A military judge convicted the appellant, pursuant to his pleas, of eight specifications of larceny of military property of a value of more than $500.00 and nine specifications of larceny of military property of a value of $500.00 or less, in violation of Article 121, Uniform Code of Military Justice, 10 U.S.C. § 921. Officer and enlisted members, sitting as a general court-martial, sentenced the appellant to a bad-conduct discharge and reduction to pay grade E-5. The convening authority approved the sentence.
Before entering pleas, the appellant moved to suppress financial information about himself that he alleged the Government obtained in violation of his “right to privacy.” He also moved to suppress his confession, claiming it was the fruit of the Government’s unlawful search and seizure of his financial information. The military judge denied both motions, and the appellant entered conditional guilty pleas, with the consent of the Government, to the Charge and its 17 specifications. Under Rule For Courts-Martial 910(a)(2), Manual For Courts-Martial, United States (2000 ed.), these conditional pleas preserved the appellant’s right to review the military judge’s adverse determinations on his motions to suppress his confession and *698the financial information obtained by the Government.
The appellant now raises the following three assignments of error: (1) the Government’s conduct in unlawfully obtaining his financial information was so outrageous that dismissal of the charges is warranted under the Due Process Clause of the Fifth Amendment; (2) the military judge erred when he denied the defense motion to suppress the appellant’s bank records; and (3) the military judge erred when he found that the Naval Criminal Investigative Service (NCIS) investigator was performing his assigned duties when he obtained the appellant’s financial records from the Defense Finance & Accounting Service (DFAS) and Personnel Support Detachment (PSD), and, therefore, held that the release of the appellant’s financial records to investigators was not a Privacy Act violation warranting suppression of those records. The third assignment of error was raised pursuant to United States v. Grostefon, 12 M.J. 431 (C.M.A.1982).
We have carefully considered the record of trial, the appellant’s three assignments of error, and the Government’s response. We conclude that the findings and sentence are correct in law and in fact and that no error materially prejudicial to the substantial rights of the appellant was committed. Arts. 59(a) and 66(c), UCMJ, 10 U.S.C. §§ 859(a) and 866(c).
Background
The appellant was stationed aboard USS MOOSBRUGGER (DD 980), homeported at Naval Station, Mayport, Florida, where he worked as an independent duty disbursing clerk. In November 1999, the appellant began submitting false travel claims to DFAS, using the names and social security numbers of active duty U.S. Navy personnel. Between November 1999 and March 2000, he submitted 17 false claims in this manner, using the name and social security number of a different Sailor on each claim. The payments for these false claims were electronically deposited directly into the appellant’s account at Navy Federal Credit Union (NFCU).
Between December 2000 and January 2001, NCIS at Naval Station, Mayport, began investigating another independent duty disbursing clerk, Disbursing Clerk First Class (DK1) P. In the course of this investigation, Senior Chief Master-at-Arms (MACS) C.A. Park, working as an NCIS investigator, interviewed DK1 P. During the interview, DK1 P explained that he had successfully submitted false claims for about $60,000.00 by taking advantage of weaknesses inherent in the travel claims processing system.
After interviewing DK1 P, NCIS began an operation to identify possible thefts of funds by other independent duty disbursing clerks at Mayport. MACS Park sent a lead to an NCIS agent stationed near the DFAS Cleveland Site, the worldwide center for Navy pay operations. That agent requested and obtained a DFAS report containing what MACS Park testified were “records for all [permanent change of station] funds, [temporary additional duty] funds that was [sic] paid out by all the ships in the basin.” Record at 27. The report consisted, in part, of the Unit Identification Code (UIC) of each ship homeported in Mayport, as well as the social security numbers, bank account numbers, and routing transit numbers (RTNs) of each servicemember who received payments. The report also indicated payments that were made, identifying them by ship’s UIC. Upon examining that portion of the report containing a record of payments made under the USS MOOSBRUGGER’s UIC, MACS Park discovered that one bank account had received 17 separate payments, each of which was associated with a different social security number.
MACS Park then contacted a disbursing officer at PSD Mayport, and asked him to identify the independent duty disbursing clerks stationed on the USS MOOSBRUG-GER and provide the numbers of the bank accounts into which they received direct deposits of funds. After the disbursing officer identified the appellant as the owner of the NFCU account into which the 17 separate travel payments had been deposited by DFAS, MACS Park asked a contact at the local Florida State Attorney’s Office to subpoena the appellant’s NFCU account rec*699ords.1 After obtaining the records, and determining that the payments for all 17 travel claims had been deposited into the appellant’s account, MACS Park and an NCIS agent interviewed the appellant. When confronted with the DFAS report and his NFCU account records, the appellant confessed to fraudulently obtaining funds.
Appellant’s Motion To Suppress
At trial, the appellant moved to “suppress all of the financial information obtained by the [G]overnment in violation of [the appellant’s] right to privacy and to suppress [the appellant's] confession because it is the fruit of the [Government's unlawful search and seizure of [the appellant’s] financial information.” Appellate Exhibit I at ¶ 1. The appellant specifically asserted that all financial information pertaining to him, both from DFAS and NFCU, should be suppressed. Id. at ¶4. In the alternative, he asked the court to bar the Government from introducing the records from his NFCU account until it “adequately complied with the provisions” of the Right to Financial Privacy Act, 12 U.S.C. §§ 8401-3422. Id.
In his motion to suppress, the appellant claimed that the DFAS records were obtained by NCIS in violation of the Privacy Act of 1974, 5 U.S.C. § 552a. The military judge found that MACS Park was in the performance of his assigned duties as a Department of Defense official when he obtained these records from DFAS and, therefore, no Privacy Act violation occurred. He denied the appellant’s motion to suppress these records.
The appellant claimed that his NFCU records were obtained in violation of the Right to Financial Privacy Act. Citing our superior court’s opinion in United States v. Wooten, 34 M.J. 141 (C.M.A.1992), the military judge ruled that civil remedies under the Right to Financial Privacy Act are exclusive, and that evidence obtained in violation thereof is not subject to suppression at a court-martial. The military judge denied the appellant’s motion to suppress his NFCU account records, and similarly denied the appellant’s motion to suppress his confession.
Privacy Act
We will first address the appellant’s third assignment of error, that the military judge erred by holding that the release of the appellant’s financial records to investigators was not a Privacy Act violation warranting suppression of these records because the NCIS investigator was performing his assigned duties when he obtained the records.
We review a military judge’s ruling on a motion to suppress evidence for an abuse of discretion. United States v. Ayala, 43 M.J. 296, 298 (C.A.A.F.1995). In doing so, we must determine whether the military judge’s findings of fact are clearly erroneous or the conclusions of law are incorrect. Id. We review de novo the question of whether the military judge “correctly applied the law.” Id. We are required to consider the evidence “in the light most favorable” to the “prevailing party.” United States v. Reister, 44 M.J. 409, 413 (C.A.A.F.1996). The appellant may challenge the validity of the search for evidence only if he can assert: (1) “a subjective expectation of privacy,” and, (2) that the expectation of privacy is also “objectively reasonable.” United States v. Monroe, 52 M.J. 326, 330 (C.A.A.F.2000)(citing Minnesota v. Olson, 495 U.S. 91, 95, 110 S.Ct. 1684, 109 L.Ed.2d 85 (1990)).
Based on our review of the record, we conclude that the findings of fact are not clearly erroneous and are supported by the record. Accordingly, we adopt them as our own. We also conclude that the military judge correctly applied the law. Because we hold that the information in question does not fall within the definition of a “system of records,” we need not determine whether the NCIS investigator was in the performance of his duties.
*700Under the Privacy Act, agencies that maintain a “system of records” must, upon establishment or revision, publish notice of the existence and character of the “system of records” in the Federal Register. 5 U.S.C. § 552a(e)(4). A “system of records” is a group of records under the control of an agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. See id. at § 552a(a)(5). The Privacy Act defines “record” as:
any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voice print or a photograph.
Id. at § 552a(a)(4)(emphases added).
The Court of Appeals for the District of Columbia Circuit, which has universal venue under the Privacy Act, has adopted a narrow construction of the term “record,” holding that in order to qualify as a “record,” an item must satisfy two requirements.
First, in order to qualify as a record, information must be “about” an individual. Second, in addition to being “about” an individual, the information must contain the individual’s name or other identifying particular. The second requirement leads to an obvious conclusion about the first: the fact that information contains an individual’s name does not mean that the information is “about” the individual. If it did, the first requirement would be surplusage.
Tobey v. NLRB, 40 F.3d 469, 471 (D.C.Cir.1994).
In Tobey, the D.C. Circuit held that a National Labor Relations Board (NLRB) computer system called the Case Handling Information Processing System (CHIPS), used for tracking and monitoring unfair labor practice and representation case data, was not a system of records “about” the appellant in that case. Tobey, 40 F.3d at 471-73. The court reached this result despite the fact that the NLRB computer system contained case names, allegations made, dates of significant events, and the initials or identifying number of the field examiner assigned to each individual ease recorded in the system. Tobey worked for the NLRB as a field examiner. Id. at 470.
In reaching its decision, the court was aware that experienced users of the NLRB computer system could, by using field examiners’ initials, retrieve files on cases assigned to individual examiners and evaluate the timeliness or efficiency with which those examiners processed cases. Tobey, 40 F.3d at 470. Gaming access to this information would then enable a user to evaluate an individual field examiner’s ability to meet time goals, one of the critical elements used by the NLRB to evaluate a field examiner’s job performance. Id.
Even though data within the NLRB computer system could be used to gain information about individual NLRB employees, the D.G. Circuit concluded that the NLRB computer system was not a system of records about Tobey or other individual field examiners. “In so holding, we do not ignore To-be/s assertion that NLRB employees could use data from CHIPS in combination with other information to draw inferences about his job performance, as Solien [an NLRB employee] apparently did. That possibility, however, does not transform the CHIPS files into records about field examiners.” Id. at 473. The court ultimately affirmed the judgment of the district court dismissing Tobey’s action. Id.
We find the information in the records obtained from DFAS to be analogous to the data at issue in Tobey. The spreadsheet in Appellate Exhibit III lists the social security numbers of individual claimants, payment codes, RCB codes (not defined in the record), payee codes, settlement dates, settlement amounts, the UIC of the USS MOOSBRUG-GER, RTN’s, and bank account numbers. Although the appellant’s bank account number appears 17 times on the spreadsheet, the spreadsheet is clearly not a record about the appellant. It does not contain the appellant’s name or identifying particular (e.g., his social *701security number), and does not describe him in any way. The fact that one might, through the use of other information, be able to identify the appellant as the owner of a particular bank account listed on the spreadsheet does not transform the spreadsheet into a record about him. Therefore, release of the spreadsheet to NCIS did not violate the appellant’s rights under the Privacy Act.
Similarly, the 17 Automated Miscellaneous Vouchers (AE IV, AE X, Prosecution Exhibit 1), which reflect the purported travel claims of 17 different individuals, are not records about the appellant. As with the DFAS spreadsheet, the only information about the appellant contained in these vouchers is his NFCU account number. Most of the remaining information consists of descriptive data about the individual claims to which the vouchers pertain. The vouchers also contain the names and social security numbers of the individual payees. They do not, however, contain the appellant’s name or social security number. Therefore, they are not records about the appellant, and their release did not violate his Privacy Act rights.
Moreover, because the DFAS spreadsheet and the Automated Miscellaneous Vouchers are not about the appellant, he lacks standing to oppose their release. Rights under the Privacy Act are personal to the subject of the record. They cannot be asserted derivatively by third parties, including a criminal defendant. See, e.g., Word v. United States, 604 F.2d 1127, 1129 (8th Cir.l979)(holding that the exclusionary rule is available only to the person whose constitutional rights were violated in the gathering of challenged evidence; the remedy for violation of the Privacy Act is vested by statute in the individual whose records were improperly released, not in a third party criminal defendant against whom the records are used). We conclude that the appellant’s third assignment of error lacks merit.2
Right to Financial Privacy Act
The appellant’s second assignment of error is his claim that the military judge erred when he determined that suppression of the appellant’s bank records was not required by the Right to Financial Privacy Act. In denying the appellant’s motion to suppress, the military judge concluded that the appellant’s NFCU account records were obtained in violation of the Right to Financial Privacy Act. Record at 162.
In denying the appellant’s motion to suppress his NFCU account records, the military judge concluded that the Government’s violation of the Right to Financial Privacy Act did not amount to a violation of the appellant’s Fourth Amendment rights. Record at 163. He noted that our superior court addressed this issue in United States v. Wooten, 34 M.J. 141 (C.M.A.1992), and stated that he considered himself bound by its ruling. Record at 163. We conclude that the military judge’s findings of fact are supported by the record, not clearly erroneous, and we adopt them as our own. We also conclude that the military judge correctly applied the law.
In Wooten, our superior court granted review as to whether the military judge in that case erred in admitting, over defense objection, the appellant’s bank records obtained in violation of the Right to Financial Privacy *702Act. The court held that the prosecution’s acquisition of Wooten’s bank records and their introduction at his court-martial did not violate his Fourth Amendment rights. Wooten, 34 M.J. at 142 (citing United States v. Miller, 425 U.S. 435, 96 S.Ct. 1619, 48 L.Ed.2d 71 (1976)). The court also held that the trial counsel’s alleged violations of Federal law in issuing and serving a subpoena duces tecum in that case did not warrant exclusion of the challenged evidence as an exercise of its military justice supervisory authority. Id. at 142.
We consider our superior court’s holdings in Wooten controlling on the applicability of the Right to Financial Privacy Act to courts-martial. Therefore, further discussion of this issue with regard to the appellant’s motion to suppress the seizure of his NFCU account records is unnecessary. His second assignment of error lacks merit.
Conclusion
We have considered the appellant’s remaining assignment of error that the Government’s conduct in unlawfully obtaining his financial information was so outrageous that dismissal of the charges is warranted under the Due Process Clause of the Fifth Amendment. Having concluded that his other two assignments of error lack merit, it follows that we conclude this assignment of error lacks merit as well. Accordingly, we affirm the findings and sentence, as approved by the convening authority.
Senior Judge CARVER and Senior Judge WAGNER concur.
. The Florida State Attorney’s Office was then prosecuting DK1 P for the murder of his son. MACS Park met the individual who helped him subpoena the appellant’s NFCU account records while working with the State Attorney’s Office on the DK1 P case. The State Attorney’s Office never investigated, or prosecuted, the appellant. The military judge found that the individual who helped MACS Park obtain the appellant's NFCU account records acted as an agent of the United States Government when he issued the subpoena for them, and that he was, therefore, bound by the limitations of the Right to Financial Privacy Act, 12 U.S.C. §§ 3401-3422. Record at 162.
. Even if we were to assume, arguendo, that the appellant had standing to object to the release of Appellate Exhibit III and the Automated Miscellaneous Vouchers, we would still conclude that their release to NCIS was proper.
"No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [subject to 12 exceptions].” 5 U.S.C. § 552a(b). One of these 12 exceptions is the routine use exception. 5 U.S.C. § 552a(b)(3).
One of the published routine uses of Department of Defense (DoD) systems of records is disclosure in a law enforcement context. “If a system of records maintained by a DoD Component to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or by regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the Agency concerned, whether Federal, State, local, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, rule, regulation, or order issued pursuant thereto.” DoD Regulation 5400.11-R, Appendix 3, at 98, AP3.1 (August 1983).