This is an action brought under the Privacy Act, 5'U.S.C. § 552a, by 13 employees at the Hanford Nuclear Reservation. Plaintiffs claim that unlawful disclosures of information in their personnel security files by the Department of Energy (DOE) to the DOE Inspector General (IG) and subsequently to the United States Department of Justice (DOJ) led to criminal prosecutions against them. Although none of those prosecutions resulted in convictions, plaintiffs claim damages consisting of costs and attorney’s fees incurred in defense of the criminal prosecutions.
The district court held that disclosure of the personnel security file information to the IG was lawful under the Privacy Act, but that the IG’s disclosure of this information to the DOJ was not. The district court then ruled that this violation of the Privacy Act was “willful or intentional,” so that damages were appropriate under the Act. See Covert v. Herrington, 667 F.Supp. 730 (E.D.Wash.1987). On appeal, the government challenges all of the rulings of the district court. On cross-appeal, plaintiffs challenge the district court’s ruling that disclosure to the IG was lawful. We affirm the judgment of the district court.
I
BACKGROUND
As a condition of their employment at the Hanford Reservation, plaintiffs were required to complete and execute forms DOE-1, — “Personnel Security Questionnaire,” (PSQ) and Supplement to Form DOE-1. The supplement stated that “personal information on the form(s) will be used to determine eligibility for a DOE personnel security clearance or access authorization.” It also provided, in pertinent part, that
[ajccess to or use of the information provided is permitted only to the authorized Federal Government investigative agencies conducting the investigations and to DOE personnel directly involved in the processing of the determination of the eligibility of the individual for security clearance or access authorization (emphasis added).
In December 1982, Fourth District Congressman Sid Morrison received a letter from a constituent charging that a number of employees at the Hanford Reservation were falsely claiming permanent residences more than 50 miles from the job site in order to obtain per diem subsistence payments from the DOE. To receive such a payment, an employee had to execute a Certificate of Permanent Residence, acknowledging that the signing party understood he was eligible for subsistence payments only during such periods as he maintained two residences — a permanent residence more than 50 miles from the work-site, and a temporary one within 50 miles of the worksite. Plaintiffs all signed such Certificates of Permanent Residence.
The charge that some employees were falsely claiming permanent residences more than 50 miles from the site found its way into the office of the DOE’s IG. On September 9, 1985, and on various dates thereafter, agents of the IG, in an attempt to uncover the possible fraud alleged in the letter to Congressman Morrison, examined *753the personnel security files of the plaintiffs. This examination was undertaken without a written request by or prior consent of plaintiffs. These files were maintained pursuant to the Privacy Act, 5 U.S. C. § 552a.
Following their investigation, the agents of the IG presented a prosecutive report for each named plaintiff to an Assistant United States Attorney for the Eastern District of Washington. Each report contained details of the IG investigations, copies of the Certificates of Permanent Residence signed by the plaintiffs, and copies of Part I of plaintiffs’ PSQs. The latter included extensive details regarding present and past residences of the plaintiffs. The IG’s disclosure to the DOJ was without written request by, or prior consent of, the individuals to whom the information pertained. The disclosure was not made pursuant to any court order. Nor was it made in response to any request by the DOJ.
II
DISCLOSURE TO THE IG
We review de novo the district court’s ruling that disclosure to the IG did not violate the Privacy Act, since the issue turns on an interpretation of the statute. United States v. McConney, 728 F.2d 1195, 1201 (9th Cir.) (en banc), cert. denied, 469 U.S. 824, 105 S.Ct. 101, 83 L.Ed.2d 46 (1984).
The relevant portions of the Privacy Act of 1974, 5 U.S.C. § 552a, provide that
(b) No agency shall disclose any record which is contained in a system of records by any means of communication to any other person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be—
(1) to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties; ...
(3) for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D) of this section;
(7) to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought; ...
(11) pursuant to the order of a court of competent jurisdiction.
“Routine use” is defined in subsection (a)(7) as, “with respect to the disclosure of a record, the use of such a record for a purpose which is compatible with the purpose for which it was collected.” Subsection (e)(4)(D) requires that “each routine use of the records contained in the system, including the categories of users and the purpose of such use” be published in the Federal Register at least annually as part of “a notice of the existence and character of the system of records.... ”
In addition, subsection (e)(3)(C) requires that each agency maintaining record systems
(3) inform each individual whom it asks to supply information, on the form which it uses to collect the information or on a separate form that can be retained by the individual—
(C) the routine uses which may be made of this information as published pursuant to paragraph (b)(D) of this subsection; ... (emphasis added).
The district court ruled that disclosure of the PSQ to the agents of the IG was permissible under the “need to know” provision of the Privacy Act, § 552a(b)(l). We agree. The IG is responsible for detection and prevention of fraud or abuse in DOE programs and operations. See 42 U.S.C. § 7138. Even the plaintiffs concede that the IG has the “authority to conduct investigations with respect to promoting economy and efficiency in the administra*754tion of programs of DOE, and for the prevention or detection of fraud and abuse.” Brief of Plaintiffs-Appellees/Cross-Appel-lants at 11. Plaintiffs argue, however, that the IG agents did not need to examine the entire PSQ of each plaintiff (which plaintiffs contend they did), but rather only needed to examine the portions of the PSQ relating to a plaintiff’s past and present residences. This argument, while appealing on the surface, does not withstand scrutiny. The injuries that plaintiffs allege consist of the costs incurred in the criminal prosecutions. The criminal proceedings, in turn, resulted from the DOJ’s awareness of information regarding plaintiffs’ residences that was discovered by the IG agents’ examination of the PSQs. Thus, even if the entire PSQ of each plaintiff was disclosed to the IG agents, only the disclosure of the residence information allegedly harmed the plaintiffs. And this information the IG needed to know to discharge its duties.1
Ill
DISCLOSURE TO THE DOJ
The district court’s ruling that disclosure of the personnel security file information by the IG to the DOJ was unlawful under the Privacy Act is also subject to de novo review, as the question is purely a legal one. The district court, characterizing this issue as “more difficult” than the disclosure to the IG, concluded that the IG’s disclosure of parts of the PSQs to the DOJ did not fall within any of the exceptions provided in § 552a. On appeal, the government makes essentially the same argument that the district court rejected below. The government argues that disclosure to the DOJ was authorized under the routine use exception, § 552a(b)(3).2
The district court reasoned that two requirements had to be met by the government before it could invoke the “routine use” exception. First, the government had to show that disclosure was within the scope of an agency’s routine use regulations as published in the Federal Register. Second, the government had to show that disclosure of the record must be for a purpose which is compatible with the purpose for which the record was collected. These two requirements come from § 552a(b)(3) and its references to subsection (a)(7) and subsection (e)(4)(D). The government agrees that these two requirements must be met, and argues, contrary to the district court’s rulings, that these requirements were in fact met in the instant case.
As to the first question, whether the disclosure to the DOJ was within the scope of the agency’s routine use regulation as published in the Federal Register, the district court’s answer was in the negative. The routine use published in the Federal Register provided:
In the event that a record within this system of records maintained by this agency indicates a violation or potential violation of law, ... the relevant records in the system of records may be referred to as a routine use to the appropriate agency....
47 Fed.Reg. 14,333 111 (1982).
The district court ruled that this “routine use” was only applicable if the records at issue here, the PSQs, on their face re*755vealed a violation or potential violation of law. Since the PSQs alone revealed no such violation or potential violation, the district court reasoned, the exception was inapplicable. The government argues that if the PSQs, when viewed in conjunction with other information (in this case the Certificates of Permanent Residence), revealed a violation or potential violation of law, then disclosure to law enforcement authorities would be a “routine use” for the purposes of the Federal Register. In essence, the government argues that the relevant “record” for the purpose of the Federal Register and § 552a is not the PSQ, but rather the entire prosecutive report the IG sent to the DOJ, which included the PSQ and other information.
As to the second prerequisite to the invocation of the routine use exception, the district court concluded that disclosure to the DOJ was not “compatible with the purpose for which the information was sought” because the information in the PSQs was collected solely in order to help the DOE determine eligibility for security clearances.
The government argues that disclosure to the DOJ of the record (which it views as the prosecutive report rather than the PSQ) was compatible with the purpose for which such information was collected because the prosecutive report was collected by the IG for the purpose of criminal investigation. The government’s position necessarily stands or falls on its reading of the term “record” as described above. If the “record” is the PSQ, then the record was not collected by the IG at all, but rather was collected by the DOE for security clearance purposes, which are unrelated to criminal investigation. If the “record” is the prosecutive report, then the purpose for which the record was collected was law enforcement itself, and the government’s argument seems convincing.
Whether the government’s or the district court’s interpretation of the term “record” is correct is a difficult question. We need not decide that question in this case, however, because we hold that disclosure to the DOJ was unlawful because the government did not comply with another provision of the Privacy Act, § 552a(e)(3)(C). Although the district court did not rely on this subsection, we are free to affirm on any ground supported by the record. See, e.g., United States v. County of Humboldt, 628 F.2d 549 (9th Cir.1980).
As noted above, subsection (e)(3)(C) provides that an Agency collecting information shall
(3) inform each individual whom it asks to supply information, on the form which it uses to collect the information or on a separate form that can be retained by the individual—
(C) the routine uses which may be made of this information as published pursuant to paragraph (4)(D) of this subsection; ... (emphasis added)
It is beyond dispute that the government did not comply with this provision in this case. The government did not indicate to plaintiffs that the PSQ information would be used for law enforcement purposes; indeed the government explicitly stated that the information would only be used for security clearance purposes.
The government argues that non-compliance with subsection (e)(3)(C) should not prevent the government from invoking the routine use exception, § 552a(b)(3). Specifically, the government makes two arguments — that the plain language of the routine use exception, § (b)(3), makes no mention of actual notice or § (e)(3)(C), and that plaintiffs can point to no “link” between § (b)(3) and § (e)(3)(C). We find both of these arguments unpersuasive.
Although the language of § (b)(3) makes no mention of actual notice, the plain language of § (e)(3)(C) could not be clearer. Found under the heading “Agency Duties,” § (e)(3)(C) states that the agency “shall ... inform each individual whom it asks to supply information, on the form which it uses to collect the information or on a separate form that can be retained by the individual ... the routine uses which may be made of this information as published pursuant to paragraph (4)(D) of this subsection” (emphasis added). Under the plain terms of the statute, a collecting agency is *756under a duty to inform the individuals from whom it is collecting information of the routine uses to which that information may be put. The statute gives the agency no discretion not to discharge this duty.
We also reject the government’s argument that noncompliance with § (e)(3)(C) is irrelevant in this case because plaintiffs have failed to establish a “link” between the two sections. Subsection (e)(3)(C) “links itself” to the routine use exception provision, § (b)(3), by invoking the technical term “routine use” and by referring back to § (e)(4)(D), the provision requiring publication of routine uses in the Federal Register. There is simply no “missing link” in plaintiffs’ claim.
This reading of the statutory scheme is consistent with our view, and that of the First Circuit, that “the purpose of the statute is to let citizens know why and for what reasons the United States is asking them questions.” Usher v. HHS, 721 F.2d 854, 856 (1st Cir.1983) quoting Saunders v. Schweiker, 508 F.Supp. 305, 309 (W.D.N.Y.1981). Like the First Circuit, we think that the government cannot simply disregard or read out of the statute § (e)(3)(C). See Usher, 721 F.2d at 856 (awarding costs to individuals on appeal because there was “no basis in the statute for an agency’s refusing to give the information specified in 5 U.S.C. § 552a(e)(3).”) We note that requiring the government to comply strictly with the terms of § (e)(3)(C) does not place an unreasonable burden on the government. Indeed, the government often indicates on questionnaires that the information gathered can be used for law enforcement. See, e.g., Form 171, the standard form for federal employment. Providing persons with actual notice of the routine uses of government collected information is a sound and inexpensive policy. Because the government did not comply with § (e)(3)(C) and that policy here, the “routine use” exception is inapplicable to the case at hand.3
IY
WHETHER THE VIOLATION WAS INTENTIONAL OR WILLFUL
The government argues that even if unauthorized by the “routine use” exception, the IG’s disclosure to the DOJ was not an “intentional or willful” violation of § 552a(b) for the purpose of awarding damages under the Privacy Act. The statute provides for damages only where “the court determines that the agency acted in a manner which was intentional or willful ...” 5 U.S.C. § 522a(g)(4)(A). Since the district court did not rely on the government’s violation of § (e)(3)(C), we must determine for ourselves whether this violation was “willful or intentional.” This does not mean, however, that we receive no assistance from the district court on this question. The district court did discuss the willful or intentional standard and characterized it, correctly we think, as “only somewhat greater than gross negligence.” 667 F.Supp. at 740. In Albright v. United States, 732 F.2d 181, 189 (D.C.Cir.1984), the leading D.C.Circuit case on the question, the court held that the damage provision of the Privacy Act “imposes liability *757only when the agency acts in violation of the Act in a willful or intentional manner, either by committing the act without grounds for believing it to be lawful, or flagrantly disregarding others’ rights under the Act.” The government argues that this standard has not been met on the facts of this case. Specifically, the government argues that the IG had a reasonable basis for believing it could disclose the prosecu-tive reports to the DOJ. In this regard, the government notes that the IG’s disclosure was in full compliance with the IG’s own internal regulations.
The fact that the IG was following its own regulations cannot be decisive because, as the district court noted, an agency “cannot promulgate regulations which ignore the dictates of the Privacy Act.” 667 F.Supp. at 742. The real question becomes, then, how tenable the government’s legal arguments are, and whether the IG agents could reasonably have relied upon them. Because we see no legitimate basis for the government’s failure to comply with § (e)(3)(C), as discussed above, we conclude that the violation was intentional or willful for the purposes of the damage award.
Accordingly, the judgment of the district court is AFFIRMED.
. Plaintiffs also make another argument regarding the disclosure of the PSQs to the IG. Plaintiffs claim that since the Supplement to the PSQ indicated that the information was not going to be used for any purpose other than security clearances, the DOE (including the IG) is es-topped from using the information for any other purpose, even if the “need to know" provision otherwise authorizes the disclosure. Plaintiffs, however, have not satisfied all the requirements of an estoppel claim against the government, if indeed one can be made at all. For example, plaintiffs have not shown any "affirmative misconduct" on the part of the government, apart from a failure to live up to a promise plaintiffs claim they reasonably relied upon. Such affirmative misconduct is a necessary element of an estoppel claim against the government. See, e.g., Wagner v. Director, Federal Emergency Management Agency, 847 F.2d 515, 519 (9th Cir.1988).
. Section 552a(b)(7), dealing with enforcement of civil or criminal laws, is not available to the government here because the DOJ did not make a written request for the PSQ information, as § 552a(b)(7) requires.
. The dissent concludes that there was no violation of § (e)(3)(C) for essentially two reasons. First, the dissent argues that the “routine use” referred to in § (e)(3)(C) is not the same "routine use” referred to in § (b)(3). See dissent at 757. As stated above, we disagree. Both sections use the technical term “routine use,” and both sections define routine use by reference to § (e)(4)(D), the provision which requires publication of routine uses in the Federal Register.
The dissent also finds § (e)(3)(C) inapplicable because "[t]he DOE did not furnish [the PSQ] information to the DOJ for criminal prosecution, ... [t]he IG did ...” Dissent at 759. What the dissent fails to recognize, however, is that the IG is part of the DOE for the purposes of the Privacy Act. Section (e)(3)(C) requires an "agency" to make known the routine uses to which government collected information will be put. The IG is a part of the "agency” which disclosed the information to the DOJ. Indeed, when the government successfully argued that disclosure to the IG was permissible under the "need to know” exception, it as much as conceded that the IG is part of the DOE, because the "need to know” provision only permits disclosure to “those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties." 5 U.S.C. § 552a(b)(1) (emphasis added). See also 42 U.S.C. § 7138 (creating Office of IG within the DOE).