[qasdfdsaq]

What's the difference between calling someone and revealing personal information verses sending them a letter, email, or text message with the same information?

The customer's consented to their personal details being sent to the address/email/telephone number when they signed up. You don't check DPA when posting their bill via letter, email, or text, so how is a phone call any different?

I'd agree that this is a silly VM policy being masqueraded as DPA, as it makes no sense under the law and other companies (in the same sector and otherwise) do no such issues with calling their customers.