Anyone can report them for investigation. I forget what the contact email address is but I had to add it to my GDPR compliance page so I know it exists.