I think the ICO is not fit for purpose, they simply do not care when you report an organisation for serious GDPR breaches. Seems to me like they are an organisation in place to collect fees from organisations and not have a care in the world. I am absolutely disgusted in the ICO for they way they have handled my previous complaint about an education provider sharing student details to tutors personal emails and the arrogance in their responses.
