The ICO should issue the maximum fine for a data breach for that act alone, plus a fine for each case.
That will have absolutely zero effect - they will be paying that with your tax money anyway so all you do is sponsor some lawyers and accountants to ship some money around.
I think this is really enquiry level stuff as it keeps happening - clearly something is fundamentally wrong there and it is time someone start digging deep enough that people start paying attention. This is not some expenses for a duck house - it's on an entirely higher scale altogether, also because that just happens to contain data from an extremely sensitive investigation. Call me cynical, but I have long stopped believing in accidents.
PNN and GSI have been around for some 15 years or so - don't try to tell me they have as yet to develop a way to securely transport data of that level of sensitivity, because then I want to know how it is possible that Youth Justice cases (read: concerning minors) ARE going via email.
It's time to stop the excuses - it's all too easy to say, "oops, silly me again". Until there is some personal accountability introduced this is not going to improve, and an enquiry will at least start to heat up some rear ends.