Consumer privacy (Reg P) and permissible purpose (FCRA) are really two different things. Providing the information to a potential purchaser is governed under a proper agreement for the purchasers not to further share the information, you should be OK under Regulation P, like any other vendor. If the participants were going to pull their own credit reports, they would need a permissible purpose under the FCRA. Since they are not engaged directly with the consumer, they would not have one.
_________________________
The opinions expressed here should not be construed to be those of my employer:
PPDocs.com