No, they were NOT permitted to do that. The privacy act specifically prohibits disclosure of personal information on citizens maintained by one agency to either parties outside the government or other federal agencies (there are exceptions but none of them applied here).
No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains 5 U.S.C. § 552a(b).
Of course, the FAA doesn't give a rat's *** about complying with the Privacy Act. They violate it continually. I've been trying to get them to stop disseminating my information in violation of it for years.