---

Published: August 2010

SEC’s proposed rule would expose personal financial information of homeowners

Coalition: Privacy

Consumer Action signed onto comments made to the Securities and Exchange Commission (SEC) on its Proposed Rulemaking on Asset-Backed Securities, a rule which would mandate an unprecedented release of individual-level financial data and would greatly increase borrowers’ risk for identity theft.

Below is an excerpt from the letter:

While we understand the purpose of and motivation for the Commission’s proposed rule, the proposal is a direct and substantial threat to the privacy of every individual who obtains a mortgage. If adopted, the proposal would be an unprecedented release of individual-level financial data and would greatly increase borrowers’ risk for identity theft and other problems related to the public release of detailed financial information. Specifically, the SEC’s proposed rule would:

• Expand the risk of identity theft for every borrower whose information would be disclosed because of the rule;
• Place on the public record and online the largest amount of personal financial information about borrowers ever disclosed, including information never before made public;
• Circumvent or undermine privacy protections in other laws, including the Fair Credit Reporting Act, Health Insurance Portability and Accountability Act, and the Privacy Act of 1974;
• Weaken the utility and security of knowledge-based authentication techniques and activities by exposing details of mortgages to more people throughout the world and would undermine NIST electronic authentication recommendations;
• Undermine the financial stability of households;
• Threaten the stability of the asset-backed instruments that the proposed rule seeks to protect by placing all borrowers at greater risk to be victims of criminal activity and thereby lowering the value of the asset-backed instruments.

We discuss the specific problems with the SEC’s proposed rule in more detail below.

1. The records that the Commission wants to disclose can be linked to addresses and to individuals with minimal effort.

For mortgage borrowers, the proposed rule would require the disclosure of personally identifiable, individual-level information about each loan and each borrower. The inherent problem is that the level of detail the SEC plans to make public via its online EDGAR database7 will lead to identifiability of individual borrowers, and the information the SEC plans to release is extremely sensitive. Professor Latanya Sweeney8 has written a white paper that addresses the ways publicly available tax assessment real property databases can be used to re-identify mortgage information in the proposed data releases that are described in the SEC’s proposed rule on Asset-Backed Securities. Dr. Sweeney is well-known for her research on re-identification risks based on public datasets.

The datasets that the SEC plans to release via EDGAR are unprecedented in their scope and detail. Schedule L at the end of the proposed rule includes the detailed disclosures that would be required for every asset covered by a loan packaged for sale. We focus here on consumer mortgage loans, but the same analysis applies to other consumer loans, such as automobile loans, leases, and student loans. These comments do not address commercial mortgages, equipment loans, or corporate debts. Commercial lending does not normally raise privacy concerns.

We emphasize that all of the information in Schedule L that we describe here will become public. The Commission acknowledges that it is “proposing to require asset-level information in a standardized format to be included in the prospectus and periodic reports and filed on EDGAR.” (page 23356). All information in the SEC’s EDGAR system is available worldwide at no charge. Thus, all information will be freely available to any user around the world, whether that user is a potential purchaser of an asset-backed security or a criminal in another country seeking personal information on Americans for nefarious purposes. We observe that companies already profit by taking EDGAR data and repackaging it for use by others, and it is highly likely that any new data would be copied and repackaged for sale.

The SEC’s proposed rulemaking is regrettably irresponsible. It would deeply undermine the security and privacy of individual borrowers, increase the risk for identity theft and fraud to an unacceptable degree, weaken the utility and security of knowledge-based authentication systems, and threaten the value of securities that the proposal seeks to protect. The SEC’s proposal would likewise undermine some of the “strong authentication” security proposals of the National Strategy for Trusted Identities in Cyberspace by undermining identity-proofing knowledge-based authentication systems. Finally, the data the SEC’s proposed rule will make public will become a treasure trove for marketers of every variety, both legitimate and nefarious. If the rich new set of financial and personal data (including health data) is placed in the public domain, this information will be combined with other public data sources in ways the SEC has not envisioned. The SEC did not take nearly enough care with its proposed rulemaking, and its proposed privacy protections are not responsive to the problems the rulemaking creates.

The SEC needs to significantly revise this rulemaking and curtail the amount of information it is releasing about individual borrowers via EDGAR. We urge the Commission to reconsider its proposed rulemaking, recognize the threat it presents to the privacy of every consumer who borrows money, protect the integrity of securities by not exposing borrowers to identity theft, and revise it approach to privacy substantially.

Lead Organization

World Privacy Forum

Other Organizations

Center for Digital Democracy | The Center for Financial Privacy and Human Rights | Privacy Rights Clearinghouse | Privacy Activism

Download PDF

No Download Available