100%. Lots of gray area here in "shouldn't", "illegal", "can't", etc.
That's why, in my experience, I think TheWorkNumber has a pretty good and individual-centric approach. I have to explicitly grant access to that data on a per-request basis with some form of one-time key that I provide to the requestor.
Compare that to a credit check, where ("if you're lucky") you sign something saying you're aware of and approve the request, but without any sort of real technical control.
That's why, in my experience, I think TheWorkNumber has a pretty good and individual-centric approach. I have to explicitly grant access to that data on a per-request basis with some form of one-time key that I provide to the requestor.
Compare that to a credit check, where ("if you're lucky") you sign something saying you're aware of and approve the request, but without any sort of real technical control.