"Denham has often said that handing out an order to stop data processing would have a greater impact on a firm than a cash payout."
That option has been there since DPA v1.0. Has it ever been used?
AFAICR it looked to me back then (?the 80's!!) that, apart from anything else, it was a trip-wire in that the ICO might not be able to prosecute a criminal offence but it was in their power to impose such a ban and that breaking it did constitute a criminal offence. Of course I may have misunderstood it but it seemed like a crafty bit of legislation.