Just been looking into this and from the little info I can find, it looks like your phone number would be classed as personal information and so covered by the data protection act.
The ICO can also prosecute the company and officers in the criminal courts under some situations, including: "unlawfully obtaining, disclosing, or procuring the disclosure of personal data;" (I don't know whether this would count as unlawful disclosure or not).