[flooq]

Yes, if it happened today it'd be covered by the Data Protection Act 2018, which is the UK implementation of GDPR. The limit has increased to £17 million or 4% of annual global turnover (whichever is higher).