Wherever this is legal for private companies (seemingly in a state of flux now) it has to be legal for the government too.
This is because we give the government an exclusive license on force.
This is part of the reason all sorts of government surveillance is structured as private companies that curate data with the goal of providing it to the Government. Companies are much more free to generate whatever databases they like, however they want. Government use then falls under the vague category of accessing "business records" which Congress ultimately doesn't seem to regulate much (except perhaps for medical records and wiretapping).