New 2257 Compliance Guide

[softball]

Originally Posted by LizAEBN

I actually just had a conversation about this internally for Canadian producer concerns.

This clause:
4.5 Principle 5 — Limiting Use, Disclosure, and Retention
Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.

seems to indicate that if the information is collected for the purpose of age verification, that can be used as applicable for those particular business purposes. Additionally, the model release could be worded to proactively outline those purposes. Also, certain personally identifying information can be redacted from submitted data.

Here is the dilemma for Canadians and Europeans. It is against the law to disclose any private information of employees to anyone. If the FBI comes calling outside the US, they are just plain people with no more authority than any normal person. Extraterratoriality is anathema to any free country. Imagine if the Nigerian secret police demanded information on a US citizen from their employer. All hell would break loose. So 4.5 Principle 5 is unenforcable outside the US.