Depends how harsh you want to be, and how serious you consider the risk to be.
If the risk is low, you may want to register a complaint with a manager and leave it there for a bit. If you want to go in a bit harder, there's a number of things you can do.
You could contact the Information Commissioner and register a complaint, detailing the nature of the offence.
http://www.ico.gov.uk/
You could also issue a Section 10 notice, which essentially says that in line with your rights under Section 10 of the Data Protection Act, you are demanding that the organisation stops processing your personal data since you are suffering, or are at risk of suffering real harm (in this case, identify threat).