If you are European you can report them for this as it goes against the GDPR[0]. You can also just send an angry email to their data officer which they have to reply to by law, and enjoy the template reaction of "we are currently too busy" followed by dismissal a few months later.

If you are not European you can probably still use their mechanisms for complying with the GDPR to fix this as they cant really tell who is a European citizen and who is not.

[0] https://gdpr.eu/email-encryption/