Is my employer allowed to sell my personal info for profit?

Got a call from a insurance company trying to sell me their product. I already have insurance and don't like being called on my personal number under any circumstances answers by strangers. Asked the man how he got my number and he replied that he did not know but that it could have been my current insurance company. Which makes no sense Because why would an insurance company allow another insurance company to try to undercut them. I did (curtly but not rude) ask the man on the phone to delete my information from their systems and put me on the no call list. He was very polite and obliged.

Then just this morning I opened a piece of old junk mail from my current job (which I'm trying to leave ASAP) and wouldn't you know it there's the name of the insurance company that called me.

Frankly I've got quite a bit of evidence to Sue this company for harassment as it is I simply don't have the time, patience, or money to do so. I simply want to wash my hands of them, although I would not turn down a class action should that occur in the future and wonder if I should add this document to my already significant files that I've kept for protection.

(Even if it's superfluous think I will just in case)