Service providers collecting personal data without autorization

1 year ago

Insurance service provider's online platform has services like getting quotes for multiple types of insurances they offer, buying insurance, claiming insurance etc.
Initial phases of deciding which product to buy, everyone goes through quotes, downloads brochures, policy documents etc which are all available online in their website.
One of the step to get the quote is to give information like age, pincode, phone number which is verified by OTP. After OTP verification we can click get the quote. Before clicking on the button, we can see in the bottom there is a check box which says "I Authorize xyz to call, send sms, email, whatsapp to offer information and services". This check box is by default checked. If I dont want these services, I dont have an option to uncheck the said check box. Upon inspecting the website in detail, found out that this checkbox is not functional. Phone number which is collected is immediately stored to be used for communicating purposes.
One of this innocent exploring of policy details of my friend's resulted in more than 20 phone calls within the span of 1 hour.
She was working and was unable to receive all calls. She disconnected couple of calls and got callbacks within seconds of disconnecting the call. So to clarify them that she doesn't need assistance, she received the call and informed them the same. They kept pressing her to give health details so that they can "better assist her in choosing the good policy" which she denied. She got the calls even after that.
She resorted to calling the customer support directly to ask them to put her number on "no calls" list. She even got the complaint number. Which she was talking to customer support regarding this, she got 3 calls. Mind you this call lasted only for 6-7 minutes max.
She received almost every call after that and kept repeating the same thing that she doesn't need assistance and if pressed, she will be forced to take this issue legally, she got 3 more calls after that.
I want to know 2 things here
1. Can we take any legal action against them forcefully collecting personal data? (Wordings on the website suggests that we have an option to opt out of sharing this information, but there is no option to opt out at all)
2. Can we put a harassment case against the insurance provider for multiple calls even after her verbally confirming that she doesn't need assistance in any manner? (According to customer support executives, all calls are recorded. So we should have the proof of her verbally saying that she doesn't need any assistance and asking them to not call her back on the same matter again)

TIA