The Privacy Act states in part:
"No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains...."
There are specific exceptions for the record allowing the use of personal records:
The Privacy Act mandates that each United States Government agency have in place an administrative and physical security system to prevent the unauthorized release of personal records.
For more information, visit:
Federal Privacy Act of 1974 Overview, Department of Justice
Federal Privacy Act of 1974, Federal Trade Commission