It's unfortunate the Privacy Act included an exception for law enforcement. I imagine at the time it wasn't clear that every action taken by the govt would be called law enforcement.

There is an ethical framework for handling personal data collected and maintained by the US govt called the Fair Information Practice Principles (https://www.fpc.gov/resources/fipps/).

It really is too bad that "any legal purpose" is the stated boundary for our elected govt rather than a more noble appeal to public service.

Laws aren't the problem here. If the data exists it will be abused, if not by the government then by corrupt insiders.