Product: Credit card or prepaid card

XX/XX/XXXX : I received an email from PayPal Prepaid Mastercard ( PPM ) stating : " Hello XXXX, the new PayPal Prepaid Mastercard that you ordered is on its way! '' This was very concerning, since I do have a PayPal account, but the email address used for this communication was not associated with that account. Thus, the message had clearly not been initiated by PayPal. The fact that it said that I " ordered '' the card was alarming, leading me to assume that I had been the victim of identity theft. 
Same day : I forwarded the email to spoof@paypal.com. I never got a reply beyond the automated receipt acknowledgement. 
XX/XX/XXXX : I called PPM and spoke with a customer service representative named XXXX. She told me that the email was not correct in asserting that I ( or any other individual ) had ordered the card, but that the account had been created at the instance of PPM itself. I asked her to explain why they felt they had the right to do so unsolicited. She said she would pass my inquiry to her supervisors and they would reply to me at the email on file. They never reached out to me about the matter. 
XX/XX/XXXX : I received the physical card in the mail. I did not activate it and am retaining it for the moment as evidence. 
XX/XX/XXXX : I sent PPM an email asking them to explain how they had gotten my personal information and what legal basis they felt they had to justify creating an account in my name unsolicited. I gave them until XX/XX/XXXX to reply to my inquiry. I never heard from them. 

In the meantime, I have received several emails from PPM urging me to 'activate my card. ' In the end, this is what I assume about the particulars of the companies involved : PayPal is using a company called Netspend to manage its PPM product. I assume that Netspend has broad discretion on how it handles accounts, perhaps in ways that PayPal is not fully aware of or supervising. I used to have a Netspend card ( opened XXXX ) and closed it down in XXXX. My PayPal account was opened several years prior to that, and remains open. The email address associated with my PayPal account is my primary email, and the email address I used to open my Netspend card is my secondary address. When PPM emailed me on my *secondary* address, it was a dead giveaway that PayPal itself was not reaching out to me to give me some kind of targeted offer. Instead, Netspend must have taken it upon itself to leak my personal information ( including my name, secondary email address, physical address, and who knows what else ) to it's PPM department. 

The grievances I have with this include the following : Netspend improperly ( in my view ) transferred my personal information to an entity ( PPM ) that had no right to it. 
I am not an attorney, but I wonder if there are privacy laws that this violates. 
PPM then falsely claimed that I had ordered a card. 
This gave me reason to think that someone else had stolen my identity and had ordered a card in my name. 
Additionally, by doing this to consumers without their consent ( I know I'm not the only one they've done this to ), it opens up an unsolicited security risk to unsuspecting consumers, since bad actors can opportunistically intercept the cards in the mail and attempt to activate and use them. 
PPM apparently made no effort to respond to my questions, despite multiple attempts I made to contact them.