You know what the underlying cause of this is?

Accountability.

Civil servants have no incentive to enact any kind of processes to ensure compliance with DPA. Why? Because they're paid peanuts, and don't care; they're never going to be fired. So why should they care?

There's no penalty on them if they don't put in place any processes.

But what about the law, the data protection act itself, failure to comply is a criminal offence? Yes, of course it's a criminal offence, but when have you ever heard of a civil servant, or a civil sevice department/agency being prosecuted under the DPA law? Even now, with all the recent fiascos, still no one has been held accountable.

No one is personally accountable, it would be the dept. that is prosecuted (and that's highly unlikely to happen anyway).

So there are in fact, zero consequences for failing to comply with the law and no motivation to setup any processes to ensure compliance.