That business you discovered in Vanguard's webpages is apalling. I don't know if I'd complain just to Vanguard so they can quietly clean it up. That's the kind of thing a REAL BIG stink should be made of, to get people's attentions as to what kinds of things are going on. Maybe the Wall Street Journal, New York Times, and so on.
Since you asked for references ... check out the Federal Trade Commission's webpage on "Financial Privacy: The Gramm-Leach Bliley Act":
There's also a complaint form on that site, you can get a ball rolling there too.