In this Settlement between the Capita Group and the UK ICO, the Capita Group agreed to admit to liability concerning a cyberattack, and not object to the publication of the details of the UK ICO’s enforcement action in turn for a significant reduction of the penalty (from £58 million, to £14 million). While this raises difficult questions about the fairness of this Penalty Notice, this article first briefly looks at the Background (I.) and provides a detailed review of the Facts (II.) and the ICO Penalty Notice (III.). Then a detailed Critique of the Commissioner’s Rationale (IV.) is elaborated which allows to derive six key Lessons Learned (V.).