PREAMBLE:

The following principles were developed by members of the individual reference services industry to respond, as an industry, to heightened interest in the industry's practices. The principles represent good practices that the undersigned companies agree to support as part of their operating practices. While it may take up to a year for some principles to be implemented fully, other principles are already part of the operating practices of the undersigned companies.

SCOPE:

These principles apply to individual reference services, which are commercial services that directly or as suppliers to others provide information that assists users in identifying individuals, verifying identities and locating individuals for various purposes.

DEFINITIONS:

• Public Record Information: Information about or related to an individual which has been obtained originally from the records of a federal, state, or local governmental entity that are open for public inspection.

• Publicly Available Information: Information about an individual that is available to the general public from non-governmental sources such as telephone directories, classified ads, newspaper reports, publications, or other forms of information.

• Non-Public Information: Information about an individual that is of a private nature and neither available to the general public nor obtained from a public record.

• Appropriate or Appropriately: Describes actions or uses that are reasonable under the circumstances reflecting a balance between the interests of individual privacy and legitimate business, governmental, and personal uses of information, including prevention and detection of fraud.

PRINCIPLES:

I. Education: Individual reference services shall individually and through their industry groups make reasonable efforts to educate users and the public about privacy issues associated with their services, the types of services they offer, these principles, and the benefits of the responsible flow of information. These principles apply to individual reference services, which are commercial services that directly or as suppliers to others provide information that assists users in identifying individuals, verifying identities and locating individuals for various purposes.
             
II. Reputable Sources: Individually identifiable information shall be acquired from only sources known as reputable in the government and private sectors.

A. Reasonable measures shall be employed to understand an information source's data collection practices and policies before accepting information from that source.

B. Individually identifiable information that is collected for marketing purposes shall not knowingly be purchased, sold or retained for creating or inclusion in individual reference services, unless it is PUBLIC RECORD INFORMATION or PUBLICLY AVAILABLE INFORMATION; its use is specifically permitted by law; or it is collected with notice to the individual that such information will be used for inclusion in individual reference service products.
    

III. Accuracy: Reasonable steps shall be taken to help assure the accuracy of the information in individual reference services. The goal of individual reference service products is to furnish customers with accurate reproductions of information.
            

A. When contacted by an individual concerning an alleged inaccuracy about that individual, the individual reference service, as APPROPRIATE, shall either correct any inaccuracy or inform the individual of the source of the information and, if reasonably available, where a request for correction may be directed.

B. The individual reference service's commitment to furnish users with reasonably accurate reproduction of information in PUBLIC RECORD INFORMATION systems does not permit alteration of the substantive content of PUBLIC RECORD INFORMATION products or services.
      

IV. Public Record and Publicly Available Information : Except as provided in section IX, NON-PUBLIC INFORMATION will be distributed only according to the criteria set forth below. The nature of NON-PUBLIC INFORMATION being requested and the intended uses of such information shall determine the level of review of the subscriber. Companies who supply information covered by this section to individual reference services shall provide such information only to individual reference services that adopt or comply with these principles.
            

V. Distribution of Non-Public Information: PUBLIC RECORD INFORMATION and PUBLICLY AVAILABLE INFORMATION shall be usable without restriction unless legally prohibited.
          

A. Selective and limited Distribution of Non-Public Information: Individual reference services may distribute NON-PUBLIC INFORMATION without restriction of its contents only to qualified subscribers.

1. Qualified subscribers for the selective and limited distribution of NON-PUBLIC INFORMATION must satisfy the following conditions:

a. The subscribers must state their APPROPRIATE uses for such information.

b. The subscribers must agree to limit their use and dissemination of such information to such APPROPRIATE uses.

c. The subscribers shall be reasonably identified and meet qualification requirements that establish them as APPROPRIATE users of the information and agree to terms and conditions consistent with these principles prior to accessing the information.

                       
2. Each individual reference service shall take reasonable steps to protect against misuse of NON-PUBLIC INFORMATION distributed pursuant to this subsection which will include:

a. Each individual reference service shall make available upon request an explanation of what uses of its information are APPROPRIATE and to which types of qualified subscribers such information is available.

b. Individual reference services shall conduct a reasonable review of the subscriber and its intended uses of the information prior to making NON-PUBLIC INFORMATION available to the subscriber.

c. Individual reference services shall maintain a record of the identity of subscribers, the types of uses, and the terms and conditions agreed to by the subscriber for three years after termination of each subscriber's relationship with the individual reference service.

d. Reasonable measures shall be employed to help assure that qualified subscribers use NON-PUBLIC INFORMATION APPROPRIATELY.

e. Individual reference services shall implement reasonable mechanisms to remedy subscriber abuses of the information.

                     
B. Commercial and Professional Distribution of Non-Public Information: Individual reference services, when they limit the NON-PUBLIC INFORMATION content of their products or services as set forth below, may distribute such products or services only to established professional and commercial users who use the information in the normal course and scope of their business or profession and the use is APPROPRIATE for such activities.

1. NON-PUBLIC INFORMATION products or services distributed pursuant to this subsection shall not include:

a. Information that reflects credit history, financial history, medical records, mother's maiden name identified as such, or similar information;

b. Certain information like social security number and birth information unless truncated in an APPROPRIATE and industry consistent manner.

 2. Users shall agree to terms and conditions consistent with these principles prior to accessing the NON-PUBLIC INFORMATION, shall agree to use such information solely in the normal course and scope of their business or profession and that the use is APPROPRIATE for such activities and that they shall limit their use and dissemination of such information to such uses and in accordance with these principles.

3. Individual reference services shall take reasonable steps to protect against misuse of the NON-PUBLIC INFORMATION distributed pursuant to this subsection which will include:

a. If not previously established, the individual reference service shall take reasonable steps to identify the user and to establish the user as an established professional or commercial entity.

b. Reasonable measures shall be employed to help assure that commercial and professional customers use NON-PUBLIC INFORMATION APPROPRIATELY.

c. Individual reference services shall implement reasonable mechanisms to remedy subscriber abuses of the information.

d. Individual reference services shall maintain a record of the identity of subscribers and the terms and conditions agreed to by the subscriber for three years after termination of each subscriber's relationship with the individual reference service.

C. General Distribution of Non-Public Information: Individual reference services, when they limit the NON-PUBLIC INFORMATION content of their products or services as set forth in this subparagraph, may distribute such products or services to any person.

1. NON-PUBLIC INFORMATION distributed pursuant to this subparagraph shall not knowingly include information that reflects social security number, mother's maiden name identified as such, non-published telephone number, or non-published address information obtained from telephone companies, birth information, credit history, financial history, medical records, or similar information, nor will the service be retrievable by a social security number.

2. The individual reference service shall take reasonable steps to protect against the misuse of NON-PUBLIC INFORMATION.
                 

VI. Security: Individual reference services shall maintain facilities and systems to protect information from unauthorized access and persons who may exceed their authorization. In addition to physical and electronic security, individual reference services shall reasonably implement:
        

A. Employee and contractor supervision­Employees and contractors shall be required to sign confidentiality agreements and be subject to supervision.

B. Reviews­System reviews shall be made at APPROPRIATE intervals to assure that employees are complying with policies.
           

VII. Openness: Each individual reference service shall have an information practices policy statement that describes what types of information it has, from what types of sources, how it is collected, the type of entities to whom it may be disclosed and the type of uses to which it is put, and shall make its policy statement available upon request. Consumers shall be notified about these practices in various ways such as:
               

1.Web sites;

2. Advertisements; or

3. Company or industry-initiated educational efforts.
              

VIII.  Choice: Each individual reference service shall upon request inform individuals of the choices, if any, available to limit access or use of information about them in its data base, provided, however, that in the case of NON-PUBLIC INFORMATION distributed to the general public (section V.C of these principles), an individual reference service shall provide an opportunity for an individual to limit the general public's access or use of such NON-PUBLIC INFORMATION.  
    
IX.  Access: Upon request and reasonable terms, an individual reference service shall:  
              

A. Inform an individual about the nature of PUBLIC RECORD and PUBLICLY AVAILABLE INFORMATION that it makes available in its products and services and the sources of such information;

B. Provide individuals with NON-PUBLIC INFORMATION contained in products and services that specifically identifies them and that are distributed as part of an individual reference service to users under section V. of these Principles unless the information was obtained on a limited use basis from a governmental agency or if its disclosure is limited by law or legally recognized privilege; and

C. Direct individuals to a consumer reporting agency regulated by the Fair Credit Reporting Act where such agency is the source of the information about the individual.  

X.  Children: Where an individual is identified in the product or service as being under the age of 18, no NON-PUBLIC INFORMATION about that individual shall be provided for other than selective and limited distribution purposes or for the purposes of locating missing children.    
                 
XI.  Assurance of Compliance: The signers of these principles shall have completed within 15 months of the effective date of these principles, and on a periodic basis thereafter, at least once every year, an assurance review done by a reasonably qualified independent professional service. The independent professional service shall apply assurance criteria consistent with these principles and approved by the signers as a group. Individual reference services shall have a reasonable opportunity to respond to any concerns expressed in such assurance review. A summary reflecting both the [original] report and any subsequent actions taken or response made by the company shall be publicly available.