I recently got an attempted scam from this company: https://wptr.biz. Their scam seems to be widely known: https://www.wipo.int/pct/en/warning/pct_warning.html.
The scam works as follows: Monitor the database of PCT applications, then send a letter with an invoice that resembles the genuine service. Scam fees can clock as high as thousands of euros. Although the collected information is public, I certainly did not agree to it being collected and processed for the purpose of scamming me. Is this a GDPR violation?
I complained to the Swedish Data Protection Agency and they basically replied "we are too busy".
Personally, I'd raise a complaint against that agency for neglect. I'm not sure of the best way, but start with the police, local politician. Greif the agency with red tape and bureaucracy into singling them out.
They are also part of the EU, so maybe go over their heads and raise it there, maybe start with your local MEP. But the shame approach with the EU, would get some results. All legal, safe and better to use the system to combat the system.