Understanding FCRA and privacy laws what you can and cannot do starts with one principle compliance teams use to reduce avoidable risk: purpose drives obligations. The legal and ethical risk is determined primarily by how information is used to make a decision, not merely whether it was “public.” The same fact pattern can be low-risk in an informational context and high-risk in an eligibility context.