You can report it sure, but does anyone actually follow up on those reports with penalties high enough to deter such behavior? At least in the UK, the answer is definitely no. Our DPA is absolutely useless and may as well not exist.