The UK’s Information Commissioner’s Office imposes a fine of £500,000 over the 2017 breach.