According to the Gramm Leach Bliley Act of 1999, financial institutions must follow certain rules created by the Federal Trade Commission on protecting the privacy of personal data. The rules say that credit reporting agencies cannot resell and reuse credit information obtained from financial institutions unless the individuals are informed that their data has been passed to such agencies and have been given an opportunity to object.
The First Amendment challenge to these rules failed and the court found that they were lawful under the 1999 Act.