In Ohio, invasion-of-privacy under some circumstances has been recognized as a legitimate cause of action. However, you must prove damages. What damages have you suffered? Further, if it was just a mistake then there is no wilfull violation by the payroll company such that they were reckless in providing your personal identifiable information. You could make a complaint to the Federal Trade Commission or the State of Ohio Attorney General's Office but I do not see where you would recover any compensation.
This post is not meant to: 1) contain my signature; 2) contain legal advice; 3) create an attorney/client relationship; or 4) guarantee confidentiality.