Counsel’s Corner: Updated HMDA Creates Concerns Over Privacy, Increased Costs

Alexander Monterrubio serves as Regulatory Affairs Counsel for the National Association of Federal Credit Unions (NAFCU). Monterrubio is a graduate of the University of California Davis School of Law and holds a Bachelor of Art degree in political science and history from George Washington University. Prior to law school, Monterrubio was on the government relations staff at the National Association Management Group LLC., where he represented restaurant franchisees.

Editor’s note: In October 2015, the Consumer Financial Protection Bureau (CFPB) announced the finalization of a rule that will improve information about consumers’ access to residential mortgage credit by updating reporting requirements of the Home Mortgage Disclosure Act (HMDA), which was originally passed in 1975. On January 7, 2016, the CFPB announced it is seeking public comment on the resubmission of data reported under HMDA.

What affect does the expanded HMDA data collection have on the industry and on credit unions in particular? What are some of the positives and the negatives to being required to report more data under HMDA?

NAFCU has been very clear in both of our comment letters to the proposal, statements, and the HMDA information collection that we support the overall goal of HMDA—to ensure fair lending and access to credit. But I think one thing that is important to recognize is that even the CFPB has acknowledged that credit unions were not engaged in the sort of practices that inspired the passage of HMDA decades ago.

As far as benefits, there are a few improvements that have occurred in the rule. There is a fairly common phrase “Two steps forward, one step back.” With the HMDA rule, it seemed like it was more “Two steps back, one step forward.” They increased the number of institutions that are exempt from HMDA data reporting by creating loan volume thresholds that start in 2017 and 2018, but as NAFCU said in our comments, it was not nearly enough. The 25 covered closed-end mortgage loans threshold could be higher, and the 100 covered open-end lines of credit threshold could be higher, and they should be. Another place where the benefits were limited by the burdens was the CFPB removing the burden of production for the Modified LAR or the Disclosure Statement from credit unions and shifting that burden to the Bureau. The public will be able to directly access those documents from the CFPB, and financial institutions are only required to provide notice to the individual that they can get that information through the Bureau. That’s a good thing—that’s something that we supported in our comment letter in 2014. But that also creates a number of privacy issues.

In their final rule, the CFPB did not expressly dictate which data points would be modified or redacted in the Modified LAR or the Disclosure Statement. I think that is an area where they want to engage in a discussion. There is an undetermined balancing test that the Bureau articulated that they are going to be doing significantly more outreach on, and we are going to be engaged with them during that process. But that is something that is definitely a concern for all financial institutions and especially credit unions, because the CFPB added a significant number of data points over what is currently collected by HMDA. A number of those data points were required by Dodd-Frank, but a number of them weren’t. It obviously depends on how you count subfields, but the CFPB actually added more discretionary data points than mandated data points.

From a credit union perspective, there are significant costs and burdens associated with the new rule. Credit unions are going to have to update their systems and they’re going to have to work with their vendors again, and look how that went with the TRID Rule.

How much of a concern is privacy in this issue?

It’s a significant concern. The data the CFPB is collecting is highly sensitive information. There is the ability to identify individual applicants and borrowers through that information. In the case of unauthorized access to this information, that’s a concern. In our modern, data-driven age, with increased use of technology, I think privacy and security is something the Bureau needs to be mindful of. It’s on the mind of every financial institution, and it’s on the mind of consumers as well.

Will the negatives of expanded HMDA data collection potentially outweigh the benefits?

The Bureau definitely made sweeping changes to HMDA and expanded the data set beyond what was required by statute. We’re doing more outreach with our members to determine their concerns and what their additional costs are going to be. It’s difficult to quantify those numbers when we’re still talking about something that has yet to be implemented. For example, with the TRID Rule, there were a number of issues that ended up occurring after implementation. Those issues are hard to predict when you’re talking about something that’s in the future. It’s an issue that that is going to become a lot clearer as we move forward toward implementation.