The Privacy Act does apply to the records of every "individual," defined as "a citizen of the United States or an alien lawfully admitted for permanent residence" but the Privacy Act only applies to records held by an "agency".