An ICO spokesperson said:

“If a customer’s phone number is used for reasons for which it was not originally taken, it could be a breach of the Data Protection Act.

"Organisations have a legal duty to make sure personal data is only used for the purposes for which it was obtained. We are aware of reports of an incident involving Just Eat and will be looking into it.”