We are a mortgage company that is captive to a home builder. When configuring our Privacy Notice, the following questions arose:

The builder sales contract states that information, such as the borrowers' transactions and creditworthiness, is shared between the mortgage company (us) and them. Our current Privacy Notice also states that we share this and that the borrower can limit this info sharing. It is our understanding that Federal law dictates sharing can be limited but, what is the difference between 'transaction and experience' v 'creditworthiness'? If we let the builder know that an applicant has been declined, does that fall under 'creditworthiness'? If the borrower opts to limit sharing and they are declined, how do we communicate the declination to the builder? Can the builder contract, which is signed by the applicant and states the type of info that will be shared, supersede the borrowers ability to limit info sharing?

Any insight would be appreciated!

Wouldn't the builder find out from the borrower?

Not necessarily, and if the borrower does share that info, it may not be until months down the road when the home was already well into the construction process. It would be ideal if everyone communicated openly with the builder about their financing, but I could see some folks waiting until weeks before their move in date to start shopping around for a new lender.