Alix - 

I am  not sure there is a statute that specifically covers this. It is definitely poor policy and dangerous, and the title company is ultimately responsible if the information is misused, but that doesn't help your heartburn as you really don't want the information in your office.

You may want to direct them to the ALTA Good Practices with regards to PPI. If you know who their Underwriter is, you could also mention it to them.