Although the specific fact patterns of three different cases heard by the Ninth Circuit, the Seventh Circuit, and the Fourth Circuit, respectively, led to nuanced differences between their holdings, all three cases stated that an agency can exempt itself by properly promulgating rules to that effect.
FORBES: Should Government Agencies Be Able To Exempt Themselves From The Privacy Act?