Suppose someone finds private health data about themselves online, identifying them by name and by specific family information. The person does not recall signing anything that gives anyone permission to share or publish this data. My questions are:
a) Is it legal for the website to publish this data?
b) If not, would the hosting site or publisher be in any way liable?
c) Is it common for people to accidentally sign sharing agreements about this sort of data without realizing it? If so, do these agreements stop the signer from being able to do anything about it later?
Edit in response to comments: This is in the US, California if it matters, but the person isn't necessarily a US citizen. Let's say the website is a legitimate hosting/sharing website focusing on presentation/slideshow content, and the data is in a particular slideshow that a user uploaded and shared on the site. We'll assume the slideshow is indexed and discoverable via search engines, etc, and is in the first page of results on a Google search for the person's name.