This is an aspect of credit reporting that irks many consumers and, IMHO, needs to be fought. As things stand now, it's a grey area. There's no law that explicitly says they can't pull your credit report, but I think they'd be hard-pressed to PROVE they had a legitimate need to do so.
If it's just one or two inquiries, I'd leave it be, but three is excessive.
- - - - in a credit-scoring postnuclear Stone Age...
To use the information in connection with a credit transaction involving the comsumer on whom the information is to be furnished and involving the extension of credit to, or review, or collection of an account of the consumer
This appears to mean that any collection company can pull your credit report at anytime without you even knowing it. They dont need your permission