In order to sue them you need to be able to prove actual damages. The best course of action is to report them to your local DPA, who will levy fines for breaches of data protection laws. Furthermore, if you do have damages, action by the DPA will increase the likelihood of winning your claim.