Who is responsible for a mortgage entity's proper disposal of personal information?

• A. The LO
• B. The compliance officer
• C. The IT department
• D. The PLM

Answer: (D)

Attributions for handling personal information are tied to who owns the organization's privacy and risk-management program. The PLM (Principal Lending Manager) is responsible for overseeing lending operations risk and regulatory compliance, including how personal data is protected and disposed of. This role ensures there are written policies and procedures for the secure destruction of both physical records and electronic data, assigns accountability, trains staff, and coordinates with IT and compliance to enact those policies. In practice, IT may perform the actual destruction, but it’s the PLM’s responsibility to establish the program, ensure it’s followed, and hold the organization accountable for proper disposal.

The other roles don’t own the program in the same way. A loan officer focuses on originating loans, not firm-wide data destruction policies. The compliance officer oversees regulatory compliance more broadly but implements the program under the PLM’s governance. The IT department executes technical tasks, including disposal methods, under the guidance of the PLM.