Are you investigating a potential breach of section 7 of the Privacy Act? Section 7 states:
Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be used by the institution except
(a) for the purpose for which the information was obtained....