Fining the directors?
Following through the links, it isn't clear if the Privacy and Electronic Communications Regulations were actually amended to give the ICO the power to go after the directors. This was supposed to be in place by "Spring 2017".
Is it? Or just another thing that ministers promised but were far too busy to actually deliver, and now they'll forget about it because they're busy pissing around with another election?