"It’s not just direct costs – such as fines from The Information Commissioner’s Office (ICO) – that need to be considered, although these help to drive the business case for preventative measures, but also indirect costs such as brand impact and disappointed customers leaving the brand."
What fines from the Information Commissioner's Office? Does this ever actually happen unless it's a council that's suffered the leak??