Or, you can just make the data private by default and assume any violations are by default "irregular".

We do this already with health care providers, attorneys, crediting agencies, banks, etc.