Under the terms of the Privacy Act, there has to be an agreement or an arrangement. In the work that my office has been doing in the area of national security, we have noted that, over the past five years, there often has not been clearly defined parameters. Rather, we have seen informal exchanges whereas the legislation more or less says that the agreement needs to clearly define what can be exchanged and why. Informal exchanges that happen on the spur of the moment, without any forethought, can pose serious privacy risks.
On May 7th, 2009. See this statement in context.