A basic question is who Jetblue released the data to: The Army or the Army's contractor. If the data went to the Army who then gave it to the contractor (legally, not that a diskpack or tape or whatever literally was touched by the Army) then JetBlue is in much better shape legally because then the data was provided by the Army, not Jetblue to the bozos at Torch to do dumb things with.
JetBlue could cover itself then by saying that it was provided for national security to a government agency who received it and was obligated to protect it under the Privacy Act and Jetblue has a signed document to that effect. This isn't quite as good as actually living up to the privacy policy, but it does give a bit of a fig leaf. Question on the privacy policy of Jetblue is whether the policy is a contractual agreement or whether it is just something they say like "new, improved, less filling, tastes great, etc..." that really doesn't mean anything.
This will be much more fun to watch than to participate in.