… defunct program for flagging “sensitive” patent applications for extra review violated the Privacy Act.