2/N There are plenty of exclusions in the Privacy Act of 1974, mostly having to do with law enforcement and national security. But there is certainly an open question whether the DHS/DOJ database on that USB stick is being used for such a purpose.
It is easy for an individual to file a Privacy Act claim - it only takes a letter.
However, agencies like to try to avoid the rather strict requirements of the Privacy Act with the less stringent obligations of the Freedom of Information Act - The PA is 5 USC 552a and FOIA is 5 USC 552 - that little 'a' at the end makes a world of difference.
I am considering making a Privacy Act claim about that USB-stick database. If I do I will post my letter.
If any of you do pursue Privacy Act, and I hope you do, make sure that you call out in huge letters that you are making a Privacy Act claim - 5 USC 552a - and *NOT* a FOIA request, 5 USC 552.