I'm fully aware that the first thing a regulatory body will do, whether I go via the Financial Conduct Authority because they're a bank or the Information Commissioner's Officer because they misused my personal information, is tell me that I need to complain to the bank first and give them a chance to respond. So I have: I complained on the day that post went live, and they told me that they're looking into it and will get back to me within 8 weeks.

THEN we'll see about a complaint to the regulator! :-)