The Privacy Act limits an agency's ability to disclose any record contained in a system of records to any person or another agency unless the disclosure is made at the written request of the individual to whom the record pertains, or that individual has given prior written consent to its disclosure.