complying with privacy rules when managing a request for post closing data

This happens infrequently but enough that it warrants a post.  I received a request from a consulting company who is performing a post closing audit.  In this case they are performing the audit for a private mortgage insurance company.

Presented as evidence of the authority to make the request is the typical quality control authorization signed by most borrowers at closing.  By signing the form the borrower grants permission to the lender to reverify application data.  It specifies that the lender may present the form to any party named in the loan application.

The consulting company making the request for private data is not the lender.  My title agency is not a party named in the loan application.  The form presented no basis under which I might release this private information and so the request was denied.

It's not that we don't want to be helpful.  We do.  If the proper document had been presented I would have provided a pdf response tout suite.  I do have the information this individual seeks.  It is sensitive and very private - the type of information the consumer may even be surprised to know I have in my file.  Even so, I am a guardian and take that job seriously.