Ohio Rev. Code Ann. § 1347.10 – Wrongful disclosure

(A) A person who is harmed by the use of personal information that relates to him and that is maintained in a personal information system may recover damages in a civil action from any person who directly and proximately caused the harm by doing any of the following:
1. (1) Intentionally maintaining personal information that he knows, or has reason to know, is inaccurate, irrelevant, no longer timely, or incomplete and may result in such harm;
2. (2) Intentionally using or disclosing the personal information in a manner prohibited by law;
3. (3) Intentionally supplying personal information for storage in, or using or disclosing personal information maintained in, a personal information system, that he knows, or has reason to know, is false;
4. (4) Intentionally denying to the person the right to inspect and dispute the personal information at a time when inspection or correction might have prevented the harm. An action under this division shall be brought within two years after the cause of action accrued or within six months after the wrongdoing is discovered, whichever is later; provided that no action shall be brought later than six years after the cause of action accrued. The cause of action accrues at the time that the wrongdoing occurs.
(B) Any person who, or any state or local agency that, violates or proposes to violate any provision of this chapter may be enjoined by any court of competent jurisdiction. The court may issue an order or enter a judgment that is necessary to ensure compliance with the applicable provisions of this chapter or to prevent the use of any practice that violates this chapter. An action for an injunction may be prosecuted by the person who is the subject of the violation, by the attorney general, or by any prosecuting attorney.