How does this work with data protection laws? Is there a way for me to object to a company doing this, i.e. an automated background check on my email address with stolen personal data?

I guess I cannot effectively object to my email being included in data leaks…