If you are based in the EU, this would be a breach of the Data Protection Act and you should complain to your national Information and Data Processing Commission. However, I am not familiar with the equivalent in the US, so if you are based there, I don't know if there is any remedy available to you. In The UK, this type of breach could lead to a significant fine and an order to change their systems to prevent any recurrence.
|