would likely substantially facilitate the re-identification of an 
applicant or borrower and that this risk would not be justified by the 
benefits of the disclosure. Therefore, the Bureau proposes to modify 
the loan-level HMDA data by disclosing the midpoint for the $10,000 
interval into which the reported property value falls. For example, for 
a property value of $117,834, the Bureau would disclose $115,000 as the 
midpoint between values equal to $110,000 and less than $120,000.
    The property value data field would be useful for determining 
whether financial institutions are serving the housing needs of their 
communities. Users could better understand the values of properties for 
which financial institutions are (and are not) providing financing to 
consumers in certain communities. The property value, combined with the 
loan amount and combined loan-to-value ratio, can also be used to 
determine whether the property is subject to a second lien. Property 
value would also be beneficial for identifying possible discriminatory 
lending patterns and enforcing antidiscrimination statutes. Combined 
with the loan amount, the property value would allow users to calculate 
a loan-to-value ratio, an important variable in underwriting. The loan-
to-value ratio would help ensure that users who are evaluating 
potential disparities in underwriting outcomes, pricing, or other terms 
and conditions are comparing applicants or borrowers who obtained or 
applied for loans with similar loan-to-value ratios, thereby 
controlling for factors that might provide a legitimate explanation for 
disparities.
    The Bureau believes that disclosing the exact property value would 
likely substantially facilitate the re-identification of an applicant 
or borrower. As with loan amount, property value is a numeric data 
field that will often consist of at least six digits, which increases 
its contribution to the uniqueness of a particular HMDA record. As 
discussed above, many jurisdictions publicly disclose property tax 
records or real estate transaction records in an identified form, such 
as mortgages or deeds of trust. These records contain estimates of 
property value or information that is closely related to property 
value. Although the value of the property reflected in these public 
records generally will not be identical to the property value relied on 
by the financial institution in making the credit decision, the Bureau 
believes that it may be close enough to permit matching. Therefore, in 
many cases, an adversary could use the exact property value, combined 
with other fields, to match a HMDA record to an identified publicly 
available record.
    If the HMDA data were re-identified, the Bureau believes that the 
property value would likely disclose minimal, if any, information about 
an applicant or borrower that may be harmful or sensitive. In some 
cases, the property value may be combined with other information to 
identify borrowers with high levels of equity, which information could 
be used to target borrowers with predatory lending offers. For most 
consumers, however, the Bureau believes that property value would be 
unlikely to be used for targeted marketing of products and services 
that pose risks that may not be apparent. Indeed, the Bureau believes 
that information about borrower equity is already available to many 
marketers and may be calculated or estimated from publicly available 
property tax or real estate transaction records that include loan 
amounts and property values, such as mortgages and real estate sales 
records. Estimates of property value are also available through online 
real estate databases.

[[Page 44608]]

    The Bureau believes that the loan-level HMDA data may be modified 
to appropriately reduce the privacy risks created by the public 
disclosure of the property value while preserving much of the benefits 
of the data field. The Bureau believes that disclosing the midpoint for 
the $10,000 interval into which the reported property value falls 
provides enough precision to allow users to rely on property value to 
achieve HMDA's purposes. For example, $10,000 intervals will provide 
general information about values of properties for which financial 
institutions are providing financing. Such intervals will not allow 
users to calculate an exact loan-to-value ratio, although users may 
still derive an estimated loan-to-value ratio. However, the Bureau 
believes that releasing the combined loan-to-value ratio, as it 
proposes to do, will be more beneficial for fair lending purposes than 
the loan-to-value ratio that users would have calculated from the exact 
loan amount and property value. Disclosing the midpoint for the $10,000 
interval into which the reported property value falls also decreases 
the ability of adversaries to match HMDA data to identified public 
records by reducing the uniqueness of a data field common to both 
datasets. Because the Bureau is also proposing to bin loan amount 
similarly, adversaries will be unable to use the combined loan-to-value 
ratio to reduce the effectiveness of the proposed modification by 
deriving the reported property value. Although such modifications do 
not entirely eliminate the risk of re-identification, the Bureau 
believes that the remaining risk would be justified by the benefits of 
disclosing the property value in $10,000 intervals. Therefore, the 
Bureau believes at this time that, under the balancing test, modifying 
property value as described above appropriately balances the privacy 
risks and disclosure benefits. The Bureau seeks comment on this 
proposal, including both the proposed $10,000 intervals to be used for 
binning and the proposal to disclose the midpoint for each interval.
Nationwide Mortgage Licensing System and Registry Identifier
    The 2015 HMDA Final Rule requires financial institutions to report 
``the unique identifier assigned by the Nationwide Mortgage Licensing 
System and Registry [NMLSR ID] for the mortgage loan originator, as 
defined in Regulation G, 12 CFR 1007.102, or Regulation H, 12 CFR 
1008.23, as applicable.'' \147\ The NMLSR ID will be submitted by 
financial institutions in numeric form, such as 123450.\148\ The Bureau 
added the requirement to report the NMLSR ID in the 2015 HMDA Final 
Rule to implement the Dodd-Frank Act's requirement that financial 
institutions report, ``as the Bureau may determine to be appropriate, a 
unique identifier that identifies the loan originator as set forth in 
section 1503 of the [Secure and Fair Enforcement for] Mortgage 
Licensing Act of 2008.'' \149\
---------------------------------------------------------------------------

    \147\ 12 CFR 1003.4(a)(34) (effective Jan. 1, 2018).
    \148\ Supra note 83, at 75.
    \149\ [thinsp]Dodd-Frank Act section 1094(3)(A)(iv), 12 U.S.C. 
2803(b)(6)(F).
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that disclosing 
the NMLSR ID in the loan-level HMDA data released to the public would 
likely substantially facilitate the re-identification of an applicant 
or borrower and that this risk would not be justified by the benefits 
of the disclosure. Therefore, the Bureau proposes to modify the loan-
level HMDA data by excluding the NMLSR ID.
    The NMLSR ID would be useful for identifying possible 
discriminatory lending patterns and enforcing antidiscrimination 
statutes. The NMLSR ID would allow users to identify individual 
mortgage loan originators with primary responsibility over 
applications, originations, and purchased loans. This information would 
help public officials and members of the public to identify loan 
originators that are engaged in problematic business practices, which 
would provide a greater level of precision for understanding and 
correcting possible discriminatory lending patterns.
    The Bureau believes that disclosing the NMLSR ID would likely 
substantially facilitate the re-identification of an applicant or 
borrower in the HMDA data. The NMLSR ID is required to appear on 
various documents associated with the loan, including the security 
instrument.\150\ As explained above, many jurisdictions publicly 
disclose these real estate transaction records in an identified form. 
Although the NMLSR ID is not unique to an individual HMDA record, it is 
unique to the mortgage loan originator who is unlikely to be associated 
with many loans for which the other HMDA data fields are identical. 
Therefore, in many cases, an adversary could use the NMLSR ID, combined 
with other data fields, to match a HMDA record to an identified public 
record.
---------------------------------------------------------------------------

    \150\ 12 CFR 1026.36(g).
---------------------------------------------------------------------------

    If the HMDA data were re-identified, the Bureau believes that the 
NMLSR ID would likely disclose minimal, if any, information about an 
applicant or borrower that may be harmful or sensitive. The Bureau 
understands that the NMLSR ID may allow users to determine information 
that loan originators may consider sensitive. However, as explained in 
the 2015 HMDA Final Rule, because the Dodd-Frank Act explicitly amended 
HMDA to add a loan originator identifier, while at the same time 
directing the Bureau to modify or require modification of itemized 
information ``for the purpose of protecting the privacy interests of 
the mortgage applicants or mortgagors,'' the Bureau believes it is 
reasonable to interpret HMDA as not requiring modifications of itemized 
information to protect the privacy interests of mortgage loan 
originators, and that that interpretation best effectuates the purposes 
of HMDA.\151\ Rather, under the balancing test, the Bureau evaluates 
the risks to applicant and borrower privacy interests and the benefits 
of public disclosure in light of the statutory purposes. Because the 
NMLSR ID conveys no sensitive information about applicants or 
borrowers, the Bureau believes that disclosure of this data field would 
create minimal, if any, risk of harm or sensitivity under the balancing 
test. However, because the Bureau believes that disclosing the NMLSR ID 
in the loan-level HMDA data released to the public would likely 
substantially facilitate the re-identification of an applicant or 
borrower and that this risk would not be justified by the benefits of 
the disclosure, the Bureau proposes not to disclose in the loan-level 
HMDA data the NMLSR ID.
---------------------------------------------------------------------------

    \151\ 80 FR 66128, 66232 (Oct. 28, 2015).
---------------------------------------------------------------------------

    The Bureau has considered whether a modification to the public 
loan-level HMDA dataset other than exclusion of the NMLSR ID would 
appropriately reduce the privacy risks created by disclosure while 
maintaining some utility for HMDA's purposes. For example, as with the 
ULI, the Bureau has considered whether it could, in the loan-level HMDA 
data disclosed to the public, replace the NMLSR ID reported to the 
regulators with a different unique number, such as a hashed value. The 
Bureau is unable to identify a feasible modification at this time, 
however. The Bureau believes at this time that, under the balancing 
test, excluding the NMLSR ID is a modification to the public loan-level 
HMDA data that appropriately balances the risks to applicant and 
borrower privacy and the

[[Page 44609]]

benefits of disclosure. The Bureau seeks comment on this proposal.
Automated Underwriting System Result
    The 2015 HMDA Final Rule requires that, except for purchased 
covered loans, financial institutions report ``the name of the 
automated underwriting system used by the financial institution to 
evaluate the application and the result generated by that automated 
underwriting system.'' \152\ The 2015 HMDA Final Rule defines 
``automated underwriting system'' for the purposes of this requirement 
as ``an electronic tool developed by a securitizer, Federal government 
insurer, or Federal government guarantor that provides a result 
regarding the credit risk of the applicant and whether the covered loan 
is eligible to be originated, purchased, insured, or guaranteed by that 
securitizer, Federal government insurer, or Federal government 
guarantor.'' \153\ A financial institution will submit a code from a 
specified list to indicate the result or results generated by the AUS 
or AUSs used.\154\ Up to five AUS names and five AUS results may be 
reported.\155\ The Bureau added these requirements in the 2015 HMDA 
Final Rule using its discretionary authority to require the reporting 
of ``such other information as the Bureau may require'' provided by the 
Dodd-Frank Act's amendment to HMDA.\156\
---------------------------------------------------------------------------

    \152\ 12 CFR 1003.4(a)(35)(i) (effective Jan. 1, 2018).
    \153\ 12 CFR 1003.4(a)(35)(ii) (effective Jan. 1, 2018).
    \154\ Supra note 8, at 74-75. AUS result will be reported using 
the following codes: Code 1--Approve/Eligible; Code 2--Approve/
Ineligible; Code 3--Refer/Eligible; Code 4--Refer/Ineligible; Code 
5--Refer with Caution; Code 6--Out of Scope; Code 7--Error; Code 8--
Accept; Code 9--Caution; Code 10--Ineligible; Code 11--Incomplete; 
Code 12--Invalid; Code 13--Refer; Code 14--Eligible; Code 15--Unable 
to Determine; Code 16--Other; Code 17--Not applicable. If the AUS 
result is not listed, the financial institution will submit code 16 
for ``other'' and will report in a free-form text field the name and 
version of the scoring model used.
    \155\ Comment 4(a)(35)-3 (concerning reporting of multiple AUS 
results); supra note 83, at 37-39, 73.
    \156\ HMDA section 304(b)(6).
---------------------------------------------------------------------------

    For the reasons given below, the Bureau believes that disclosing in 
the loan-level HMDA data released to the public the AUS result field 
would likely disclose information about the applicant or borrower that 
is not otherwise public and may be harmful or sensitive and that this 
risk would not be justified by the benefits of the disclosure. 
Therefore, the Bureau proposes to modify the public loan-level HMDA 
dataset by excluding the AUS result field.\157\
---------------------------------------------------------------------------

    \157\ As discussed above, the Bureau proposes to disclose AUS 
name.
---------------------------------------------------------------------------

    The AUS result would assist users in identifying possible 
discriminatory lending patterns and enforcing antidiscrimination 
statutes. The AUS result would assist in understanding a financial 
institution's underwriting decision-making and would help ensure that 
users are comparing applicants and borrowers with similar profiles, 
thereby controlling for factors that might provide a legitimate 
explanation for disparities in credit and pricing decisions.
    The Bureau believes that, if the HMDA data were re-identified, 
disclosure of AUS result would likely disclose information about the 
applicant or borrower that is not otherwise public and may be harmful 
or sensitive. Applicants' AUS results are not available to the general 
public. An AUS result is based on a complex set of factors used to 
evaluate the credit risk associated with a loan. The traditional 
underwriting process often uses, among other things, loan-to-value 
ratio to evaluate collateral, credit score to evaluate creditworthiness 
and willingness to pay, and debt-to-income ratio to evaluate ability to 
pay. The result from an AUS reflects in a single indicator these and 
other factors used to evaluate the risk of the borrower and the 
eligibility of the loan to be purchased, insured, or guaranteed. The 
Bureau believes that, if a HMDA record were associated with an 
identifiable applicant or borrower, disclosure of a ``negative'' AUS 
result \158\ would reveal information that would likely be perceived as 
reflecting negatively on the applicant or borrower's willingness or 
ability to pay. The Bureau believes that most consumers would consider 
such information sensitive and that disclosure of this information 
could lead to dignity harm or embarrassment. The Bureau believes that 
this field also could be used to target marketing to applicants or 
borrowers, including marketing of products and services that may pose 
risks that are not apparent.
---------------------------------------------------------------------------

    \158\ For example, a ``refer with caution'' result would 
indicate that the loan would need to be manually underwritten.
---------------------------------------------------------------------------

    The Bureau believes that disclosure in the loan-level HMDA data of 
AUS result would create minimal, if any, risk of facilitating the re-
identification of applicants and borrowers in the HMDA data. The Bureau 
believes that AUS results are not included in any public records or 
found in other datasets available to the public and that an adversary 
would face substantial difficulty attempting to re-identify an 
applicant or borrower by using AUS result to match HMDA records to 
other identified records.
    The Bureau has considered whether modifications to the public loan-
level HMDA data other than the exclusion of AUS result would 
appropriately reduce the privacy risks created by the disclosure of the 
AUS result while maintaining some utility for HMDA's purposes. However, 
the Bureau does not believe that AUS result can be modified in a manner 
that appropriately protects privacy and that also preserves utility. 
AUS result is a categorical field, as opposed to a numerical one, and 
thus cannot be binned or rounded. The Bureau believes at this time 
that, under the balancing test, excluding AUS result is a modification 
to the public loan-level HMDA data that appropriately balances the 
risks to applicant and borrower privacy and the benefits of disclosure. 
The Bureau seeks comment on this proposal.
Free-Form Text Fields
    The 2015 HMDA Final Rule requires financial institutions to use 
free-form text fields to report certain data. For example, the 2015 
HMDA Final Rule requires financial institutions to report, except for 
purchased covered loans, the credit score or scores relied on in making 
the credit decision and the name and version of the scoring model used 
to generate each credit score.\159\ A financial institution will submit 
a code from a specified list to indicate the name and version of the 
scoring model used to generate each credit score reported.\160\ If the 
name and version of the scoring model used to generate a credit score 
is not listed, the financial institution will submit the code for 
``other credit scoring model'' and will report in a free-form text 
field the name and version of the scoring model used.\161\ Free-form 
text fields may also be used to report race,\162\ ethnicity,\163\ 
reason for denial,\164\ and AUS system name.\165\ The maximum number of 
characters for the AUS system name free-form text field and for the 
reason for denial free-form text field, including spaces, is 255; the 
maximum number of characters including spaces for all other free-form 
text fields is 100. Free-form text fields used to report race and 
ethnicity will be completed by

[[Page 44610]]

applicants; \166\ all other free-form text fields will be completed by 
the financial institution.
---------------------------------------------------------------------------

    \159\ 12 CFR 1003.4(a)(15)(i) (effective Jan. 1, 2018).
    \160\ Supra note 83, at 33-34, 63-64.
    \161\ Id.
    \162\ 12 CFR 1003.4(a)(10)(i); supra note 83, at 21-31.
    \163\ 12 CFR 1003.4(a)(10)(i); supra note 83, at 17-20.
    \164\ 12 CFR 1003.4(a)(16); supra note 83, at 35-36.
    \165\ 12 CFR 1003.4(a)(35)(i); supra note 83, at 38-40.
    \166\ Appendix B, paragraph 8 (effective Jan. 1, 2018).
---------------------------------------------------------------------------

    Free-form text fields will allow the reporting of any information, 
including information that creates risks to applicant and borrower 
privacy. Given the volume of HMDA data reported each year, it will not 
be feasible for the Bureau to review the contents of each free-form 
text field submitted before disclosing the loan-level HMDA data to the 
public. The Bureau believes at this time that, under the balancing 
test, excluding free-form text fields is a modification to the public 
loan-level HMDA data that appropriately balances the risks to applicant 
and borrower privacy and the benefits of disclosure. The Bureau seeks 
comment on this proposal.

IV. Other Considerations Related to Disclosure

A. Additional Data

    Current Regulation C requires financial institutions to report the 
location of the property to which the loan or application relates, by 
MSA or by Metropolitan Division, by State, by county, and by census 
tract, if the institution has a home or branch office in that MSA or 
Metropolitan Division.\167\ To reduce burden on financial institutions, 
the 2015 HMDA Final Rule eliminates from this provision the requirement 
to report the MSA or Metropolitan Division in which the property is 
located.\168\ The Bureau proposes to identify for each loan and 
application subject to this provision the MSA or Metropolitan Division 
in which the property securing or proposed to secure the loan is 
located and to include this information in the loan-level HMDA data 
disclosed to the public so that the utility of these currently 
disclosed data fields are preserved. The Bureau seeks comment on this 
proposal.
---------------------------------------------------------------------------

    \167\ 12 CFR 1003.4(a)(9).
    \168\ 12 CFR 1003.4(a)(9)(ii) (effective Jan. 1, 2018); 80 FR 
66128, 66187 (Oct. 28, 2015).
---------------------------------------------------------------------------

    The FFIEC currently includes with the agencies' loan-level release 
the following census and income data: Population (total population in 
tract); Minority Population Percent (percentage of minority population 
to total population for tract, carried to two decimal places); FFIEC 
Median Family Income (FFIEC Median family income in dollars for the 
MSA/MD in which the tract is located (adjusted annually by FFIEC)); 
Tract to MSA/MD Median Family Income Percentage (percentage of tract 
median family income compared to MSA/MD median family income, carried 
to two decimal places); Number of Owner Occupied Units (number of 
dwellings, including individual condominiums, that are lived in by the 
owner); and Number of 1- to 4-Family units (dwellings that are built to 
house fewer than five families).\169\ These data are intended to 
provide additional context to the reported HMDA data. The Bureau 
proposes to continue to include these data in the loan-level HMDA data 
disclosed to the public. The Bureau seeks comment on this proposal.
---------------------------------------------------------------------------

    \169\ For more information concerning these data, including the 
sources of these data, see Federal Financial Institutions 
Examination Council, ``FFIEC Census and Demographic Data,'' https://www.ffiec.gov/censusproducts.htm (last visited Mar. 20, 2017).
---------------------------------------------------------------------------

    The FFIEC also currently includes with the agencies' loan-level 
release an application date indicator reflecting whether the 
application date was before January 1, 2004, on or after January 1, 
2004, or not available. The Bureau believes that this indicator is no 
longer useful to analysis of the HMDA data and proposes to no longer 
include the application date indicator in the loan-level HMDA data 
disclosed to the public. The Bureau seeks comment on this proposal.

B. The Modified LAR and the Agencies' Loan-Level Release

    As discussed above, HMDA requires that financial institutions make 
available to the public, upon request, ``loan application register 
information'' as defined by the Bureau and in the form required under 
regulations prescribed by the Bureau.\170\ This information must be 
made available as early as March 31 following the calendar year for 
which the information was compiled.\171\ In addition to the loan-level 
data made available by each financial institution on its modified loan/
application register, the FFIEC currently makes available in September 
of each year the agencies' loan-level release, which is a loan-level 
dataset containing all reported HMDA data for the preceding calendar 
year.
---------------------------------------------------------------------------

    \170\ HMDA section 304(j)(1). This requirement is implemented in 
12 CFR 1003.5(c), which requires that each financial institution 
make available to the public its modified loan/application register, 
sometimes referred to as a ``modified LAR.''
    \171\ HMDA section 304(j)(5).
---------------------------------------------------------------------------

    Under the 2015 HMDA Final Rule, financial institutions will no 
longer be required to provide their modified loan/application registers 
directly to the public and will be required instead to provide a notice 
advising members of the public seeking their data that it may be 
obtained on the Bureau's Web site.\172\ By March 31 following the 
calendar year for which the data was compiled, the Bureau will make 
available on the Bureau's Web site a modified loan/application register 
for each financial institution that timely submits its HMDA data.\173\ 
With respect to data compiled in 2018 or later, this proposed Policy 
Guidance describes the modifications the Bureau proposes to apply to 
each financial institution's modified loan/application register as well 
as to the agencies' loan-level release, with the possible exception of 
modifications to reflect whether the loan amount is above the 
applicable GSE conforming loan limit, which may be released later than 
March 31.\174\
---------------------------------------------------------------------------

    \172\ 12 CFR 1003.5(c) (effective Jan. 1, 2018).
    \173\ With respect to data that is submitted late, the Bureau 
intends to make available a modified loan/application register by 
March 31 whenever possible, or as soon thereafter as is feasible.
    \174\ As noted above, HMDA data is reported by March 1 of the 
year following the calendar year for which the information was 
compiled, leaving the Bureau as little as 30 days to prepare each 
financial institution's modified loan/application register. The 
Bureau is exploring how best to provide the public with information 
concerning whether a loan is above the applicable GSE conforming 
loan limit.
---------------------------------------------------------------------------

C. Aggregate and Disclosure Reports

    HMDA and Regulation C require the FFIEC to make available a 
disclosure statement for each financial institution each year.\175\ The 
statute and regulation also require the FFIEC to compile aggregate data 
by census tract for all financial institutions reporting under HMDA and 
to produce tables indicating aggregate lending patterns for various 
categories of census tracts grouped according to location, age of 
housing stock, income level, and racial characteristics.\176\ The FFIEC 
currently makes these aggregate data products available in September of 
each year reflecting HMDA data reported for the preceding calendar 
year.
---------------------------------------------------------------------------

    \175\ 12 U.S.C. 2803(k); 12 CFR 1003.5(b)(1) (effective Jan. 1, 
2018).
    \176\ 12 U.S.C. 2809(a); 12 CFR 1003.5(f) (effective Jan. 1, 
2018).
---------------------------------------------------------------------------

    The FFIEC, the Bureau, and the other agencies continue to evaluate 
options for making available the disclosure statements and aggregate 
data required by HMDA and the 2015 HMDA Final Rule. The Bureau may also 
consider making available other data products to enhance understanding 
of the HMDA data and otherwise further the goals of the statute.

D. Restricted Access Program

    As indicated in the supplementary information to the 2014 HMDA 
Proposed Rule and the 2015 HMDA Final Rule, the Bureau believes that 
HMDA's public disclosure purposes may be furthered by allowing 
academics

[[Page 44611]]

and industry and community researchers to access the unmodified HMDA 
dataset through a restricted access program, for research purposes. The 
Bureau continues to evaluate whether access to unmodified HMDA data 
should be permitted through such a program, the options for such a 
program, and the risks and costs that may be associated with such a 
program.

V. Regulatory Requirements

    The Bureau concludes that the proposed Policy Guidance on 
Disclosure of Loan-Level HMDA Data is a non-binding general statement 
of policy and/or a rule of agency organization, procedure, or practice 
exempt from notice and comment rulemaking requirements under the 
Administrative Procedure Act pursuant to 5 U.S.C. 553(b). 
Notwithstanding this conclusion, the Bureau invites public comment on 
the proposed Policy Guidance. Because no notice of proposed rulemaking 
is required, the Regulatory Flexibility Act does not require an initial 
or final regulatory flexibility analysis.\177\ The existing information 
collections contained in Regulation C have been approved by the Office 
of Management and Budget (OMB) and assigned OMB control number 3170-
0008. The Bureau has determined that this proposed Policy Guidance does 
not impose any new or revise any existing recordkeeping, reporting, or 
disclosure requirements on covered entities or members of the public 
that would be collections of information requiring OMB approval under 
the Paperwork Reduction Act, 44 U.S.C. 3501, et seq. The Bureau has a 
continuing interest in the public's opinions regarding this 
determination. At any time, comments regarding this determination may 
be sent to the Consumer Financial Protection Bureau (Attention: PRA 
Office), 1700 G Street NW., Washington, DC 20552, or by email to 
CFPB_Public_PRA@cfpb.gov.
---------------------------------------------------------------------------

    \177\ 5 U.S.C. 603(a), 604(a).
---------------------------------------------------------------------------

VI. Proposed Policy Guidance on Disclosure of Loan-Level HMDA Data

    The text of the proposed Policy Guidance is as follows:

Policy Guidance on Disclosure of Loan-Level HMDA Data

A. Background

    The Home Mortgage Disclosure Act (HMDA), 12 U.S.C. 2801 et seq., 
requires certain financial institutions to collect, report, and 
disclose data about their mortgage lending activity. HMDA is 
implemented by Regulation C, 12 CFR part 1003. HMDA identifies its 
purposes as providing the public and public officials with sufficient 
information to enable them to determine whether financial institutions 
are serving the housing needs of the communities in which they are 
located, and to assist public officials in their determination of the 
distribution of public sector investments in a manner designed to 
improve the private investment environment.\178\ In 1989, the Board of 
Governors of the Federal Reserve System (Board) recognized a third HMDA 
purpose of identifying possible discriminatory lending patterns and 
enforcing antidiscrimination statutes, which now appears with HMDA's 
other purposes in Regulation C.\179\
---------------------------------------------------------------------------

    \178\ 12 U.S.C. 2801(b).
    \179\ 54 FR 51356, 51357 (Dec. 15, 1989) (codified at 12 CFR 
1003.1(b)(1)) (Bureau's post-Dodd-Frank Act Regulation C).
---------------------------------------------------------------------------

    In 2010, Congress enacted the Dodd-Frank Wall Street Reform and 
Consumer Protection Act (Dodd-Frank Act).\180\ Among other changes, the 
Dodd-Frank Act expanded the scope of information relating to mortgage 
applications and loans that must be collected, reported, and disclosed 
under HMDA and authorized the Bureau to require financial institutions 
to collect, report, and disclose additional information. The Dodd-Frank 
Act amendments to HMDA also added new section 304(h)(1)(E), which 
directs the Bureau to develop regulations, in consultation with the 
agencies identified in section 304(h)(2),\181\ that ``modify or require 
modification of itemized information, for the purpose of protecting the 
privacy interests of the mortgage applicants or mortgagors, that is or 
will be available to the public.'' Section 304(h)(3)(B), also added by 
the Dodd-Frank Act, directs the Bureau to ``prescribe standards for any 
modification under paragraph (1)(E) to effectuate the purposes of 
[HMDA], in light of the privacy interests of mortgage applicants or 
mortgagors. Where necessary to protect the privacy interests of 
mortgage applicants or mortgagors, the Bureau shall provide for the 
disclosure of information . . . in aggregate or other reasonably 
modified form, in order to effectuate the purposes of [HMDA].'' \182\
---------------------------------------------------------------------------

    \180\ Dodd-Frank Wall Street Reform and Consumer Protection Act, 
Public Law 111-203, 124 Stat. 1376, 1980, 2035-38, 2097-101 (2010).
    \181\ These agencies are the prudential regulators--the Board of 
Governors of the Federal Reserve System, the Federal Deposit 
Insurance Corporation, the National Credit Union Administration, and 
the Office of the Comptroller of the Currency--and the Department of 
Housing and Urban Development. Together with the Bureau, these 
agencies are referred to herein as ``the agencies.''
    \182\ Section 304(h)(3)(A) provides that a modification under 
section 304(h)(1)(E) shall apply to information concerning ``(i) 
credit score data . . . in a manner that is consistent with the 
purpose described in paragraph (1)(E); and (ii) age or any other 
category of data described in paragraph (5) or (6) of subsection 
(b), as the Bureau determines to be necessary to satisfy the purpose 
described in paragraph (1)(E), and in a manner consistent with that 
purpose.''
---------------------------------------------------------------------------

    On October 28, 2015, the Bureau published a final rule amending 
Regulation C (2015 HMDA Final Rule) to implement the Dodd-Frank Act 
amendments and make other changes.\183\ Most provisions of the 2015 
HMDA Final Rule go into effect on January 1, 2018,\184\ and apply to 
data financial institutions will collect beginning in 2018 and will 
report beginning in 2019.
---------------------------------------------------------------------------

    \183\ 80 FR 66128 (Oct. 28, 2015); see also 80 FR 69567 (Nov. 
10, 2015) (making technical corrections).
    \184\ Certain amendments to the definition of financial 
institution went into effect on January 1, 2017. See 12 CFR 1003.2 
(effective Jan. 1, 2017); 80 FR 66128, 66308 (Oct. 28, 2015).
---------------------------------------------------------------------------

B. The Balancing Test

    In the 2015 HMDA Final Rule, in consultation with the agencies and 
after notice and comment, the Bureau interpreted HMDA, as amended by 
the Dodd-Frank Act, to require that the Bureau use a balancing test to 
determine whether and how HMDA data should be modified prior to its 
disclosure to the public in order to protect applicant and borrower 
privacy while also fulfilling HMDA's public disclosure purposes. The 
Bureau interpreted HMDA to require that public HMDA data be modified 
when the release of the unmodified data creates risks to applicant and 
borrower privacy interests that are not justified by the benefits of 
such release to the public in light of the statutory purposes. In such 
circumstances, the need to protect the privacy interests of mortgage 
applicants or mortgagors requires that the itemized information be 
modified. This binding interpretation implemented HMDA sections 
304(h)(1)(E) and 304(h)(3)(B) because it prescribed standards for 
requiring modification of itemized information, for the purpose of 
protecting the privacy interests of mortgage applicants and borrowers, 
that is or will be available to the public.\185\
---------------------------------------------------------------------------

    \185\ 80 FR 66128, 66134 (Oct. 28, 2015).
---------------------------------------------------------------------------

    The Bureau has applied the balancing test to determine whether and 
how to modify the HMDA data reported under the 2015 HMDA Final Rule 
before it is disclosed on the loan level to the public. This Policy 
Guidance describes the loan-level HMDA data that the Bureau intends to 
make available to the public beginning in 2019, with respect to data 
compiled by financial institutions in or after 2018, including 
modifications that

[[Page 44612]]

the Bureau intends to apply to the data. The Bureau intends to continue 
to monitor developments affecting the application of the balancing test 
to the HMDA data and may reconsider whether and how to modify the HMDA 
data, based on the application of the balancing test, in order to 
ensure the appropriate protection of applicant and borrower privacy in 
light of HMDA's purposes. This Policy Guidance is non-binding in part 
because flexibility to revise the modifications to be applied to the 
public loan-level HMDA data is necessary to maintain a proper balancing 
of the privacy risks and benefits of disclosure.

C. Loan-Level HMDA Data To Be Disclosed to the Public

    The Bureau intends to publicly disclose loan-level HMDA data 
reported pursuant to the 2015 HMDA Rule as follows:
    1. Except as provided in paragraphs 2 through 6 below, the Bureau 
intends to disclose all data as reported, without modification.
    2. The Bureau intends to exclude the following from the public 
loan-level HMDA data:
    a. Universal loan identifier, collected pursuant to 12 CFR 
1003.4(a)(1)(i);
    b. The date the application was received or the date shown on the 
application form, collected pursuant to 12 CFR 1003.4(a)(1)(ii);
    c. The date of action taken by the financial institution on a 
covered loan or application, collected pursuant to 12 CFR 
1003.4(a)(8)(ii);
    d. The address of the property securing the loan or, in the case of 
an application, proposed to secure the loan, collected pursuant to 12 
CFR 1003.4(a)(9)(i);
    e. The credit score or scores relied on in making the credit 
decision, collected pursuant to 12 CFR 1003.4(a)(15)(i);
    f. The unique identifier assigned by the Nationwide Mortgage 
Licensing System and Registry for the mortgage loan originator, as 
defined in Regulation G, 12 CFR 1007.102, or Regulation H, 12 CFR 
1008.23, as applicable, collected pursuant to 12 CFR 1003.4(a)(34);
    g. The result generated by the automated underwriting system used 
by the financial institution to evaluate the application, collected 
pursuant to 12 CFR 1003.4(a)(35)(i); and
    h. Free-form text fields used to report the following data: 
Applicant or borrower race, collected pursuant to 12 CFR 
1003.4(a)(10)(i); applicant or borrower ethnicity, collected pursuant 
to 12 CFR 1003.4(a)(10)(i); name and version of the credit scoring 
model used to generate each credit score or credit scores relied on in 
making the credit decision, collected pursuant to 12 CFR 
1003.4(a)(15)(i); the principal reason or reasons the financial 
institution denied the application, if applicable, collected pursuant 
to 12 CFR 1003.4(a)(16); and automated underwriting system name, 
collected pursuant to 12 CFR 1003.4(a)(35)(i).
    3. With respect to the amount of the covered loan or the amount 
applied for, collected pursuant to 12 CFR 1003.4(a)(7), the Bureau 
intends to:
    a. Disclose the midpoint for the $10,000 interval into which the 
reported value falls, e.g., for a reported value of $117,834, disclose 
$115,000 as the midpoint between values equal to $110,000 and less than 
$120,000; and
    b. Indicate whether the reported value exceeds the applicable 
dollar amount limitation on the original principal obligation in effect 
at the time of application or origination as provided under 12 U.S.C. 
1717(b)(2) and 12 U.S.C. 1454(a)(2).
    4. With respect to the age of an applicant or borrower, collected 
pursuant to 12 CFR 1003.4(a)(10)(ii), the Bureau intends to:
    a. Bin reported values into the following ranges, as applicable: 25 
to 34; 35 to 44; 45 to 54; 55 to 64; and 65 to 74;
    b. Bottom-code reported values under 25;
    c. Top-code reported values over 74; and
    d. Indicate whether the reported value is 62 or higher.
    5. With respect to the ratio of the applicant's or borrower's total 
monthly debt to the total monthly income relied on in making the credit 
decision, collected pursuant to 12 CFR 1003.4(a)(23), the Bureau 
intends to:
    a. Bin reported values into the following ranges, as applicable: 20 
percent to less than 30 percent; 30 percent to less than 40 percent; 
and 50 percent to less than 60 percent;
    b. Bottom-code reported values under 20 percent;
    c. Top-code reported values of 60 percent or higher; and
    d. Disclose, without modification, reported values greater than or 
equal to 40 percent and less than 50 percent.
    6. With respect to the value of the property securing the covered 
loan or, in the case of an application, proposed to secure the covered 
loan, collected pursuant to 12 CFR 1003.4(a)(28), the Bureau intends to 
disclose the midpoint for the $10,000 interval into which the reported 
value falls, e.g., for a reported value of $117,834, disclose $115,000 
as the midpoint between values equal to $110,000 and less than 
$120,000.

    Dated: September 8, 2017.
Richard Cordray,
Director, Bureau of Consumer Financial Protection.
[FR Doc. 2017-20409 Filed 9-22-17; 8:45 am]
 BILLING CODE 4810-AM-P