usc 15 § 1681e

Every consumer reporting agency shall maintain reasonable procedures designed to avoid violations of  and to limit the furnishing of consumer reports to the purposes listed under . These procedures shall require that prospective users of the information identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose. Every consumer reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by such prospective user prior to furnishing such user a consumer report. No consumer reporting agency may furnish a consumer report to any person if it has reasonable grounds for believing that the consumer report will not be used for a purpose listed in .

Whenever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.

A consumer reporting agency may not prohibit a user of a consumer report furnished by the agency on a consumer from disclosing the contents of the report to the consumer, if adverse action against the consumer has been taken by the user based in whole or in part on the report.

A consumer reporting agency shall provide to any person—

who regularly and in the ordinary course of business furnishes information to the agency with respect to any consumer; or

to whom a consumer report is provided by the agency;

The Bureau shall prescribe the content of notices under paragraph (1), and a consumer reporting agency shall be in compliance with this subsection if it provides a notice under paragraph (1) that is substantially similar to the Bureau prescription under this paragraph.

A person may not procure a consumer report for purposes of reselling the report (or any information in the report) unless the person discloses to the consumer reporting agency that originally furnishes the report—

the identity of the end-user of the report (or information); and

each permissible purpose under  for which the report is furnished to the end-user of the report (or information).

A person who procures a consumer report for purposes of reselling the report (or any information in the report) shall—

establish and comply with reasonable procedures designed to ensure that the report (or information) is resold by the person only for a purpose for which the report may be furnished under , including by requiring that each person to which the report (or information) is resold and that resells or provides the report (or information) to any other person—

identifies each end user of the resold report (or information);

certifies each purpose for which the report (or information) will be used; and

certifies that the report (or information) will be used for no other purpose; and

before reselling the report, make reasonable efforts to verify the identifications and certifications made under subparagraph (A).

Notwithstanding paragraph (1) or (2), a person who procures a consumer report for purposes of reselling the report (or any information in the report) shall not disclose the identity of the end-user of the report under paragraph (1) or (2) if—

the end user is an agency or department of the United States Government which procures the report from the person for purposes of determining the eligibility of the consumer concerned to receive access or continued access to classified information (as defined in section 1681b(b)(4)(E)(i)  of this title); and

the agency or department certifies in writing to the person reselling the report that nondisclosure is necessary to protect classified information or the safety of persons employed by or contracting with, or undergoing investigation for work or contracting with the agency or department.