"Some of you mentioned that we’re not registered with the ICO, it is not a legal requirement to register with the ICO."
Its actually a criminal offence not to register with the Information Commisoneer.
I am amazed giffgaff got away with it for so long.
Section 21 Offences.
(1)If section 17(1) is contravened, the data controller is guilty of an offence.
(2)Any person who fails to comply with the duty imposed by notification regulations made by virtue of section 20(1) is guilty of an offence.
(3)It shall be a defence for a person charged with an offence under subsection (2) to show that he exercised all due diligence to comply with the duty.
http://www.legislation.gov.uk/ukpga/1998/29/section/21