A new report on modernizing the Privacy Act recommends Congress take action to rein in how agencies buy personal information from private data brokers.