National Public Data is almost certainly subject to the Fair Credit Reporting Act as a “Consumer Reporting Agency”.

What seems to be missing from the FCRA is a requirement for the security of data being held by Consumer Reporting Agencies, although such a thing may exist and I’m not finding it. If it doesn’t exist then Congress needs to get busy passing a law about it and / or Federal Agencies like the Consumer Protection Agency and the FTC need to look closer and find the existing provisions in the FCRA that would require it.