They certainly can under one of the permissible purposes enumerated in the DPPA.