There are two laws missing that allow such privacy violations to occur.

First is strong and enforceable law that makes it unlawful to violate one's privacy. The second is to prosecute violators directly—that is, employees cannot hide behind corporate walls and allow the corporate entity to take the blame.

Irrespective of what employers demand, employees have a responsibility to obey the law. Risk of individual employees being chucked in the slammer would change corporate culture overnight.

Fining corporations alone is a waste of time, they see such fines as the cost of doing business, losing one's freedom for an individual is another matter altogether. Employees must be frightened of the consequences of violating the law or the practice will continue.

The main federal laws that are missing is a formal definition of what data you own and expect privacy and what data on you the company owns. In this case it is specified by contract which may or may not have been breached not law.