I'm not sure I mentioned GDPR? I merely said it would be interesting to see what the ICO do. The main problem is that a £400k fine was not sufficient to make t

I'm not sure I mentioned GDPR? I merely said it would be interesting to see what the ICO do. The main problem is that a £400k fine was not sufficient to make them invest in their security, even after they knew they were definitely a target (having been hacked before). Now if the ICO's hands are tied and they can still only fine them based on the DPA limits then hopefully the ICO will fine them the full £500k and tell them the next breach they have will incur the maximum GDPR fine. That should light a fire up them.