I filed an ICO report early this morning, but not sure how far that will get to be honest. I am not familiar with the UK's systems or what they will bother to do with this, if anything.
Well, we can only hope they change something, delete your personal data, and publicly apologise. If you'd go to court, you could probably even demand money for the damage to your reputation they tried to create, but court is expensive in these cases.
Let's see what they will do, maybe once it hits their lawyers and they are personally at risk they turn reasonable. Or at least their lawyers prevent them from doing more shit.
I'm currently at the post office buying stamps for an international letter, so I can send a C&D.
This is the weirdest exchange between a business and its customers I've ever seen.