Under the provisions of the Privacy Act, 5 U.S.C. 552a, civil and criminal penalties may be assessed.