[snowwrestler]

I think a U.S. citizen can file a request for records about themself via the Privacy Act. As I understand it, FOIA allows anyone to ask for anything; Privacy Act allows one person to ask for information about themselves.

I don't know if CISA also prevents Privacy Act requests, or if it only applies to FOIA.

Theoretically, companies using CISA would anonymize personally identifiable information before sharing to the government. An IP address, for example, is probably not PII (as millions of people have pointed out in the context of digital piracy lawsuits). I doubt one could file a Privacy Act request just based on an IP address.

[dsp1234]

It specifically mentions "552(b)(3)(B) of title 5" which is the FOIA statute. No mention of the privacy act.