I didn't say it was illegal. And I won't give a reference without a signed authorization, either.
Call it best practice if it makes you feel better. But I'm not giving out salary information or verifying addresses to someone that I can't confirm is entitled to have that information.

