I don't think GDPR violations are normally handled by police. It might be if there is separate a crime (in Finland illicit observation can probably be both GDPR violation and crime though that probably doesn't apply here).
GDPR violations would normally be handled by the national DPA. They can investigate things by their own decision but normally you need to try to exercise your rights (in this case probably ask copies of your data, information regarding processing & recipients of your personal data), get denial from data controller or find issues on their reply and then make complaint to DPA. They will then investigate & give decision. You or data controller can then appeal it to court if either disagrees.
