The UK Information Commissioner’s Office (ICO) has won an important appeal relating to data protection obligations arising from a 2017-18 cyber attack at electronics retailer Currys PC World.