[DanBC]

If they're in the UK you can report them to the regulator - the Information Commissioner.

They tend to take a warn then fine approach.