As this thread might be read at some later date I post an extract from email received from PCUK:
"I have spoken with our Data Protection Officer and after careful assessment of the impact, he has taken the decision that we will not, on this occasion, be reporting ourselves to the ICO. We will, however, document the incident and record the impact to the individuals concerned. So, we can learn from our mistake and address any weaknesses in our internal controls and procedures."
This assures me and hopefully other members that safeguarding our personal details are taken seriously.
Ray