Talk to your local data protection agency. Tell the company that they are breaking the law, etc. A good starting point is your local citizens information website/organisation.
For the UK, this is the Information Commissioner's Office:
http://www.ico.gov.uk/complaints/privacy_and_electronic_comm...