Even if you are protected by a regulation that requires that permission, would anyone be surprised to discover that firms like Equifax have failed to obey that regulation? They constantly fail to do required things that don't happen to contribute to profits.