"Talk to your local data protection agency."

For the UK, this is the Information Commissioner's Office:

http://www.ico.gov.uk/complaints/privacy_and_electronic_comm...