"This was due to a process failure, corrected in 2016, which led to a limited amount of UK data being stored in the US between 2011 and 2016. "
If the process error was corrected in 2016, how come the data on 400k people was still in the US in March 2017? Safe Harbour regulations should have made this data transfer all but impossible, since it appears to be a marketing list...roll on GDPR.
Handy of them to discover this on a friday evening...
I smell a hamster. And some elderberries.