Seems they are violating The Privacy Act of 1974 The Privacy Act of 1974 is a federal law that governs our collection and use of records we maintain on you in a system of records. A system of records is any grouping of information about an individual under the control of a Federal agency from which information is retrievable by personal identifiers, such as name, social security number, or other identifying number or symbol. Under the Privacy Act, Federal agencies may not disclose information without consent unless certain exceptions apply to the disclosure. The Privacy Act provides protections to individuals in three primary ways. It provides individuals with:

the right to request their records, subject to Privacy Act exemptions;

the right to request a change to their records that are not accurate, relevant, timely or complete;

and the right to be protected against unwarranted invasion of their privacy resulting from the collection, maintenance, use, and disclosure of their personal information. https://osc.gov/Pages/Privacy-Act.aspx

I say seems, because even though they aren't a federal agency, they should be held to the same standard at a minimum. It's our data, they don't own it, and they don't have a right to injure us for it.