The UK’s data protection watchdog, the Information Commissioner’s Office (ICO), failed to hold both the government and private sector to account for