“The SECURE Data Act does not include a private right of action, which would allow individuals to sue companies for violations.”