This PRIVACY NOTICE FOR CALIFORNIA RESIDENTS supplements the information contained in the Privacy Statement of the FEDERAL HOME LOAN MORTGAGE CORPORATION ("Freddie Mac," "we," "us," or "our") and applies solely to those individuals who reside in the State of California ("consumers" or "you"). We are issuing this Notice in compliance with the California Consumer Privacy Act of 2018 ("CCPA") and other applicable California privacy laws. Any terms used in this Notice that are not defined in the Notice itself have the same definition as used in the CCPA.
Definition of Personal Information
We collect certain "personal information" from consumers. The CCPA defines personal information as information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household or device. Personal information does not include:
What Personal Information We Collect
We have collected the following categories of personal information from consumers within the last twelve (12) months:
|A. Identifiers.||Real name, alias, postal address, personal and work phone number, unique personal identifier, online identifier, Internet Protocol address, personal photograph/image, personal and work email address, account name, Social Security number, driver's license number, passport number, and other similar identifiers.||YES|
|B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).||Name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.||YES|
|C. Protected classification characteristics under California or federal law.||Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).||YES|
|D. Commercial information.||Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.||YES|
|E. Biometric information.||Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.||YES|
|F. Internet or similar network activity.||Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.||YES|
|G. Geolocation data.||Physical location or movements.||NO|
|H. Sensory data.||Audio, electronic, visual, thermal, olfactory, or similar information.||YES|
|I. Professional or employment-related information.||Current or past job history, responsibilities, memberships or performance evaluations, national identification information, travel-related records, background check and screening results, references, EEOC monitoring information (ethnicity, religion, gender and sexual orientation).||YES|
|J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).||Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.||YES|
|K. Inferences drawn from other personal information.||Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.||NO|
Categories of Sources
We obtain the categories of personal information listed above:
How We Use Personal Information
We may use or disclose personal information we collect for one or more of the following business purposes:
We do not do the following things with your personal information:
How We Share Personal Information
We may disclose your personal information to third parties for business-related purposes. Before we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient not to use or disclose the information except for purposes specified in the contract (typically to perform services for us).
In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:
Third Parties to Whom We Disclose Personal Information
We disclose your personal information to the following categories of third parties:
We also may disclose personal information to our regulators, our conservator, and as otherwise required by applicable laws, regulations and court orders.
In the twelve (12) months preceding the date of this Notice, we have not sold any personal information other than as specified in this Notice.
Your Rights and Choices under the CCPA
The CCPA provides California residents with specific rights regarding their personal information. This section describes consumers’ CCPA rights and explains how to exercise those rights.
Access to Specific Information and Data Portability Rights
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Before we disclose information to you, we will ask you for information to verify your identity. Once we receive and confirm your verifiable consumer request, we will disclose to you:
Additionally, if you have requested it and have provided sufficient identifying information to enable us to do so, we will disclose the specific pieces of your personal information that we collected about you.
Please note that we may not disclose the information you have requested if we are unable to verify your identity. In addition, we may not disclose certain information that is covered by one or more of the exemptions from the CCPA, as outlined earlier in this Notice.
Deletion Request Rights
You have the right to request that we delete personal information that we collected and retained. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. If we deny your deletion request, we will inform you and explain the basis for our denial.
How to Exercise Your Access, Data Portability, and Deletion Rights
To exercise your rights described above, please submit a request to us by either:
You must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to it. You may only make a request for access or data portability twice within any 12-month period.
Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a request related to your personal information. You may also make a request on behalf of your minor child.
As noted earlier in this Notice, we respond only to requests that are verifiable consumer requests. Therefore, when you submit a request to us, we will seek to verify your identity by asking you to provide us with information that enables us to identify you, such as your email address or the last four digits of your social security number. We also may use a third-party verification provider to verify your identity.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a request does not require you to create an account with us. We will only use personal information provided in a request to verify the requestor's identity or authority to make the request.
Response Timing and Format
We endeavor to respond to each verifiable consumer request within 45 days of its receipt. If we require more time, we will inform you of the reason and extension period in writing. If you already have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding our receipt of your verifiable consumer request. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
We will not discriminate against you for exercising any of your CCPA rights. Except to the extent permitted by the CCPA, we will not:
Changes to This Notice
We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will notify you by posting the updated Notice on our website homepage. Please be sure to check back periodically for any updates.
How to Contact Us
If you have any questions or comments about this Notice, our Privacy Statement, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:
Chief Privacy Officer
8200 Jones Branch Drive
McLean, Virginia 22102-3110
Or please contact us by sending an email to: firstname.lastname@example.org
Version Dated: June 11, 2020