The AA's copped to credit data blurt, but what about car-crash incident response?

When we said 'Credit Card details have not been compromised', we meant"

UK motoring organisation The AA belatedly admitted late on Friday, July 7th that customer data - including in some cases partial credit card numbers - had been exposed in a recent breach. Security experts gave the confession a frosty response while a specialist IT lawyer said incident response handling of this type would risk severe sanctions when new data protection laws come into effect next May."