> Does EU have any regulation to prevent it?

Yes

Article 22 of the GDPR. Essentially it sates that if automated decision making occurs, you must be able to appeal to a human.

https://www.gdpr-toolkit.co.uk/individuals-rights/the-rights...

This is aside from common law, which might give some protection in that entities managing your goods (and maybe your data?), even voluntarily, have a have a duty of care to keep them safe.

No, people in the EU also have the same thing happen with Google.

This is not clear. Even if it is regulated, the question is if anybody ever successfully sued to get this right, and then the question is what is the fine that would be given. Is it large enough to make the company change its ways in the future?

GDPR Article 16 gives you the right to have inaccurate personal information amended, taking in to account the purpose of the information.

A phone number used for this purpose would definitely identify a person, and so qualify as personal information.

Presumably you need to prove who you are to make changes to your record however. GDPR doesn’t give me the right or require a company to change a phone number if I call them up and tell them to change the number for some random name without proof of identity.