In your publication(s), You just state the truth: You took data from a public source and used the data therein to reconstruct the data. You also state that you do not believe you are in violation of the data use agreement and that your use of data, and in particular your publication of the results, does not violate privacy.
Because knowing that data can be reconstructed helps people looking for full data sets, publication of the existence of a work-around has at least the potential for a breach of privacy. To be more precise, the breach of privacy has already occurred, but publishing the existence of a work-around makes it easier to find a work-around. This means that before you publish anything, you need to give the agency a chance to remove the data (and hopefully replace it with better protected data). This also means that your data will not be reproducible from public sources, so that you will have to post publicly a privacy protecting version of the data set on which you base your conclusions.
Finally, if you use a computer program to regenerate the data, you might use an anonymizer within the program (e.g. replace names with a hash value or slightly encrypt identifying information such as addresses by XOR-ing with a fixed string) so that no human eyes including yours sees the actual data. I do not know how bad the privacy breach is, so this might be a stupid suggestion.
Privacy protection is an active research area in fields like Computer Science. Mistakes in privacy protection are important data points. Their discovery should be treated like the discovery of exploits in software, where you give the owner of the data / software a decent chance to fix the problem before you announce the discovery to the world.