Determine the relevant data protection agency (usually at a national level -- if in doubt, it's your country's) and report it to them.

Generally, the rule is to complain with the NY Times first.

But one of the subjects might be.