Sandral (e-toll) Not complying with POPI ACT

Sandra is not complying with the Popi act. Sandra is sending letters with full ID number written on it and the car registration. This information in the wrong hands my personal information can be accessed. What even makes it worse is that they are sending letter to my old address which I've moved from there long ago. This is very wrong of sandal and I plan to take this further. I want to sue them for failure to protect my personal information. I have their letters as evidence.