If anyone knows the booker whose details were released, has she been contacted by LCC in line with the recommendations here? Given the concern expressed about violence and protests, I'd think this would constitute a "high risk" to the individual - if it doesn't, I'd like to know what does.
Notifications apply when there is a high risk to the private life of the affected individual. It can be assumed that if the personal data breach affects financial data, sensitive data, or data that could result in identity theft, stigmatization, or exclusion, it is considered a personal data breach that should be notified to the affected individuals.
All communications to individuals should be clear and comprehensive. This means that individuals should understand what it says and what they can do themselves to mitigate the consequences. In some countries, a copy of the communications must be provided to the data protection authority, and therefore it is very important to align the facts you provide to the individual with the facts you provide to the data protection authority. It’s also important to think about the way you want to communicate the breach, as the communication could attract unwanted media or other attention.
www.hoganlovells.com/en/publications/the-gdpr-introduces-new-notification-rules-for-personal-data-breaches