Just to clarify, Jennifer has informed me that the Privacy Act does not explicitly address metadata, because it was done in 1983, but that metadata does meet the definition of personal information in the act, so it would apply in terms of that.
On November 24th, 2016. See this statement in context.