It may be a while since I worked in data and dialer management but while the the regulations have expanded they haven't changed that much and they can't have it both ways. At the start of Hansard Sackman is saying that the information shared with an AI company (not a marketing or data supply company which suggests this was to do wtih improving site functionality) potentially included personal data such as name, date of birth and address, but the wording also suggests that the information shared was the same information that was publicly available directly from the courts. Yet by the end of the document the she changes tack to state that personal date was shared, in which case they were legally obligated to contact the ICO within 72 hours of discovering the breach. Any Data Officer worth the title would have known that sharing personal data without authorisation more than crosses the threshold which makes this come across as a deliberate attempt to not involve the ICO.
Hanlon's razor is all well and good but this is a level of incompetence that just comes across as suspicious.
