This is where you say the word GDPR (if you're in Europe). I've done it to some HR person and subsequently received a long email apology from the (very nervous) boss of the company the day after.