A £500,000 penalty has been introduced by the Information Commissioner's Office (ICO) for personal data security breaches.