My question involves a consumer law issue in the State of: Florida
Sometime back I submitted a comment to a federal museum's website because I was displeased that one of their tour guides was using racial slurs against middle easterners in his tour. Their website asked for my email and name with the comment and I included those things. The privacy policy link at the bottom of their comment page brings you to their privacy policy which says, "We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information." among other things. The privacy policy says that it was last updated in 2013 while my comment was made after that in 2014. Since then, the tour guide has emailed me nasty things harassing me and forwarded the email to some of his buddies. I have received a handful of nasty emails from people I do not know (and even a couple of people supporting me for speaking up). I have ignored all of them. I realize it is now May 2015, but I just got another email recently when I thought this had all died down. Clearly the museum gave the tour guide my comment, name and email and he started forwarding it around to anyone he pleased.
Seems unprofessional that the museum would let its employee harass me for a disagreement. Furthermore, it seems wrong that they let him forward this comment around via email. That comment had my name and email attached to it which is enough to be considered PII by the GSA definition. So by giving that to the tour guide to forward around to random people they broke their privacy policy by sharing my PII.
Has the museum broken any laws in letting my comment with PII get leaked out and emailed around? What, if anything, can be done about?
Thanks for any feedback and advice.

