"something along the lines that the person responsible looses their job for instance."
If it was traceable to an individual, then they will likely have embarked on a trip down the disciplinary procedures. If someone higher up was responsible for putting a procedure in place and they'd not done it, they the same may apply to them.
I've not personally had dealings with ICO incidents, but a friend at a local council has been (as an observer, not a participant, natch!) and he said the report back to the ICO was supposed to include tracing and placing of "blame" where possible and measures/sanctions taken. This implies that the ICO want to see relevant individuals at whatever level taken to task.
Biting the hand that feeds IT
