Will Fannie and Freddie comply with new privacy law?

Freddie Mac says it will comply with the California Consumer Privacy Act, which takes effect Jan. 1. I’m still waiting to hear from Fannie Mae.

Here’s a New Year’s gift from the state of California: The ability to take control of your personal loan data and interior photos of your property.

The Consumer Privacy Act, or CCPA, takes effect Jan. 1, greatly expanding consumer protections and giving you the right to sue when your privacy rights are violated.

Under the law, Californians can hold companies accountable for potential abuse of their data and ask a business to delete information they have on them. The state can fine businesses that fail to comply.

While the likes of information giants Facebook, Google and Amazon have a treasure trove of personal data on you, they may not hold a candle to the amount of personal information Fannie Mae and Freddie Mac may have collected.

F & F are data and automation giants, and the fastest and cheapest way for most lenders to screen and price out your mortgage application.

Whether mortgage giants Fannie Mae and Freddie Mac (that own about half of America’s mortgages) ever purchased your mortgage from a lender, they may have collected your personal mortgage application data through their automated underwriting and appraisal valuation processes.

Freddie Mac should be acknowledged for getting out in front of this. “Freddie Mac takes privacy and its obligation to follow the law very seriously. We will comply with the new California Consumer Privacy Act when it takes effect on Jan. 1, including properly responding to verifiable requests made by consumers,” wrote a Freddie Mac spokesperson.

Will Fannie Mae comply? Fannie did not respond to multiple inquiries.

This is my ninth year of corresponding with and writing columns about F & F. At times, I’ve been surprised by their coyness in shedding light on unremarkable topics.

Worse than coyness, I received no response to several requests from the Federal Housing Finance Agency, which is F & F’s regulator and has been conservator for both over the last 11 years.

California has 7.3 million mortgaged properties, 14% of the U.S. market, according to Black Knight. Will the FHFA require compliance with California law? What about compliance guidance?

The CCPA requires covered businesses to respond within 45 days about personal information collected about you over the previous 12 months, according to attorney Raymond Snytsheuvel at Garris Horn.

You can request that a business delete your personal information, and your requests should include what the information collected and shared.

“The law is silent about how far back the business must go to delete your personal information,” said Snytsheuvel.

I’d request all information be deleted from the beginning of time.

You also have the right to opt-out of the sale of your personal information and the right to non-discrimination when you do exercise your rights. Other laws may preclude certain business from deleting your personal information.

The vast majority of real estate agents will not fall within the CCPA’s constraints, according to a California Association of Realtors advisory.

Other state laws require agents and mortgage brokers who are subject to the law to retain your records for at least three years, state officials said.