The main federal laws that are missing is a formal definition of what data you own and expect privacy and what data on you the company owns. In this case it is specified by contract which may or may not have been breached not law.