[alnorth]

It is legal, in that it is not a crime.

However, that business could be liable if you suffer damages due to this act, and could be sued. May or may not be able to sue the owner or person responsible individually as well as the business.

You have to incur actual damage, you cant just walk into court and say "I'm afraid my identity may be stolen", they'll tell you to come back when something actually happens.

Until then, you could still reasonably make the argument that you now need to pay for a fraud alert and credit monitoring for years, and you could probably sue for the cost and time of doing that.