This is a temporary restraining order (TRO), so the judge did not need to, and did not actually, rule that they did violate the Privacy Act, but that they <i>likely</i> did so, and that this probability of success on the merits coupled with the fact that the disclosure of their banking information would constitute irreparable harm justifies a TRO while the case proceeds.