The applicable provision here is the Data Protection Act.
Whoever is going to provide you with the information/data will firstly need to be registered under the Data Protection Act and secondly will also need to have the consent to share the data with you, from whoever they got the data from or from each of the individuals if it is individuals data. Ultimately, the individual must consent even if that consent gets passed down the line from data provided to data provider.
It is the point you have made in the first paragraph of your question with regard to the user excepting terms and conditions. Make sure that they have to click to accept your terms and conditions and that they are easily viewable, before they proceed.
You cannot use an email address provided by your user if that email address is of a third party unless that third party has consented.
You would also need to be registered with the Information Commissioner under the provisions of the Data Protection Act. It is not difficult and from memory, the fee is one £40 per annum.
Can I clarify anything for you?
Please rate the service positive. It’s an important part of the process by which experts get paid.
It does not cost you anything but helped me greatly.
If there is information/data on that client, they have to give consent to have their personal details (even just name) given out. They don’t need to consent if the review is completely anonymous if they could not be identified from it.
I haven’t got a clue about the United States but there is a legal section on Just Answer where you can ask the same question of a US attorney