Thank you for using JustAnswer. I am researching your issue and will respond shortly.

If it was truly a wrongful access, there might be criminal liability for the employee. But as for the employer, there's not currently any legal recourse because there is not yet a "ripe" case. For civil cases, there has to be ripeness in a case to bring a lawsuit against a "tortfeasor" (wrongful actor). For a company to have liability, there has to be either action done in the course and scope of employment of the employee, OR "ratification" of those actions. Keeping this individual on would be ratification, but another necessary element is damages. As crazy as it sounds, you have to have actual damages relating to the actions of another before you can go to court to sue. So if this person used your information and you were harmed in a quantifiable manner (you lost money, your credit was ruined, etc...) then you could go after both this individual and the company in civil court. But you would need to have those specific, provable damages first. At this point, if you don't know what was done with the information, you can't yet prove that, and therefore would not have any legal recourse (at least yet).

I know this is probably not what you wanted to hear, but it is the law. I hope that clears things up anyway. If you have any other questions, please let me know. If not, and you have not yet, please rate my answer. Please note that I don't get any credit for my answer unless and until you rate it a 3, 4, 5 (good or better). Thank you, and good luck to you!

Yes, but again, this is really only enforceable if there is damage. Most of the time, companies take a pretty hard line to show that there is no ratification of the employee's actions, and to avoid civil liability. But there's not "injunctive" rights (where you can get a court to tell them to do something or not to do something) in such a situation, but rather only remedial (compensating for damages already incurred).