ICO fines are just the tip of the iceberg for companies who fail to prevent data breaches