If I had to choose, I would prefer if my sensitive data was entirely handled by specialised, established 3rd party entity (with good record) than by newly formed ICO project 'team'. The latter almost always have no relevant experience and, even with no malicious intentions, the risk of mishandling data is too high.