The Privacy Act applies to all “records” as that term is defined in § 700.257(d), which the Commission maintains in a “system of records,” as that term is defined in § 700.257(e).