IRSG
PRINCIPALS
(Individual Reference
Services Industry) |
 |
PREAMBLE:
The
following principles were developed by members of the individual
reference services industry to respond, as an industry, to
heightened interest in the industry's practices. The principles
represent good practices that the undersigned companies agree to
support as part of their operating practices. While it may take
up to a year for some principles to be implemented fully, other
principles are already part of the operating practices of the
undersigned companies.
SCOPE:
These principles apply to
individual reference services, which are commercial services
that directly or as suppliers to others provide information that
assists users in identifying individuals, verifying identities
and locating individuals for various purposes.
DEFINITIONS:
-
Public
Record Information: Information about or related to
an individual which has been obtained originally from the
records of a federal, state, or local governmental entity
that are open for public inspection.
-
Publicly
Available Information: Information about an
individual that is available to the general public from
non-governmental sources such as telephone directories,
classified ads, newspaper reports, publications, or other
forms of information.
-
Non-Public
Information: Information about an individual that is
of a private nature and neither available to the general
public nor obtained from a public record.
-
Appropriate
or Appropriately: Describes actions or uses that are
reasonable under the circumstances reflecting a balance
between the interests of individual privacy and legitimate
business, governmental, and personal uses of information,
including prevention and detection of fraud.
PRINCIPLES:
I. Education: Individual
reference services shall individually and through their industry
groups make reasonable efforts to educate users and the public
about privacy issues associated with their services, the types
of services they offer, these principles, and the benefits of
the responsible flow of information. These principles apply to
individual reference services, which are commercial services
that directly or as suppliers to others provide information that
assists users in identifying individuals, verifying identities
and locating individuals for various purposes.
II.
Reputable Sources: Individually identifiable
information shall be acquired from only sources known as
reputable in the government and private sectors.
A. Reasonable
measures shall be employed to understand an information source's
data collection practices and policies before accepting
information from that source.
B. Individually
identifiable information that is collected for marketing
purposes shall not knowingly be purchased, sold or retained for
creating or inclusion in individual reference services, unless
it is PUBLIC RECORD INFORMATION or PUBLICLY AVAILABLE
INFORMATION; its use is specifically permitted by law; or it is
collected with notice to the individual that such information
will be used for inclusion in individual reference service
products.
III.
Accuracy: Reasonable steps shall be taken to help
assure the accuracy of the information in individual reference
services. The goal of individual reference service products is
to furnish customers with accurate reproductions of information.
A.
When contacted by an individual concerning an alleged inaccuracy
about that individual, the individual reference service, as
APPROPRIATE, shall either correct any inaccuracy or inform the
individual of the source of the information and, if reasonably
available, where a request for correction may be directed.
B.
The individual reference service's commitment to furnish users
with reasonably accurate reproduction of information in PUBLIC
RECORD INFORMATION systems does not permit alteration of the
substantive content of PUBLIC RECORD INFORMATION products or
services.
IV.
Public Record and Publicly Available Information :
Except as provided in section IX, NON-PUBLIC INFORMATION will be
distributed only according to the criteria set forth below. The
nature of NON-PUBLIC INFORMATION being requested and the
intended uses of such information shall determine the level of
review of the subscriber. Companies who supply information
covered by this section to individual reference services shall
provide such information only to individual reference services
that adopt or comply with these principles.
V.
Distribution of Non-Public Information: PUBLIC
RECORD INFORMATION and PUBLICLY AVAILABLE INFORMATION shall be
usable without restriction unless legally prohibited.
A. Selective
and limited Distribution of Non-Public Information: Individual
reference services may distribute NON-PUBLIC INFORMATION without
restriction of its contents only to qualified subscribers.
1. Qualified subscribers for
the selective and limited distribution of NON-PUBLIC INFORMATION
must satisfy the following conditions:
a. The subscribers must state their
APPROPRIATE uses for such information.
b. The subscribers must agree to limit their
use and dissemination of such information to such APPROPRIATE
uses.
c. The subscribers shall be
reasonably identified and meet qualification requirements that
establish them as APPROPRIATE users of the information and agree
to terms and conditions consistent with these principles prior
to accessing the information.
2. Each individual reference
service shall take reasonable steps to protect against misuse of
NON-PUBLIC INFORMATION distributed pursuant to this subsection
which will include:
a. Each individual reference service shall
make available upon request an explanation of what uses of its
information are APPROPRIATE and to which types of qualified
subscribers such information is available.
b. Individual reference services shall conduct
a reasonable review of the subscriber and its intended uses of
the information prior to making NON-PUBLIC INFORMATION available
to the subscriber.
c. Individual reference services shall
maintain a record of the identity of subscribers, the types of
uses, and the terms and conditions agreed to by the subscriber
for three years after termination of each subscriber's
relationship with the individual reference service.
d. Reasonable measures shall be employed to
help assure that qualified subscribers use NON-PUBLIC
INFORMATION APPROPRIATELY.
e. Individual reference
services shall implement reasonable mechanisms to remedy
subscriber abuses of the information.
B. Commercial
and Professional Distribution of Non-Public Information: Individual
reference services, when they limit the NON-PUBLIC INFORMATION
content of their products or services as set forth below, may
distribute such products or services only to established
professional and commercial users who use the information in the
normal course and scope of their business or profession and the
use is APPROPRIATE for such activities.
1. NON-PUBLIC INFORMATION
products or services distributed pursuant to this subsection
shall not include:
a. Information that reflects credit history,
financial history, medical records, mother's maiden name
identified as such, or similar information;
b. Certain information like social security
number and birth information unless truncated in an APPROPRIATE
and industry consistent manner.
2.
Users shall agree to terms and conditions consistent with these
principles prior to accessing the NON-PUBLIC INFORMATION, shall
agree to use such information solely in the normal course and
scope of their business or profession and that the use is
APPROPRIATE for such activities and that they shall limit their
use and dissemination of such information to such uses and in
accordance with these principles.
3. Individual reference services shall take
reasonable steps to protect against misuse of the NON-PUBLIC
INFORMATION distributed pursuant to this subsection which will
include:
a. If not previously established, the
individual reference service shall take reasonable steps to
identify the user and to establish the user as an established
professional or commercial entity.
b. Reasonable measures shall be employed to
help assure that commercial and professional customers use
NON-PUBLIC INFORMATION APPROPRIATELY.
c. Individual reference services shall
implement reasonable mechanisms to remedy subscriber abuses of
the information.
d. Individual reference
services shall maintain a record of the identity of subscribers
and the terms and conditions agreed to by the subscriber for
three years after termination of each subscriber's relationship
with the individual reference service.
C. General
Distribution of Non-Public Information: Individual reference
services, when they limit the NON-PUBLIC INFORMATION content of
their products or services as set forth in this subparagraph,
may distribute such products or services to any person.
1. NON-PUBLIC INFORMATION distributed pursuant
to this subparagraph shall not knowingly include information
that reflects social security number, mother's maiden name
identified as such, non-published telephone number, or
non-published address information obtained from telephone
companies, birth information, credit history, financial history,
medical records, or similar information, nor will the service be
retrievable by a social security number.
2. The individual reference
service shall take reasonable steps to protect against the
misuse of NON-PUBLIC INFORMATION.
VI.
Security: Individual reference services shall
maintain facilities and systems to protect information from
unauthorized access and persons who may exceed their
authorization. In addition to physical and electronic security,
individual reference services shall reasonably implement:
A.
Employee and contractor supervisionEmployees and contractors
shall be required to sign confidentiality agreements and be
subject to supervision.
B.
ReviewsSystem reviews shall be made at APPROPRIATE intervals
to assure that employees are complying with policies.
VII.
Openness: Each individual reference service shall
have an information practices policy statement that describes
what types of information it has, from what types of sources,
how it is collected, the type of entities to whom it may be
disclosed and the type of uses to which it is put, and shall
make its policy statement available upon request. Consumers
shall be notified about these practices in various ways such as:
1.Web sites;
2. Advertisements; or
3. Company or
industry-initiated educational efforts.
VIII. Choice: Each
individual reference service shall upon request inform
individuals of the choices, if any, available to limit access or
use of information about them in its data base, provided,
however, that in the case of NON-PUBLIC INFORMATION distributed
to the general public (section V.C of these principles), an
individual reference service shall provide an opportunity for an
individual to limit the general public's access or use of such
NON-PUBLIC INFORMATION.
IX.
Access: Upon request and reasonable terms, an
individual reference service shall:
A. Inform an individual
about the nature of PUBLIC RECORD and PUBLICLY AVAILABLE
INFORMATION that it makes available in its products and services
and the sources of such information;
B.
Provide individuals with NON-PUBLIC INFORMATION contained in
products and services that specifically identifies them and that
are distributed as part of an individual reference service to
users under section V. of these Principles unless the
information was obtained on a limited use basis from a
governmental agency or if its disclosure is limited by law or
legally recognized privilege; and
C.
Direct individuals to a consumer reporting agency regulated by
the Fair Credit Reporting Act where such agency is the source of
the information about the individual.
X. Children: Where an
individual is identified in the product or service as being
under the age of 18, no NON-PUBLIC INFORMATION about that
individual shall be provided for other than selective and
limited distribution purposes or for the purposes of locating
missing children.
XI.
Assurance of Compliance: The signers of these
principles shall have completed within 15 months of the
effective date of these principles, and on a periodic basis
thereafter, at least once every year, an assurance review done
by a reasonably qualified independent professional service. The
independent professional service shall apply assurance criteria
consistent with these principles and approved by the signers as
a group. Individual reference services shall have a reasonable
opportunity to respond to any concerns expressed in such
assurance review. A summary reflecting both the [original]
report and any subsequent actions taken or response made by the
company shall be publicly available.
|
