I had the header at 9.30 this morning. I just refreshed the page and my number has gone, so either they've fixed it or I'm using a different proxy that doesn't have the issue.
Just been looking into this and from the little info I can find, it looks like your phone number would be classed as personal information and so covered by the data protection act.
Yeah. Just submitted a form as well and got response from ICO that case work has been received. According to the law, companies that break Data Protection, can be fined up to £500,000 per case.
Technically the organisation in breach would receive a penalty, not a fine. I realise that's a bit pedantic but there is a difference (fines can usually only be made and enforced by the courts).
The ICO can also prosecute the company and officers in the criminal courts under some situations, including: "unlawfully obtaining, disclosing, or procuring the disclosure of personal data;" (I don't know whether this would count as unlawful disclosure or not).
It would have to be to someone that you know and don't mind being exposed to said domain as in accordance with ICANN you can't use fake whois information.