CBA Joint Comment Letter re Disclosure of Loan-Level HMDA Data

 November 24, 2017

Monica Jackson

Office of the Executive Secretary

Consumer Financial Protection Bureau

1700 G Street, NW

Washington, DC 20552


            Re:      Disclosure of Loan-Level HMDA Data; Docket No. CFPB-2017-0025

Dear Ms. Jackson,

            We appreciate the opportunity to provide comments on the Consumer Financial Protection Bureau’s (CFPB or Bureau) proposed policy guidance, Disclosure of Loan-Level HMDA Data (Proposed Guidance).[1] Our associations, the American Bankers Association,[2] Consumer Bankers Association,[3] Consumer Mortgage Coalition,[4] Housing Policy Council of the Financial Services Roundtable,[5] and Mortgage Bankers Association,[6] represent the thousands of lenders who originate and purchase home loans in the U.S., and these lenders are committed to ensuring fair treatment of consumers, equal access to credit, and a broad reach into all American communities.[7]

In the 2015 HMDA Final Rule, CFPB interpreted HMDA to require that CFPB use a balancing test to determine whether and how HMDA data should be modified prior to its public disclosure in order to protect applicant and borrower privacy while also fulfilling HMDA’s disclosure purposes. The balancing test is whether the release of unmodified data creates risks to applicant and borrower privacy interests that are not justified by the benefits of such release to the public in light of the statutory purposes. The Proposed Guidance is CFPB’s application of this balancing test. Under the Proposed Guidance, CFPB would exclude certain loan-level data points from disclosure, modify some data points prior to disclosure, and disclose other data points without modification.[8]

Consumers[9] provide a wide range of financial and personal data to our lender and vendor members – information that provides a clear financial and demographic profile of the borrower and the terms of the loans. As responsible keepers of this sensitive information, we feel compelled to articulate our profound concerns about the risks to consumer privacy, of identity theft, and fraud presented by the Proposed Guidance. Our concerns include:

  • The CFPB has not engaged in the statutorily-required rulemaking process for modification of itemized data. To rectify this, CFPB must withdraw this Proposed Guidance and issue a formal Administrative Procedure Act (APA)-compliant rulemaking.
  • The CFPB’s balancing test fails to consider real threats to consumers, as re-identification under the Proposed Guidance would be a virtual certainty. Research has shown that re-identification is already highly possible, even using only the current public HMDA data. It becomes significantly more attainable with any increase in data disclosures lacking sufficient masking. With advances in technology enabling easier re-identification, this concern transforms from a risk to a virtual certainty. To guard against invasions of privacy, identity theft, and fraud, CFPB should disclose the new data only in aggregate form, carefully designed to protect the financial interests of individual consumers.  
  • Data security is of the utmost importance, and CFPB should take steps to ensure this sensitive data is protected, including providing a comprehensive update of its data security practices and taking measures to restrict access and ensure the data is properly protected.
  • The CFPB’s new data submission interface raises concerns about accessibility, functionality, data aggregation and storage, and liability. We have several suggestions for addressing these concerns, including providing for the ability to submit data incrementally and permitting the appending of earlier data.
  • Finally, to improve the public understanding of why lenders ask for certain information, the obligation to submit that information to CFPB, and the statutory requirement for public disclosure we ask CFPB to engage in a public education initiative.


I.The Dodd-Frank Act Requires CFPB to Use APA Rulemaking to Address the Privacy Issues Presented by Public Disclosure of the HMDA Data.

The Dodd-Frank Act defines the terms under which CFPB is authorized to release to the public an expanded set of loan-level data. CFPB is required to “develop regulations” “after notice and comment” which: a) establish a method to evaluate whether the publication of specific data will violate consumers’ privacy interests (the balancing test) and b) describe how CFPB will “modify” any data that trigger this privacy breach. The letter and intent of the law is only satisfied by meeting both of these terms. The HMDA balancing test, as promulgated in the 2015 HMDA Final Rule, clearly fulfills the statutory obligation to establish a standard for evaluating the impact of disclosure of loan-level data. However, neither that regulation nor the proposed rule that preceded that Final Rule sets forth the method to mask the data fields deemed problematic. It is in this latter action, the application of the balancing test, that the impact of the Rule will be felt by all stakeholders, especially consumers. As modified by Dodd-Frank, the statutory requirement is to develop regulations “that modify or require modification”, not merely a conceptual framework for making that determination at a later date. It is this outcome that was the core concern for lawmakers, when mandating the rulemaking, not merely the means. The application of the test and the outcomes necessitate an APA-compliant rulemaking process. 

Therefore, we disagree with CFPB’s conclusion that it has met the statutory requirement of issuing a rule regarding modification of itemized information. The fact that the Bureau has requested comment on the Proposed Guidance does not excuse the procedural shortcut: the requirements for APA rulemaking encompasses far more than notice and comment to promote fairness, transparency and fact-based decision-making.[10] Moreover, a final rule adopted through APA rulemaking has a degree of permanence that is not guaranteed with agency guidance.


[1] Disclosure of Loan-Level HMDA Data, 82 Fed. Reg. 44586 (Sept. 25, 2017).

[2] The American Bankers Association is the voice of the nation’s $17 trillion banking industry, which is composed of small, regional and large banks that together employ more than 2 million people, safeguard $13 trillion in deposits and extend more than $9 trillion in loans.

[3] The Consumer Bankers Association represents America’s retail banks above $10 billion in assets. We advance legislation and promote policies geared toward creating a stronger industry and economy. Established in 1919, CBA’s corporate member institutions account for 1.6 million jobs in America, extend roughly $3 trillion in consumer loans, and provide $270 billion in small business loans. Follow us on Twitter @consumerbankers.

[4] The Consumer Mortgage Coalition, a mortgage industry trade association, dedicated to better-serving consumers by streamlining and improving the laws and regulations governing the mortgage industry.

[5] The Housing Policy Council (HPC) is a division of the Financial Services Roundtable (FSR). Our members are 31 of the leading national mortgage lenders, servicers, mortgage insurers, and title and data companies.  HPC advocates for the mortgage and housing marketplace interests of its members in legislative, regulatory, and judicial forums. For additional information, visit:

[6] The Mortgage Bankers Association (MBA) is the national association representing the real estate finance industry, an industry that employs more than 280,000 people in virtually every community in the country. Its membership of over 2,300 companies includes all elements of real estate finance: mortgage companies, mortgage brokers, commercial banks, thrifts, REITs, Wall Street conduits, life insurance companies and others in the mortgage lending field.

[7] Our comments are representative of single-family HMDA reporters. Some of the undersigned trade associations may submit separate comments relative to multi-family HMDA reporters.

[8] See Appendix A for a detailed overview of the Proposed Guidance.

[9] While we use the term “consumers” throughout this letter, we recognize that some business purpose loans also are reportable under HMDA, and therefore some of these privacy concerns may also be applicable to businesses.

[10] In part, the APA requires a notice of proposed rulemaking to include reference to the legal authority under which the rule is proposed and the substance of the proposal. There are other statutory requirements for a formal rulemaking as well, such as section 1022(b)(2) of Dodd-Frank, which requires the CFPB to conduct a cost-benefit analysis; the Regulatory Flexibility Analysis Act which requires an agency to consider the potential impact of its regulations on small entities, and the Paperwork Reduction Act, which requires an agency to seek the Office of Management and Budget approval for information collection requirements prior to implementation.

Please click here for full comment letter.