You may only run consumer reports on individuals where you have a legitimate business need and appropriate authority, such as customer consent or another lawful basis. All searches must align with your declared use case, and the individual must have given consent for the search to be carried out.