privacy violation? options?

A collection agency called my Dad's current work about a business debt with a prior job. The woman that they spoke with is not an employee of his, he is an independent contractor and she has been used as a number simply as verification of his employment for renting homes, etc. We don't know how/where they got the number. The woman explained that she is not his office manager (which they for some reason thought she was) and that he is an independent contractor for the corporation. Knowing this, he still disclosed not only that was a about collecting a debt, but what the debt was for, and the amount of the debt and the amount with interest. This woman works in a different city that where my father does, so she emailed this information to the office where he works, to give to him. I was under the impression that they couldn't even tell someone they are calling about a debt, let alone what it's for and how much. About a week later, the guy called her, AGAIN and a second time disclosed all this personal information to a woman who has never even met my father. This incident too, has an email from the woman who received the call to my dad's office. Both emails include the guys name, when he called, and the info he gave. I called the company and complained to the guy and he acted like what he did was perfectly fine. I hung up and spoke to his supervisor, he too was unhelpful, he said he couldn't even listen to the complaint because it was a personal matter (despite the fact that I was not requesting any info, I was simply reporting the inappropriate actions of an employee). Finally, I was able to get a hold of the next guy up, the floor supervisor. He listened to my complaint politely and I made it clear I knew he'd (the guy who'd called) violated my dad's privacy and that "appropriate actions" would be taken if this continued. I wasn't sure exactly what laws/rules were broken, but luckily, the calls have ceased since my call. However, is there any action that can be taken for these first two calls? Isn't this against some privacy law or something? The email was printed and given to my father, is the email from the lady who received the call to the office secretary good enough evidence of this violation? I am happy they stopped calling, but still quite upset they embarrassed him in the first place by disclosing his personal information like that, TWICE! (We are in California, if it matters)