Essentially this is a data breach, or multiple data breaches, and potentially a breach of their duty of care.
You say that you initially notified your employer of your change of address when you moved out, and that they've since sent multiple items of confidential mail to the wrong address.
When did you first raise this with them, and did it happen again after you did so? If it did, how many times?
They are obligated to investigate any and every report of a data breach. You say they've apologized, but did they give you an explanation as to how it happened, and what action they've taken as a result? Are you satisfied that it won't happen again?
You have a number of options depending on what you're hoping to achieve.
Internal - If you're simply looking to resolve the issue and make sure it doesn't happen again.
- You could ask for written confirmation that an investigation has taken place if this hasn't already been provided, including a breakdown of the resulting actions.
- You could file a formal grievance against the company (and/or a specific department/individual, if the situation warrants it).
If you're in a Trade Union, seek their advice here. If not, ACAS.
External - If you're looking to hold them accountable and/or seek redress.
If the company fails to adequately deal with the breach, or if the initial breach was extremely serious (I would argue that in your case it was), you should refer them directly to the ICO.
You mention the legal route. Depending on the full circumstances, you may have a claim. The bar for a phycological injury claim is high though. Suffering distress/upset is not enough; you'll need a medical diagnosis of severe anxiety, PTSD or similar. Broadly, you'll also need to evidence that it was directly caused or made worse by your employer's actions/negligence, that they could/should have foreseen this happening and could have acted to prevent it.
If you've exhausted the company's internal complaints process and the situation is still so bad that you're compelled to resign, depending on your circumstances you may have a claim for constructive dismissal.
You should seek qualified legal advice ASAP on the above.
In any case, it is vitally important that you collect as much evidence as possible. This includes evidence of the breaches and their impact on you, medical evidence, and evidence of how your employer has responded. Ask for any face to face meetings or formal calls to be minuted, otherwise make your own notes and email them to all relevant parties afterwards.