I am not a lawyer, I am not your lawyer.
You do not identify a jurisdiction and the answer will turn almost entirely on this. As an Australian I will deal with that jurisdiction.
The Privacy Act 1988 governs personal information of or an opinion of an identifiable individual collected and held by Australian Government Agencies and businesses with a turnover of more than $3 million. See http://www.oaic.gov.au/. States and territories have similar legislation that fills some of the gaps.
Under that legislation you have a number of rights, the most applicable to your circumstances being:
- the right to have your information corrected
- the right to complain
On the face of it the actions taken would be in breach of the legislation if committed by an entity covered. It is worth noting that if your name and address are published (say in the phone book) then they are not personal information; credit card details would be personal information.
There may be a breach here - it would depend on the exact law in the jurisdiction.
In order to establish negligence as a Cause of Action under the law of torts, a plaintiff must prove that the defendant:
- had a duty to the plaintiff,
- breached that duty by failing to conform to the required standard of conduct (generally the standard of a reasonable person),
- the negligent conduct was, in law, the cause of the harm to the plaintiff, and
- the plaintiff was, in fact, harmed or damaged.
Where a case would fall over is on point 4.; what harm, in the sense of an actual loss, have you suffered? I can't see that you have actually suffered any damage. If you were to suffer credit card fraud or identity theft and you could prove that the company was the source of the information you would have a case for the loss.
You could seek an order of the court to make them correct their records