Re: Does there need to be an obligation to "encrypt" ?
No, the ICO will decide because it will never come to court. It isn't just the encryption but the other things - is this the third time this year customer data has been stolen?
My guess is that the ICO will slap nearly their maximum half a million pound penalty on Talk Talk with 20% discount if they pay within 30 days. This is a trivial penalty for a corporation that size and they will instantly pay because their top priority is to kill the news story.