Thank you for that information. However, I am not sure how anyone could establish malicious intent unless they know what the information was gathered for. In any event, malicious intent is not necessary to show an invasion of privacy
. However, the State would not be liable unless they knew that she had the proclivity of accessing other people's private information without permission. In other words, an employer is not generally responsible for the criminal acts of an employee who is acting outside the scope of their employment.
That said, you will need to sit down with a local personal injury attorney who handles non-physical injury torts (which is what invasion of privacy and perhaps negligent supervision are) to discuss all the details of the case and how you found out about this and what you know. Chances are the suit will only be successful against the person who actually invaded your privacy and not the employer, but your attorney can evaluate that and might recommend that you file suit against both and see what the discovery process turns up.
In terms of criminal charges, the only invasion of privacy crime in NJ has to do with sex tapes, etc. However, if she actually used the information, or tried to, in order to steal your identity, for example tried to get a loan or a credit card, then that could be charged as identity theft.
Please let me know if you need any clarification. I would be glad to assist you further if I can.