Playing by the Privacy Act rules