Re: What's the point?
Pre-GDPR coming fully into force, the ICO stated prosecution/fines would be “impact related”.
Small violation - small fine/enforcement
Big Violation (BA/Marriot grade) - large fine/enforcement/arse kicking
£2m is a piddling little legal budget and if not increased massively will lead companies to going GDPR... m’eh.