• Rules from the Privacy Act:
  • 5 USC Section 552a(a)(7) -
    • requires Routine Uses to be compatible with the purpose for which it was collected
    • "the term 'routine use' means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected"
  • 5 USC Section 552a(b) -
    • states the conditions for disclosure
      • "(b) Conditions of disclosure. No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be--"
      • for a Routine Use
        • "(3) for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D) of this section;"
      • to a US entity for authorized civil or criminal law enforcement, if the head of the entity specifically requests the record
        • "(7) to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought"
  • 5 USC Section 552a(e)(2)
    • requires agencies to collect information directly from subject where practicable
    • "collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal program;"

I couldn't find a court case that directly addresses the question in our scenario.

This is not unusual.

I searched Lexis for federal cases mentioning 5 USC 552a and reviewed the 138 results.

The following three seem most relevant:

• F&H Barge Corporation v. D&H Corp., 46 F. Supp. 2nd 453 (E.D.Va. 1998)
  • in dicta, cites Pilon v. U.S. Dep't of Justice, 315 U.S. App. D.C. 329, 73 F.3d 1111, 1112 (D.C. Cir. 1996) for the propositions:
    • Privacy Act creates a private cause of action for damages or other relief
      • against a government agency
      • for wilfull or intentional disclosure
      • K note: this is not the "holding" since the case is not about a claim against the government
  • Cites Doe v. DiGenova, 250 U.S. App. D.C. 274, 779 F.2d 74, 85 note 21 (D.C. Cir. 1985) for the propositions:
    • Privacy Act does not serve as an evidentiary exclusionary rule
      • does not bar the discovery and use of the information between private litigants
      • K note: this would be part of the "holding"

• Doe v. DiGenova, 250 U.S. App. D.C. 274, 779 F.2d 74 (D.C. Cir. 1985)
  • holding a grand jury subpoena as insufficient to warrant transfer (dissemination) of information
    • because an Assistant US Attorney can issue it
    • indicating that the (b)(7) method of obtaining records requires the head of the agency to make the request
    • indicating that (b)(3) Routine Uses issued after the event in dispute are not relevant
    • deciding this does not meet (b)(11) "pursuant to the order of a court of competent jurisdiction" even though it's "under the authority of a court"

• Cardamone v. Cohen, 241 F.3d 520 (6th Cir. 2001)
  • cites Hudson v. Reno, 130 F.3d 1193, 1198 (6th Cir. 1997), cert. denied, 525 U.S. 822, 142 L. Ed. 2d 50, 119 S. Ct. 64 (1998)
    • for the proposition that 5 USC 552a(e)(2) does not require an agency to seek information from a person directly in certain types of investigations
    • "when conducting an investigation into a particular person, third party sources may be contacted first when practical considerations, such as confirming or denying false statements, require this or when the information can only be obtained from third parties".