1. Protection of CONSUMER information
PowerPoint Presentation
By Deanna Sabey, General Counsel
CITYWIDE HOME LOANS

2. PROTECTION OF CONSUMER INFORMATION
SUMMARY The security and integrity of consumer non-public personal information is important to Citywide. We take the protection of this information seriously, and expect our employees to take measures so the information is protected from any prohibited disclosure or improper use.
This presentation is designed to help you understand:
what “consumer non-public personal information” means,
what Citywide does to protect the information, and
what you are expected to do to help protect the information.
This presentation also explains what happens if there is an unintentional disclosure or a theft or conversion of protected information.

3. Protection of consumer personal information
GRAMM-LEACH-BLILEY ACT
What consumer information is protected?
Social security numbers
Account numbers
Driver’s license numbers
Bank statements
Financial information
W-2s
Employment information and verifications
Credit reports
Applications and any information provided in the applications
Credit scores
Any other information a consumer provides to obtain a residential mortgage loan
Non-public financial information
Protection of consumer personal information

4. Protection of consumer personal information
GRAMM-LEACH-BLILEY ACT
What is publicly available information?
Any information a lender has a reasonable basis to believe is legally available to the general public from:
federal, state, or local government records;
widely distributed media; or
disclosures to the general public required by law.
Examples: information found in a telephone book, information available on a website, information recorded in a county recorders office or court clerk’s office.
Protection of consumer personal information

5. GRAMM LEACH BLILEY ACT
Citywide Privacy Notice to Consumers
Permits disclosure of nonpublic personal information (protected consumer information) to:
a third party, but only when required in the normal course of business
(such as warehousing lenders, investors), and on a need-to-know basis;
regulatory authorities and law enforcement officials;
protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability;
report account activity to credit bureaus;
consumer reporting agencies; and
respond to a subpoena or court order, judicial process or regulatory authorities.

6. PROTECTION OF CONSUMER INFORMATION
What Citywide does to protect consumer information
Conducts criminal background checks on employees as part of the hiring process.
Prohibits employees from storing consumer non-public personal information on any personal or non-Citywide device.
Uses firewalls to protect and encrypt network communication.
Critical systems are backed up and stored at a secure, third-party vendor.
Servers are located in a locked room with restricted access.
Employees with remote access are required to use a VPN with encryption to access Citywide’s system.
Provides secure storage for hard-copy files.
Requires use of document shredding services.
Restricts access to systems.
Requires employees to follow password policy.
Conducts third party vendor due diligence and periodic review.

7. Protection of consumer information
Employee Actions to Protect Consumer Information
Avoid storing protected information on personal devices (laptop, smartphone, hard-drive, etc.) or in personal s. Devices can be stolen and s can be hacked.
Keep hard-copy documents in a locked cabinet or locked office.
Make sure guests are escorted to a location rather than let them walk through the office unattended.
Place discarded documents in a shredding bin.
Do not give passwords to any other person to use. You could be held responsible for what that person does with your password.
Only share protected information with third-parties as authorized by Citywide on a need-to-know basis in the normal course of business.
Make sure computer screen is locked while not in use to prevent unauthorized access/viewing.

8. What happens if protected information is accidentally disclosed?
Inform Citywide’s General Counsel. She will oversee the process to:
document the disclosure;
notify the consumer;
provide the consumer with information from the Federal Trade Commission instructing the consumer on how to take protective measures on credit reports;
give the consumer a designated Citywide employee’s contact information for any further questions; and
take measures to prevent further disclosure issues.

9. PROTECTING CONSUMER NON-PUBLIC INFORMATION
What if someone has taken protected information from Citywide?
Notify Citywide’s General Counsel.
Senior Management will then assess the nature and scope of the incident. If appropriate, Citywide will:
Notify appropriate law enforcement authorities.
Notify appropriate regulators.
Take measures to contain and control the incident.
Prevent further unauthorized access.
Notify customers when warranted.
PROTECTING CONSUMER NON-PUBLIC INFORMATION