"highly unlikely event that a criminal attempts to defraud them" sorry but birthdate is incredibly sensitive and useful for identity theft. Its not highly unlikely at all, in fact it is very likely that this infomation will now be used!
Its not up to talktalk to judge how important people's private details are, they should be taking the proper precautions to protect the data as they have a duty by law to do so and if they don't receive a significant penalty for this it is saying to other companies that they can cut corners and not bother looking after our data properly too.
After being hacked twice recently they should be on guard now more than ever and yet it is so lax a couple of 15 year olds can get in!? If the words 'appropriately protected' in the law need a less vague definition let us start defining it now by saying this was not appropriate protection!