This is a health, safety and welfare issue and an important one and should be treated accordingly. I’d take the following steps:
(a) raise a formal complaint with the accommodation provider (use the contact details provided in the licence to occupy / handbook, which should contain a complaints procedure). Then you need to wait for it to go through that procedure but if not satisfactorily deal with then escalate it (eg: find out which company is the ultimate owner of the company that owns the halls (is there any branding?) and approach the directors of that business on LinkedIn
(b) report in writing to the University via the student welfare officer / dept
(c) also report in writing to the students union and ask for their advice. That’s exactly what they are there for.
Include details of how the incident made her feel (scared, intimidated, privacy violated or whatever it is).
Whilst the threat of legal action might help get engagement, it’s not in itself going to lead to a worthwhile outcome.