The Information Commissioner’s Office (ICO) has fined an estate agency £80,000 for leaving more than 18,000 customers’ personal data exposed for almost two years.