The fact I used to get regularly spammed by the ICO themselves (I edited a magazine on a completely unconnected topic; they insisted on sending press releases that had nothing to do with our subject matter), and they ignored all requests to be removed from their list, has never exactly given me much confidence in them.

That's a different issue, though. In your example, the company is actively doing something malicious, and accepting the fine for getting caught as part of their costs. Other than the threat of a really huge fine (or worse sanctions), they're unlikely to stop.

In this case, it's a company that's not actively trying to be malicious, but rather due to [cost-saving/incompetence] has underfunded IT security to an excessive degree. For them, and others like them, to change their ways it's a lot less self evident that the fine needs to be huge. The fine (and accompanying reputational damage) just needs to be enough to make them, and similar companies, take IT security seriously.

Very different situations, really.