The ICO continues to argue that it will not fine public sector organisations for major data breaches and that reputational damage will be a driver for improvement.
As many people are saying, the problem is that if you have no choice but to use that organisation then they could lose all your data and their reputation would not be a factor in their interactions with you.
That is also why I dislike terms such as customer when dealing with those organisations – I am service user, not a customer as customer implies choice when using them.