Public Data Use Checklist: Source and Licence Verification, Restriction Screening, Derived Work Analysis, Attribution Compliance, and Refresh Obligations

By Casey Scott McKay · 2024-02-22

This checklist audits a product built on public data, and it is organised around the four ways such businesses actually fail: a feed stops, a share-alike condition surfaces during diligence, an accuracy claim becomes a liability, or privacy regulation catches up with the aggregation. None of the four is prevented by a copyright opinion. The checklist starts with the provenance register and the acquisition route, then covers government work verification, portal terms read as contracts, restriction screening, the derived rights position, attribution propagation, refresh and accuracy obligations, per-state privacy analysis, the difficult source categories, and source dependency. Gate items mark where work should stop.

IP and Technology > General IP | Checklist | Published 22 February 2024 - Updated 19 June 2026 | Casey Scott McKay - marksy.us

Summary. This checklist audits a product built on public data, organised around the four ways such businesses actually fail: a feed stops, a share-alike condition surfaces during diligence, an accuracy claim becomes a liability, or privacy regulation catches up with the aggregation. None is prevented by a copyright opinion. It starts with the provenance register and the acquisition route, then covers government work verification, portal terms read as contracts, restriction screening, derived rights, attribution propagation, refresh and accuracy, per-state privacy analysis, the difficult source categories, and source dependency. Gate items mark where work should stop.

Keywords: public data checklist · provenance register · acquisition route · government work verification · portal terms · share-alike screening · licence compatibility · derived rights · attribution mechanism · refresh and accuracy · per-state privacy analysis · geospatial licensing · court records · incorporated standards · source dependency

How to use this checklist

| Phase | What it produces | Who runs it | Gate | |---|---|---|---| | 1. Register | Every source with its acquisition route | Counsel and engineering | Built from the warehouse, not from memory | | 2. Status | A government work answer per dataset | Counsel | Contractor and third-party material identified | | 3. Terms | Portal terms read as contracts | Counsel | Formation established per source | | 4. Screening | Share-alike and non-commercial findings | Counsel | Screened before the architecture is fixed | | 5. Ownership | An honest statement of what is owned | Counsel | Enrichment protected as secret | | 6. Attribution | A mechanism, not a line of copy | Product and counsel | Text in the product | | 7. Refresh | An accuracy and correction policy | Product and counsel | Staleness surfaced per dataset | | 8. Privacy | A per-state answer and a deletion process | Privacy counsel | Process before the first request | | 9. Hard categories | Separate reviews where warranted | Counsel | Court, geospatial, standards, training | | 10. Dependency | A quantified and disclosed exposure | Counsel and management | In the diligence file |

The matter. A company assembles property records, permits, and licensing data from four hundred municipal sources into a subscription product. A Series A closes in four months. The engineering team has been scraping whatever it could reach for three years, nobody has read a licence, and the product presents records about identifiable people as current.

Phase 1. Build the provenance register

[ ] Build it from the data warehouse, not from anyone's memory. Enumerate every table, file, and feed with the ingestion job that populated it.
- Why. Engineers know what they built recently and not what somebody built four years ago, and the ingestion code contains the answer more reliably than any person does.
[ ] Record the provider and dataset precisely enough that somebody else could find it.
[ ] Record the acquisition route per source — manual download from an open page, registered download, API access under an agreement, bulk delivery under a separate contract, purchase from an aggregator, automated collection, or a records request.
- Trap. These are five or six materially different legal positions and they are indistinguishable in the warehouse. It is the first question a customer's counsel asks and the hardest to answer three years later.
[ ] Record the licence and version, and retain the text, using archived versions of the page where necessary, since providers change terms and the version in force at acquisition governs.
[ ] Record the date obtained, which fixes which terms apply.
[ ] Record the attribution text required, verbatim.
[ ] Record the restrictions: redistribution, commercial use, derived products, volume, and territory.
[ ] Record any refresh obligation the licence imposes.
[ ] Flag every source describing identifiable individuals.
[ ] Expect a third of the sources to have no recorded acquisition route, and record honest gaps rather than assumed answers, since an acknowledged gap is far better in diligence than an assumption that turns out wrong.
[ ] Find the scrapers, which will exist, will be undocumented, and may have targeted sites with terms.
[ ] Gate new sources on a register row, or the register will need reconstructing again in three years.
[ ] [Gate] Nothing else in this checklist can be assessed until the sources are enumerated.

Phase 2. Verify government work status per dataset

[ ] Apply the exclusion correctly. 17 U.S.C. § 105 provides that copyright is not available for a work of the United States Government, defined in 17 U.S.C. § 101 as a work prepared by an officer or employee as part of official duties.
[ ] Check for contractor production.
- Trap. A contractor is neither an officer nor an employee, so a contractor deliverable published on a federal portal may be copyrighted and licensed rather than free, and the portal will not always say so.
[ ] Check for licensed-in third-party material, since agency reports routinely contain photographs, figures, and data licensed from publishers and imagery providers.
[ ] Do not extend the exclusion to state and local bodies, which take varying positions and frequently assert copyright selectively over mapping data, aerial imagery, and material with commercial value.
[ ] Treat foreign government works separately, since several jurisdictions assert Crown or state copyright as a matter of course.
[ ] Handle grantee output under the funding instrument, since university-produced datasets frequently carry institutional terms.
[ ] Note the edicts doctrine, under which judicial opinions, statutes, and regulations are uncopyrightable — extended in Georgia v. Public.Resource.Org, Inc. to annotations prepared by a legislature's official arm on the basis that the author is what matters.
[ ] Remember facts are free regardless of source, following Feist Publications, Inc. v. Rural Telephone Service Co., which rejected sweat of the brow and confined compilation protection to original selection and arrangement.
[ ] [Gate] No dataset is treated as public domain on assumption.

Phase 3. Read the terms of use as contracts

[ ] Establish whether a contract was formed per source. Clickwrap arrangements are routinely enforced; browsewrap frequently is not; and a business that downloaded from an open page without accepting anything is in a materially different position from one that registered for an API key.
[ ] Accept that the contract binds regardless of the copyright position, since a public domain dataset downloaded under terms prohibiting commercial redistribution is one the business agreed not to redistribute commercially.
[ ] Read bulk access agreements separately, since they carry tighter terms than the public interface as the price of the convenience.
[ ] Read each public sector licence properly rather than by name, since standard open licences come in versions with materially different conditions and public bodies publish bespoke terms that resemble standard ones without being them.
[ ] Find the grant: copy, publish, distribute, transmit, adapt, exploit commercially, combine. A grant omitting adaptation or commercial exploitation does not support a product.
[ ] Find the exclusions: personal data, third-party rights, logos and emblems, and material the provider does not itself own are routinely excluded, which means an openly licensed dataset may contain elements that are not.
[ ] Find the disclaimer and the termination provision.
- Trap. Most public sector licences disclaim accuracy entirely and terminate automatically on breach, which means an attribution failure can end the licence rather than merely breach it.
[ ] Check whether the licence is perpetual and what happens to material already obtained if the provider changes it or withdraws the dataset.
[ ] Assess the position where no agreement exists, since automated collection involves the site's terms if they bind, computer access law after the narrowing in Van Buren v. United States, and any technical measures deployed.
[ ] Interrogate aggregators, since a business buying from an intermediary inherits whatever the intermediary was permitted to grant and intermediaries routinely grant more than they hold.
[ ] Price the termination risk, since a provider that decides a reuser is placing undue load or misrepresenting the data may withdraw access with no remedy.
[ ] [Gate] No source is used commercially before its terms have been read in full.

Reading a public sector licence, clause by clause

Fifteen minutes per licence answers most of Phase 4, and the clauses are in a predictable order.

[ ] The definitions. What counts as "the Information," what counts as "a Derivative Work," and whether the definitions capture what the business is actually building. Two licences with identical operative clauses can produce opposite answers because their definitions differ.
[ ] The grant clause. Read the verbs. Copy, publish, distribute, transmit, adapt, exploit commercially, and combine with other information are separate permissions and a licence granting some is not granting all.
[ ] The conditions clause. Attribution in a specified form, the non-endorsement statement, share-alike, and any obligation to identify the source as the source.
[ ] The exclusions clause, which is where personal data, third-party rights, logos, emblems, and departmental identifiers are removed from the grant. An openly licensed dataset may contain elements outside the licence entirely.
[ ] The no-warranty clause, which in most public sector licences disclaims accuracy, currency, and fitness completely — meaning the reuser carries the accuracy risk that Phase 7 addresses.
[ ] The termination clause. Automatic termination on breach is standard, which converts an attribution failure into a licence failure and makes every downstream use unlicensed.
[ ] The governing law and version clauses, since licences are versioned and jurisdiction-specific and a business operating in several markets may be under several.
[ ] Retain the text as it stood at acquisition, using an archived copy where necessary, since providers revise their own terms without archiving the previous version.

Phase 4. Screen for the conditions that can break the product

[ ] Screen every source for share-alike conditions.
- Why. These require derived works to be released under the same licence, and a business that combined such a dataset into a proprietary product may be obliged to release the result. The finding does not need to be correct to destroy a transaction, only arguable.
[ ] Screen for non-commercial conditions, which appear in public sector and academic licences and are fatal to a commercial reuser who did not notice.
[ ] Check licence compatibility across combined sources, since two open licences may impose conditions that cannot both be satisfied in one derived work.
[ ] Check field-of-use and territory restrictions, which appear in imagery and commercial-adjacent public sector licences.
[ ] Check volume and rate limits, which are breached by an engineering decision nobody described as a legal one.
[ ] Check whether machine learning use is addressed, remembering that silence is not permission where the grant is of specified rights, and that the answer depends on the licence's structure.
[ ] Screen before the architecture is fixed, since a rebuild is cheap early and existential late.
[ ] Categorise findings by severity: a share-alike condition on a core source is existential; a non-commercial condition on a minor source is a removal; an unmet attribution obligation is a product change; a volume breach is a configuration.
[ ] Remove first, replace second, negotiate third, since removal is immediate and certain, replacement takes longer, and a bespoke licence from a public body takes longest and frequently fails because the body has no mechanism for it.
[ ] Consider re-obtaining under proper terms where data was scraped and the provider offers an API or bulk agreement, which converts an argument into a contract.
[ ] Do not launder. Deriving a clean dataset from a contaminated one does not clean it, and removing a source from the documentation while keeping the derived records creates a worse problem.
[ ] Document the remediation — what was found, decided, done, and when — since a disclosed finding with a remediation record is a demonstration of competence rather than a risk.
[ ] [Gate] No product architecture is fixed before the screening is complete.

Records requests as an acquisition route

[ ] Understand that a request produces records, not licences. Requests under 5 U.S.C. § 552 and state equivalents compel disclosure; they do not adjudicate copyright in what is disclosed, so a record containing third-party copyrighted material may be disclosed and still not be freely republishable.
[ ] Map the exemptions that will narrow production: confidential commercial information, personal privacy, deliberative material, and law enforcement.
[ ] Expect the reverse-request process, where a submitter objects to disclosure of its own material, which is where commercial data most often stays out.
[ ] Declare the correct fee category, since commercial requesters pay differently from news media and educational requesters and mischaracterisation is noticed once a pattern of requests emerges.
[ ] Anticipate the reaction to bulk requesting, since agencies treat repeated large requests as an abuse of the process and respond by restricting access or moving the material to a paid product — a worse outcome than paying commercial fees would have been.
[ ] Budget the labour of making records usable, since they arrive as scans, in inconsistent formats, and with redactions, and that labour is the enrichment layer the business actually owns.
[ ] Carry the privacy obligations forward, since records containing personal data do not become unregulated on disclosure.
[ ] Build the relationship with the records office, since a requester who is known, predictable, and reasonable gets better and faster responses than one who arrives as an unexplained volume.

Screening a combined product

Where the product assembles many sources, the compatibility question is not answered source by source and needs its own pass.

[ ] List the conditions imposed by every source in a single table, so that incompatible pairs are visible rather than latent.
[ ] Identify conditions that cannot coexist, since two open licences may each require derived works to be released under themselves — an obligation that cannot be satisfied simultaneously in one derived work.
[ ] Identify where combination creates a derived work of a share-alike source and where it does not, since the answer depends on the licence's own definitions rather than on general principle.
[ ] Segregate where the answer is unfavourable. A product that keeps a share-alike source in a separate, separately delivered layer may avoid the problem that combining it would create, and that is an architecture decision rather than a drafting one.
[ ] Check field-of-use and territory restrictions against the product's actual markets, since a licence permitting domestic use only is breached the day the product is sold abroad.
[ ] Check volume and rate limits against the ingestion configuration, since these are breached by an engineering decision nobody described as a legal one and the breach terminates the licence automatically under most public sector terms.
[ ] Re-run the pass after every remediation, since replacements bring their own conditions and the compatibility answer changes with the population.
[ ] Record the result as a document, not a conclusion, since a buyer's counsel will want to see the analysis rather than the assurance, and the analysis under 17 U.S.C. § 103 about what the compilation actually comprises is where the assurance comes from.

Phase 5. State honestly what the business owns

[ ] Not the underlying facts, however much work went into collecting them.
[ ] The selection and arrangement, thinly, where the choices involved genuine originality — an obvious ordering carries nothing.
[ ] The enrichment: classifications devised, links inferred, scores computed, and annotations written, which are contributions rather than reproductions.
[ ] The software, interface, documentation, and presentation, in the ordinary way.
[ ] Protect the enrichment as a trade secret on the terms 18 U.S.C. § 1839 requires — marking, access control, and terms specific to the methodology — since a claim over a methodology never marked or restricted fails on the reasonable measures element and takes the moat with it.
[ ] Register what is registrable where enforcement is contemplated, noting that a registration must issue before suit under 17 U.S.C. § 411 and that protection under 17 U.S.C. § 103 reaches the compilation's original elements rather than the underlying material.
[ ] Correct the pitch. A business telling investors it owns a dataset assembled from public sources is overstating, and a buyer's counsel will say so at a worse moment.
[ ] Describe the real moats accurately: accumulated corrections, matching methodology, update pipeline, customer integrations, and switching cost. They are genuine and they are not property.
[ ] [Gate] No investor or customer material describes the business as owning the underlying data.

Phase 6. Build the attribution mechanism

[ ] Extract the required text verbatim from each licence into the register.
[ ] Put it in the product rather than in a policy nobody reads, since the obligation is to attribute where the data appears.
[ ] Design for scale. Crediting one source is a line of copy; a product combining four hundred municipal datasets needs a mechanism — an attribution panel, a hover disclosure, or an about screen listing sources.
[ ] Solve the map problem specifically, since a rendered map at scale has nowhere obvious to put a credit and geospatial attribution conditions are ubiquitous and the most often breached.
[ ] Propagate downstream where the licence requires the business's own customers to be given notice, which several open licences do.
[ ] Include the non-endorsement statement where required, since many public sector licences oblige a reuser to state that the provider does not endorse the reuse.
[ ] Handle machine learning attribution honestly, since a licence requiring attribution wherever the data appears has no obvious application to model weights and nobody has a confident answer.
[ ] Audit the attributions annually, since sources are added by engineers and the credit list is maintained by nobody.
[ ] [Gate] No source ships in the product without its attribution text in place.

Phase 7. Write the refresh and accuracy policy

[ ] State the currency of every dataset in the product, since presenting stale data as current is a representation about accuracy actionable under 15 U.S.C. § 1125 where a competitor is harmed and under consumer protection law otherwise.
[ ] Build a correction pipeline.
- Why. The source corrects a record and the derived product does not, which means the business publishes something it knows to be wrong about an identifiable person or entity — a defamation and consumer protection problem the copyright analysis never addressed.
[ ] Propagate deletions, since a source that removes a record — sometimes for legal reasons — leaves a downstream product republishing material the source was required to withdraw.
[ ] Meet licence currency conditions, since some public sector terms oblige a reuser to update within a period or stop representing the data as sourced from the provider.
[ ] Set a staleness threshold per dataset and surface it, since a register updated weekly is wrong within days and users make decisions on it.
[ ] Plan for format changes, which break pipelines on the provider's schedule rather than the reuser's.
[ ] Keep a cached historical corpus where the licence permits, since discontinuation happens and a business dependent on a live feed with no history has nothing when it stops — and where retention is prohibited, know that and price the dependency accordingly.
[ ] [Gate] No record about an identifiable person publishes without a correction and deletion path.

Phase 8. Run the privacy analysis per state

[ ] Separate the disclosure question from the use question, since an agency compelled to disclose has answered a transparency obligation and the recipient's use is governed by whatever regime applies to the recipient.
[ ] Run a per-state analysis rather than a general one.
- Trap. Comprehensive state privacy statutes contain exemptions for publicly available information whose scope varies materially — some exempt information lawfully made available from government records broadly, others narrowly — and a national product needs an answer per state rather than a conclusion.
[ ] Assess the aggregation, since individually innocuous records combined into a profile create something the source disclosure never contemplated and this is the pattern that attracts regulatory attention.
[ ] Check sector-specific regimes, since court records containing health information, criminal history data, and records concerning minors are subject to rules that publication by a court does not displace.
[ ] Check whether the product's use is itself regulated, particularly where outputs inform decisions about credit, employment, insurance, or housing.
[ ] Assess re-identification risk where de-identified public datasets are combined, since the technical possibility is what regulators examine rather than the intention.
[ ] Build the downstream deletion and correction process before the first request, since a person who persuaded the source to remove a record will approach the reuser next and a business with no process handles each request differently.
[ ] Note the records request route separately, since federal requests under 5 U.S.C. § 552 and state equivalents compel disclosure without adjudicating copyright or removing privacy obligations.
[ ] Check the fee category where the business requests records, since commercial requesters pay differently and mischaracterisation is noticed once a pattern emerges.
[ ] [Gate] No state is entered before its exemption scope has been assessed.

Phase 9. Give the hard categories their own review

Court records.

[ ] Treat opinions as free and the publisher's apparatus as not, since headnotes, syllabi, and editorial classifications involve authorship.
[ ] Read the court system's access terms, since access runs through court systems with their own fees and bulk agreements rather than through general records statutes.
[ ] Honour sealing and redaction downstream, since a filing sealed or redacted after publication creates an obligation for a reuser holding the earlier version.
[ ] Expect extensive personal information in filings, protected by redaction rules the filing party may have ignored.

Geospatial data.

[ ] Treat federal imagery and base mapping as generally free where produced by federal employees.
[ ] Treat state and municipal parcel, address, and aerial data as licensed, since local governments commissioned it at real cost and many treat it as a revenue asset.
[ ] Check whether contractor-produced surveys were assigned to the commissioning body, since municipal contracts frequently did not.
[ ] Distinguish coordinates from cartography, since coordinate data is factual and selection, generalisation, symbology, and labelling involve authorship.
[ ] Read imagery licences in full for resolution, territory, term, derived products, and redistribution, since providers enforce them actively.

Standards incorporated by reference.

[ ] Recognise the unresolved position, where a standard adopted by regulation binds the regulated public while remaining the standards body's copyrighted work.
[ ] Quote rather than reproduce, since quoting is ordinarily defensible under 17 U.S.C. § 107 and wholesale reproduction is contested.
[ ] Check which edition the regulation incorporated, since the body's current version is a different document with its own position and price.

Training data.

[ ] Apply the same provenance discipline, since facts are free for training as for anything else, contract does not disappear, and whether a model trained on a share-alike dataset is a derived work is unresolved.
[ ] Prefer clean government sources and document their status, since a register showing every training source with its licence and acquisition date is worth more to a buyer than any opinion.
[ ] [Gate] No hard-category source is used before its own review is complete.

Phase 10. Price and disclose the source dependency

[ ] Identify the critical sources, meaning those whose loss would materially degrade the product.
[ ] Answer in writing what happens if each stops, since discontinuation, format change, movement behind a paid interface, and withdrawal from commercial reusers all happen and usually without notice.
[ ] Assess substitutability honestly, since some public datasets have no alternative and a business dependent on one has a single point of failure it did not price.
[ ] Diversify where possible, since a product drawing the same field from three sources degrades rather than fails.
[ ] Maintain the provider relationships. A requester who is known, predictable, and reasonable gets better responses, and an agency deciding whether to restrict a commercial reuser decides differently about one it has spoken to. It costs nothing and it is the only warning the business gets.
[ ] Disclose the dependency in diligence rather than letting a buyer discover it, since an identified and priced dependency is a negotiating point and an unidentified one is a discount.
[ ] Assemble the diligence file: the register, the government work assessments, the screening results, the remediation record, the attribution audit, the accuracy policy, the per-state privacy analysis, and the dependency assessment.
[ ] [Gate] The file is assembled before the round opens, not during it.

Advising the supply side

Where the client publishes rather than reuses — an agency, a contractor delivering to one, a grantee, or a non-profit — the questions are the mirror image and the mistakes are different.

[ ] Establish what a contractor is delivering. Data rights clauses in government contracts determine whether the agency receives unlimited rights, government purpose rights, or a limited licence, and the categories are prescribed rather than negotiable in standard forms.
[ ] Apply restrictive legends at delivery, in the prescribed form.
- Trap. Marking is the mechanism and it is unforgiving. Material delivered unmarked carries the default rights whatever the contract said, and the omission surfaces years later during a re-compete when the agency supplies the contractor's own data to a competitor.
[ ] Check the funding instrument for grantees, since it governs rather than the government work exclusion and university-produced datasets frequently carry institutional terms.
[ ] Advise an agency choosing a licence on what each option forecloses. A share-alike condition forecloses commercial reuse in ways the agency may not intend; no statement at all produces cautious under-use by exactly the reusers the agency wanted; and asserting copyright where the federal exclusion applies is wrong and will be pointed out publicly.
[ ] Note that state bodies have a genuine choice, since the federal exclusion does not bind them and each option has consequences worth understanding before deciding.
[ ] Draft attribution conditions to be satisfiable, since a requirement to credit in a specified form on every screen is unusable by a product combining hundreds of sources and produces non-compliance rather than compliance.
[ ] Clear third-party material before publishing a dataset, since agencies do this inadvertently with imagery and figures more often than with anything else.

A note on order

The phases are ordered by dependency, and the ordering matters because the instinct is to start in the wrong place.

Clients arrive worried about privacy, because privacy is the topic that generates headlines, or about copyright, because copyright is what "intellectual property" means to a board. Both are real and neither can be assessed first: a privacy analysis requires knowing which sources contain personal data, and a copyright position requires knowing which datasets are government works. Both questions are answered by the register, which is why the register is Phase 1 and why it has a gate that stops everything else.

The register is also the phase that takes longest, is least interesting, and requires engineering time the business would rather spend elsewhere. Expect resistance and expect the resistance to be strongest from the people whose undocumented ingestion jobs the exercise will surface.

Government work status and terms follow because they are the inputs to screening. Screening precedes the ownership discussion because what the business owns depends on what it was permitted to build.

Attribution, refresh, and privacy are product changes with engineering cost, which is why they sit after the analysis and why they should be scheduled rather than requested.

The hard categories at Phase 9 are placed late because most products touch only one or two, and a business touching none can skip it — while a business touching court records or geospatial data should have started there.

Dependency is last because it is the phase that produces no compliance artefact and the greatest commercial insight, and it is the one most likely to be dropped when the diligence deadline approaches. It should not be: of the four ways these businesses fail, a source stopping is the one nothing else on this list addresses.

[ ] Confirm the enrichment layer is actually protected as a secret, with the methodology marked, access limited by role, and contractor terms specific to it, since 18 U.S.C. § 1839 makes reasonable measures an element and an unmarked methodology on a shared drive fails it.
[ ] Check whether any output of the product is itself registrable and whether registration has been made, remembering that 17 U.S.C. § 411 requires a registration to issue before suit.
[ ] Confirm insurance cover reaches the accuracy and privacy exposures, since general liability policies commonly exclude both and this sector's likeliest claims sit in exactly those categories.

Outcome. A business that has run this checklist can tell a buyer where every field in its product came from, under what terms, obtained how and when; can show that it screened for the two conditions that would have required a rebuild and remediated what it found; can demonstrate an attribution mechanism and a correction pipeline; and can say what happens if its largest source stops. None of those is a copyright opinion, and all four of the ways these businesses fail are addressed by them.

Key Authorities at a Glance

| Authority | What it settles | Phase | |---|---|---| | 17 U.S.C. § 105 | No copyright in works of the United States Government | 2 | | 17 U.S.C. § 101 | Definition of a work of the United States Government | 2 | | Feist Publications, Inc. v. Rural Telephone Service Co. | Facts unprotectable; no sweat of the brow | 2, 5 | | Georgia v. Public.Resource.Org, Inc. | Government edicts doctrine extends to official annotations | 2, 9 | | 17 U.S.C. § 102 | Subject matter of copyright | 5 | | 17 U.S.C. § 103 | Compilations and derivative works | 5 | | 17 U.S.C. § 106 | Exclusive rights | 4 | | 17 U.S.C. § 107 | Fair use | 9 | | 17 U.S.C. § 411 | Registration as a precondition to suit | 5 | | 17 U.S.C. § 201 | Ownership and transfer | 2 | | 17 U.S.C. § 512 | Notice and takedown | 7 | | 5 U.S.C. § 552 | Federal records access, exemptions, and fees | 8 | | Van Buren v. United States | Narrow reading of exceeding authorized access | 3 | | 18 U.S.C. § 1839 | Reasonable measures element of trade secret status | 5 | | 15 U.S.C. § 1125 | False designation of origin and false advertising | 7 |

The five things people get wrong

One: assuming public means free. Federal government works are outside copyright and almost nothing else in the register is covered by that rule. Contractor deliverables, licensed-in third-party material, state and municipal datasets, foreign government works, and grantee output are all outside it, and the portal that published them will not say which is which. The verification is dataset by dataset and there is no shortcut.

Two: looking for the restrictions in copyright. They are in contract. A public domain dataset downloaded under terms prohibiting commercial redistribution is a dataset the business agreed not to redistribute, and no amount of analysis about the copyright position answers that. Most public sector licences also disclaim accuracy entirely and terminate automatically on breach, which means an attribution failure ends the licence rather than merely breaching it.

Three: never recording how the data was obtained. Manual download, registered access, bulk agreement, purchase from an aggregator, scraping, and records request are materially different positions and they look identical in the warehouse. The question is asked in the first diligence session, and the answer has to be reconstructed from ingestion code because nobody wrote it down.

Four: discovering a share-alike condition after the architecture is fixed. Screened early it is a source removal; discovered during a funding round it is an argument about whether the proprietary product must be released, and the argument does not have to be right to end the transaction. The same screening costs a fortnight before the product and a quarter afterwards.

Five: treating accuracy as somebody else's problem. The product presents records about identifiable people, the source corrects one, the product does not, and the business is now publishing something it knows to be wrong about a named individual. That is the exposure most likely to produce an actual claim in this sector, it is entirely preventable with a correction pipeline, and it appears nowhere in a copyright opinion.