[pwaring]

Technically the organisation in breach would receive a penalty, not a fine. I realise that's a bit pedantic but there is a difference (fines can usually only be made and enforced by the courts).

The ICO can also prosecute the company and officers in the criminal courts under some situations, including: "unlawfully obtaining, disclosing, or procuring the disclosure of personal data;" (I don't know whether this would count as unlawful disclosure or not).