|
PRINCIPLES:
I. Education: Individual reference
services shall individually and through their industry groups make
reasonable efforts to educate users and the public about privacy issues
associated with their services, the types of services they offer, these
principles, and the benefits of the responsible flow of information.
These principles apply to individual reference services, which are
commercial services that directly or as suppliers to others provide
information that assists users in identifying individuals, verifying
identities and locating individuals for various purposes.
II. Reputable
Sources: Individually
identifiable information shall be acquired from only sources known as
reputable in the government and private sectors.
-
A.
Reasonable
measures shall be employed to understand an information source's
data collection practices and policies before accepting information
from that source.
-
B. Individually
identifiable information that is collected for marketing purposes
shall not knowingly be purchased, sold or retained for creating or
inclusion in individual reference services, unless it is PUBLIC
RECORD INFORMATION or PUBLICLY AVAILABLE INFORMATION; its
use is specifically permitted by law; or it is collected with notice
to the individual that such information will be used for inclusion
in individual reference service products.
III. Accuracy:
Reasonable steps shall be
taken to help assure the accuracy of the information in individual
reference services. The goal of individual reference service products is
to furnish customers with accurate reproductions of information.
-
A. When
contacted by an individual concerning an alleged inaccuracy about
that individual, the individual reference service, as APPROPRIATE,
shall either correct any
inaccuracy or inform the individual of the source of the information
and, if reasonably available, where a request for correction may be
directed.
-
B. The
individual reference service's commitment to furnish users with
reasonably accurate reproduction of information in PUBLIC
RECORD INFORMATION systems
does not permit alteration of the substantive content of PUBLIC
RECORD INFORMATION products
or services.
IV. Public
Record and Publicly Available Information : Except
as provided in section IX, NON-PUBLIC INFORMATION will
be distributed only according to the criteria set forth below. The
nature of NON-PUBLIC
INFORMATION being requested
and the intended uses of such information shall determine the level of
review of the subscriber. Companies who supply information covered by
this section to individual reference services shall provide such
information only to individual reference services that adopt or comply
with these principles.
V. Distribution
of Non-Public Information: PUBLIC
RECORD INFORMATION and PUBLICLY AVAILABLE INFORMATION shall
be usable without restriction unless legally prohibited.
-
A. Selective
and Limited Distribution of Non-Public Information: Individual
reference services may distribute NON-PUBLIC INFORMATION without
restriction of its contents only to qualified subscribers.
-
1. Qualified subscribers for the
selective and limited distribution of NON-PUBLIC INFORMATION must satisfy the following
conditions:
-
a. The subscribers must state
their APPROPRIATE uses
for such information.
b. The subscribers must agree
to limit their use and re-dissemination of such information to
such APPROPRIATE uses.
c.
The subscribers shall be
reasonably identified and meet qualification requirements that
establish them as APPROPRIATE
users of the
information and agree to terms and conditions consistent with
these principles prior to accessing the information.
2. Each individual reference service
shall take reasonable steps to protect against misuse of NON-PUBLIC
INFORMATION distributed
pursuant to this subsection which will include:
-
a. Each individual reference
service shall make available upon request an explanation of what
uses of its information are APPROPRIATE and
to which types of qualified subscribers such information is
available.
b.
Individual reference
services shall conduct a reasonable review of the subscriber and
its intended uses of the information prior to making NON-PUBLIC
INFORMATION available
to the subscriber.
c.
Individual reference
services shall maintain a record of the identity of subscribers,
the types of uses, and the terms and conditions agreed to by the
subscriber for three years after termination of each
subscriber's relationship with the individual reference service.
d.
Reasonable measures shall be
employed to help assure that qualified subscribers use
NON-PUBLIC INFORMATION APPROPRIATELY.
e. Individual reference services
shall implement reasonable mechanisms to remedy subscriber
abuses of the information.
-
B. Commercial
and Professional Distribution of Non-Public Information: Individual reference services,
when they limit the NON-PUBLIC
INFORMATION content of their products or services as set forth
below, may distribute such products or services only to established
professional and commercial users who use the information in the
normal course and scope of their business or profession and the use
is APPROPRIATE for such
activities.
-
1. NON-PUBLIC INFORMATION
products or services
distributed pursuant to this subsection shall not include:
-
a.
Information that reflects
credit history, financial history, medical records, mother's
maiden name identified as such, or similar information;
b.
Certain information like
social security number and birth information unless truncated in
an APPROPRIATE and
industry consistent
manner.
2.
Users shall agree to terms and
conditions consistent with these principles prior to accessing the NON-PUBLIC INFORMATION, shall
agree to use such information solely in the normal course and scope
of their business or profession and that the use is APPROPRIATE
for such activities and
that they shall limit their use and re-dissemination of such
information to such uses and in accordance with these principles.
3. Individual reference services
shall take reasonable steps to protect against misuse of the
NON-PUBLIC INFORMATION distributed pursuant to this subsection which
will include:
-
a.
If not previously
established, the individual reference service shall take
reasonable steps to identify the user and to establish the user
as an established professional or commercial entity.
b.
Reasonable measures shall be
employed to help assure that commercial and professional
customers use NON-PUBLIC INFORMATION APPROPRIATELY.
c.
Individual reference
services shall implement reasonable mechanisms to remedy
subscriber abuses of the information.
d.
Individual reference
services shall maintain a record of the identity of subscribers
and the terms and conditions agreed to by the subscriber for
three years after termination of each subscriber's relationship
with the individual reference service.
-
C. General
Distribution of Non-Public Information: Individual
reference services, when they limit the NON-PUBLIC INFORMATION
content of their products or services as set forth in this
subparagraph, may distribute such products or services to any
person.
-
1.
NON-PUBLIC INFORMATION
distributed pursuant to this subparagraph shall not knowingly
include information that reflects social security number, mother's
maiden name identified as such, non-published telephone number, or
non-published address information obtained from telephone
companies, birth information, credit history, financial history,
medical records, or similar information, nor will the service be
retrievable by a social security number.
2.
The individual reference
service shall take reasonable steps to protect against the misuse
of NON-PUBLIC INFORMATION.
VI. Security : Individual
reference services shall maintain facilities and systems to protect
information from unauthorized access and persons who may exceed their
authorization. In addition to physical and electronic security,
individual reference services shall reasonably implement:
-
A.
Employee
and contractor supervisionEmployees and contractors shall be
required to sign confidentiality agreements and be subject to
supervision.
-
B. ReviewsSystem
reviews shall be made at APPROPRIATE intervals to assure that
employees are complying with policies.
VII. Openness:
Each individual reference
service shall have an information practices policy statement that
describes what types of information it has, from what types of sources,
how it is collected, the type of entities to whom it may be disclosed
and the type of uses to which it is put, and shall make its policy
statement available upon request. Consumers shall be notified about
these practices in various ways such as:
-
1. Web sites;
2. Advertisements; or
3. Company or industry-initiated
educational efforts.
VIII. Choice:
Each individual reference
service shall upon request inform individuals of the choices, if any,
available to limit access or use of information about them in its data
base, provided, however, that in the case of NON-PUBLIC INFORMATION
distributed to the general public (section V.C of these principles), an
individual reference service shall provide an opportunity for an
individual to limit the general public's access or use of such
NON-PUBLIC INFORMATION.
IX. Access:
Upon request and
reasonable terms, an individual reference service shall:
-
A. Inform
an individual about the nature of PUBLIC RECORD and PUBLICLY
AVAILABLE INFORMATION that it makes available in its products and
services and the sources of such information;
-
B.
Provide
individuals with NON-PUBLIC INFORMATION contained in products and
services that specifically identifies them and that are distributed
as part of an individual reference service to users under section V.
of these Principles unless the information was obtained on a limited
use basis from a governmental agency or if its disclosure is limited
by law or legally recognized privilege; and
-
C. Direct
individuals to a consumer reporting agency regulated by the Fair
Credit Reporting Act where such agency is the source of the
information about the individual.
X. Children:
Where an individual is
identified in the product or service as being under the age of 18, no
NON-PUBLIC INFORMATION about that individual shall be provided for other
than selective and limited distribution purposes or for the purposes of
locating missing children.
XI. Assurance
of Compliance: The
signers of these principles shall have completed within 15 months of the
effective date of these principles, and on a periodic basis thereafter,
at least once every year, an assurance review done by a reasonably
qualified independent professional service. The independent professional
service shall apply assurance criteria consistent with these principles
and approved by the signers as a group. Individual reference services
shall have a reasonable opportunity to respond to any concerns expressed
in such assurance review. A summary reflecting both the [original]
report and any subsequent actions taken or response made by the company
shall be publicly available.
|