It was a very useful snapshot of the breach reporting activity just before and post GDPR. It seems that organisations are over reporting because they are not properly risk assessing the impact of the breaches. Organisations could adopt a risk approach such as ENISA's Recommendations for a methodology of the assessment of severity of personal data breaches. See: https://www.enisa.europa.eu/publications/dbn-severity
Although this is a few years old, this is still relevant (perhaps more relevant) today. Most of these were probably swept under the carpet before, but all these incidents should be properly risk assessed in terms of their impact using an objective approach to decide the level where the breach is reportable.
Another interesting subject was that organisations are not reporting at the correct time, i.e. rushing to notify before full facts were known (the example of payroll being lost and found an hour later) or phoning the ICO on a Friday afternoon (leaving it until the last minute) when the phone lines seem to be busiest.
I'm sure this will settle down over time as we get used to the new landscape. It's definitely worth a view, if only to see this from the ICO's perspective.
