Privacy laws and 30-, 60-, 90-days late lists

[Brian K.]

I've read in several places that it's the credit bureaus that provide list companies with 30-, 60-, 90-days late data. What do the (privacy-related) laws say and what do the bureaus do to create these data that makes this distribution legal? (How do they avoid running afoul of privacy laws?) Are there organizations other than the bureaus that can determine these data?