credit card privacy rights

What is the name of your state? California

I paid off my Providian Mastercard early in September and cancelled my account, and I received a letter acknowledging this from Providian. Then in mid-October I received a letter from a credit card company called Emerge saying my account had been sold to them. Is this legal? I paid my Providian account off and cancelled the card before they sold it to Emerge, so why do they have the right to sell my information to them without my consent? I called Emerge's toll-free number and talked to their customer service department. None of the representatives on the phone spoke English very well, indicating that they are almost certainly located offshore--the Phillippines, etc. They told me that my account had already been cancelled, but my name wouldn't be deleted from their data base for at least 12 months. Because I was a victim of identity theft about a year ago, I am very upset about this. Does Providian have the right to sell my private information after I cancel my account with them? Does Emerge have the right to keep my information for 12 months even though I don't have an account with them and have asked them to delete my information from their database? Lastly, what are the laws concerning access to personal information when it comes to offshore employees? I am really worried about this, so any information you can provide would be sincerely appreciated.

[bigun]

Emerge is in India. Yes, Providian can sell your information. Once you acceept a card, the information you provided is their property.
I don't blame you for being concerned but I have no idea what {if any} laws govern this situation. Have you placed fraud alerts on your account with the CRA's?

No I haven't posted these alerts, but even if I do, this won't stop Emerge from selling my information to other third parties.

Are you sure that Providian has the right to sell my private information even after the account has been cancelled? Doesn't the privacy agreement I have with them prevent this? I don't have a similar agreement with Emerge. Does this mean Emerge can sell my private information? There has to be some kind of law that prevents this, otherwise anyone who has ever had a credit card is subject to the same abuse of privacy and I can't believe that is the case. Can you direct me to any legal statutes that govern this situation?

Thank you for taking the time to at least partially answer my question.