Privacy Notice for California Residents
This PRIVACY NOTICE FOR CALIFORNIA RESIDENTS supplements the information contained in the Privacy Statement of the FEDERAL HOME LOAN MORTGAGE CORPORATION ("Freddie Mac," "we," "us," or "our") and applies solely to those individuals who reside in the State of California ("consumers" or "you"). We are issuing this Notice in compliance with the California Consumer Privacy Act of 2018 ("CCPA") and other applicable California privacy laws. Any terms used in this Notice that are not defined in the Notice itself have the same definition as used in the CCPA.
Definition of Personal Information
We collect certain "personal information" from consumers. The CCPA defines personal information as information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household or device. Personal information does not include:
- Publicly available information from government records.
- De-identified or aggregated information.
- Information excluded from the CCPA's scope, like:
- health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
- personal information covered by certain other privacy laws, like the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) and California Financial Information Privacy Act (FIPA).
What Personal Information We Collect
We have collected the following categories of personal information from consumers within the last twelve (12) months:
|A. Identifiers.||Real name, alias, postal address, personal and work phone number, unique personal identifier, online identifier, Internet Protocol address, personal photograph/image, personal and work email address, account name, Social Security number, driver's license number, passport number, and other similar identifiers.||YES|
|B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).||Name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.||YES|
|C. Protected classification characteristics under California or federal law.||Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).||YES|
|D. Commercial information.||Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.||YES|
|E. Biometric information.||Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.||YES|
|F. Internet or similar network activity.||Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.||YES|
|G. Geolocation data.||Physical location or movements.||YES|
|H. Sensory data.||Audio, electronic, visual, thermal, olfactory, or similar information.||YES|
|I. Professional or employment-related information.||Current or past job history, responsibilities, memberships or performance evaluations, national identification information, travel-related records, background check and screening results, references, EEOC monitoring information (ethnicity, religion, gender and sexual orientation).||YES|
|J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).||Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.||YES|
|K. Inferences drawn from other personal information.||Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.||NO|
Categories of Sources
We obtain the categories of personal information listed above:
- from the companies from which we buy or consider buying loans (our “customers”) or their agents, from our loan servicing agents and from our service providers in connection with the purchase and securitization of loans and the resecuritization and sale of such securities.
- from our Seller/Servicers and other entities that sell or seek to sell us mortgages or to have us securitize their mortgages.
- from credit bureaus and other vendors who provide credit and other background information on individuals for credit and due diligence purposes.
- from activity on our websites or mobile application (for example, from submissions to our mobile application or through our website portals, or from automatically collected website or mobile application usage details).
- from borrowers and loan applicants.
- from third-parties from whom we obtain products or services.
How We Use Personal Information
We may use or disclose personal information we collect for one or more of the following business purposes:
- To fulfill the request or satisfy the reason for which the information is provided. For example, if a mortgage broker provides us with personal information in order for us to consider buying a loan, we use that information to assess the loan and, if we buy it, to service it and securitize it. As another example. if you provide your personal or financial information through our mobile application, we organize, store and retain that information, making the information available to the housing counselor so the counselor can determine your readiness to purchase a home and get your finances and credit profile ready for success in the mortgage application process.
- In connection with activities related to buying mortgages, securitizing them and selling the securities (our secondary market-related activities). For example, we use personal information to evaluate loans that we are considering buying or guaranteeing and to monitor the performance of loans that we own or guarantee. As another example, we use this information to evaluate the value of properties collateralizing these loans and to predict default.
- To establish and manage our relationships with brokers, third party loan originators, and other entities with whom we conduct business, such as information about these entities’ employees, agents, principals, officers and guarantors. This may include names, photographs/images, email addresses, phone numbers and other contact information for the employees of these entities with whom we are dealing.
- If you send us an email or message and provide your name or other personal information, we may use this information to research your question, to send an answer to your question and to deliver the requested information or service to you. We also may use this information to provide you with information in which we believe you will be interested; however, at any time, you may request that we stop doing this by contacting us in the manner described in the "How to Contact Us" section of this Notice.
- To provide our customers with email alerts, event registrations and other notices concerning our products or services, events, news, or other items that may be of interest.
- With regard to website visitor information, to measure the number of visitors to different pages on the website, conduct statistical modeling and evaluate, modify and enhance our websites, our services and our business. We also use this information to monitor network traffic and to identify unauthorized access or unusual activity on the website.
- The mobile application will also capture information about your mobile device and your usage of the application, including location, session duration and similar data. We use this to help refine the application.
- For purposes of testing, research, analysis, modeling and product development related to our public mission, business and websites. We may publish the results of our research, but we will not publish personally identifiable information about you as part of the publication.
- In connection with employment applications to, or employment with, Freddie Mac, and in connection with our employment processes more generally (such as assessing an individual’s suitability for a position, determining compensation and eligibility to work, arranging or reimbursing travel and other expenses, career planning and development, compliance with policies and procedures, administering benefits, maintaining emergency contacts and granting access to internal systems).
- To carry out our obligations and enforce our rights arising from any loan documents or other contracts we have entered into, including for collections.
- To evaluate or conduct a restructuring, reorganization, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
- In connection with the security and access control systems for our offices, buildings and other facilities, if you work for or with Freddie Mac (sometimes including Biometric Identifiers).
- As necessary or appropriate to protect the rights, property or safety of us, our customers or others.
- As required by applicable laws, regulations and court orders, and requests from Congress, our regulators, or our conservator.
- To respond to law enforcement requests.
- For security or the prevention, detection, or investigation of fraud, suspected or actual illegal activity, or other misconduct.
- To establish or defend legal claims and allegations.
- To seek advice from lawyers, auditors and other professional advisers.
- As described to you when collecting your personal information or as otherwise set forth in the CCPA.
We do not do the following things with your personal information:
- We do not sell personal information to third parties for advertising or marketing products and services to you, or to third parties whose purpose in acquiring the information is to sell your personal information to others for advertising or marketing purposes.
- We will not collect additional categories of personal information or use the personal information we collect for materially different, unrelated, or incompatible purposes without first providing you notice in the manner specified in the "Changes to this Notice" section of this Notice.
How We Share Personal Information
We may disclose your personal information to third parties for business-related purposes. Before we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient not to use or disclose the information except for purposes specified in the contract (typically to perform services for us).
In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:
- Category A: Identifiers.
- Category B: California Customer Records personal information categories.
- Category C: Protected classification characteristics under California or federal law.
- Category D: Commercial information.
- Category I: Professional or employment-related information.
- Category J: Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C.1232g, 34 C.F.R. Part 99)).
Third Parties to Whom We Disclose Personal Information
We disclose your personal information to the following categories of third parties:
- Service providers.
- Third parties to whom you or your agents authorize us to disclose your personal information in connection with activities we perform or services we provide to you or in connection with your loan.
- Third parties who assist us with this or our other websites, or our applications. This may include information you provide as part of voluntary surveys about application or website-related issues taken after visiting this site.
- Third parties as part of our secondary market-related activities and other aspects of our business, including to loan servicers, consumer reporting agencies, workout companies, attorneys, and technology providers who enable us or third parties to perform business, professional, and technical support functions for us or you. For example, we may disclose personal information to third parties to administer or protect our interest in a loan.
We also may disclose personal information to our regulators, our conservator, and as otherwise required by applicable laws, regulations and court orders.
In the twelve (12) months preceding the date of this Notice, we have not sold any personal information other than as specified in this Notice.
Your Rights and Choices under the CCPA
The CCPA provides California residents with specific rights regarding their personal information. This section describes consumers’ CCPA rights and explains how to exercise those rights.
Access to Specific Information and Data Portability Rights
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Before we disclose information to you, we will ask you for information to verify your identity. Once we receive and confirm your verifiable consumer request, we will disclose to you:
- The categories of personal information we collected about you.
- The categories of sources for the personal information we collected about you.
- Our business or commercial purpose for collecting or sharing that personal information.
- The categories of third parties with whom we share that personal information.
- If we disclosed your personal information for a business purpose, the business purpose and the categories of personal information that each category of recipient received.
Additionally, if you have requested it and have provided sufficient identifying information to enable us to do so, we will disclose the specific pieces of your personal information that we collected about you.
Please note that we may not disclose the information you have requested if we are unable to verify your identity. In addition, we may not disclose certain information that is covered by one or more of the exemptions from the CCPA, as outlined earlier in this Notice.
Deletion Request Rights
You have the right to request that we delete personal information that we collected and retained. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. If we deny your deletion request, we will inform you and explain the basis for our denial.
How to Exercise Your Access, Data Portability, and Deletion Rights
To exercise your rights described above, please submit a request to us by either:
- Calling us at 877-287-3831 or
- California Privacy Request
You must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to it. You may only make a request for access or data portability twice within any 12-month period.
Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a request related to your personal information. You may also make a request on behalf of your minor child.
As noted earlier in this Notice, we respond only to requests that are verifiable consumer requests. Therefore, when you submit a request to us, we will seek to verify your identity by asking you to provide us with information that enables us to identify you, such as your email address or the last four digits of your social security number. We also may use a third-party verification provider to verify your identity.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a request does not require you to create an account with us. We will only use personal information provided in a request to verify the requestor's identity or authority to make the request.
Response Timing and Format
We endeavor to respond to each verifiable consumer request within 45 days of its receipt. If we require more time, we will inform you of the reason and extension period in writing. If you already have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding our receipt of your verifiable consumer request. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
We will not discriminate against you for exercising any of your CCPA rights. Except to the extent permitted by the CCPA, we will not:
- Deny you goods or services.
- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
- Provide you a different level or quality of goods or services.
- Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
Changes to This Notice
We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will notify you by posting the updated Notice on our website homepage. Please be sure to check back periodically for any updates.
How to Contact Us
If you have any questions or comments about this Notice, our Privacy Statement, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:
Chief Privacy Officer
8200 Jones Branch Drive
McLean, Virginia 22102-3110
Or please contact us by sending an email to: [email protected]
Version Dated: February 25, 2022