The worst part is, the protocols and procedures for securing data have been around forever.
I remember being instructed in the matter way back in the early 90's when we first started getting the things.
Hell, I almost got hit in the security line at the airport by a bump-n-grab (Perp1 watches metal detector line, waits for laptop guy, signals Perp2, causes mild distraction while laptop travels to the secure side where Perp2 is waiting to pick 'er up and walk away non-chalant). Spotted it happening, caught Perp2's eye and pointed directly at him as he was approaching. He did an about face and took off, and his pal was gone when I turned around. (Remember, this was pre-911. Today would probably be different)
If the company does have protocols that weren't followed, you could hit the guy personally, too. Some kind of reckless disregard thing, perhaps.
I agree with Skuzz...no excuses these days. Data Security is no secret. And to be frivolous with financial and identification data?
He's right...bag the lot of 'em, for Monumental Stupidity.