Except the US has no law that you have to secure private data or that not securing it is a crime.