Does GDPR really work?

Last Saturday, I was in a stupid, non-serious car accident while leaving a gas station parking lot.
The other car and I hit each other's rear bumpers.

There were no injuries, and it was just sheet metal, meaning plastic on plastic.

At the time, and without any problems, we filled out the amicable declaration and signed it.

The declaration followed the normal flow of being delivered/sent to the insurance company, and the final verdict was 50% fault for each of us, meaning each of us was responsible for the damage to our vehicle.

Honestly, this doesn't surprise me, given that we were in a private parking lot, and the way we crashed, the insurance company wouldn't be able to say that one of us was 100% responsible for the accident.

So far, so good...

The issue was today when I received a call from a number I didn't recognize, and when I answered, to my surprise, it was the driver of the other car. He came to appeal whether I should sign a document accepting blame for the accident, given that the insurance company had agreed to a 50/50 split and that he was already out of the car when we crashed.

At the time, I wasn't in the right place to have this discussion.
However, he mentioned in the call that he had to request my number from the insurance company to call me, since I didn't include it in the amicable statement.

This is the big problem.

I didn't include my cell phone number in the amicable statement because I didn't want to, and the insurance isn't in my name. Where did the insurance company get my number?

I once had insurance with that insurance company, and the insurance company believed I had the right to share my number with third parties outside the legal terms under which they collected my data.

Under the GDPR, this is a serious violation of my rights, given that my contact information was collected to enter into a contract with the insurance company in the past, and they decided to share it with another driver.

I've now activated the first and most basic mechanism: filing a complaint by email asking the insurance company for an explanation.
If they don't respond within 30 days or if their response isn't satisfactory, I'll file a complaint with the National Data Protection Commission.

Large companies, like insurance companies, are used to doing whatever they want, but this time I won't let this go unpunished. If I pay the insurance and sign the amicable statement, they'll handle the matter and I won't have to receive calls from the other driver.