I think this is where (in the EU) a Subject Access Request could work.