Ohio.
Not sure if this is the right forum, but I don't see one that is a better fit. If there is, please move, thanks.

My school (college) published a file containing personal information (name/address/ssn/dob/etc) to a web server. (Could have been downloaded by anyone with and internet connection) They sent a letter admitting the error and have purchased credit report checking for the next year for the people who had the info published.

I don't really have any factually damages at this point. But who's to say someone can't hold on to my information and damage me 4 years from now?

Also, being in IT myself, it seems like gross negligence to post this type of file to a web server. If it was on a network server and there system was hacked that would be one thing, but putting the file on a public web server is the same as handing out hard copies of the file on the street.

Anyway, I'm not looking for some type of quick pay day, but I would like to use their error as leverage in a separate matter. I would like to offer settlement on the other matter and say something to the effect, I am considering suit against you for posting that file.
Take the settlement in this case and I’ll forget about your gross negligence.

Would something like that carry any weight, since I don't have any real proof of damages at this time? Is there any type of damages they would be responsible for because there error was gross negligence? Punitive Damages maybe? Googling a bit I see in some states posting that type of information is violation of state law, but I can’t find anything relevant in Ohio?

Thanks.
James