Magistrates’ courts are no longer limited to £5,000 fines for criminal offences under the DPA following the entry into force of the Legal Aid, Sentencing and Punishment of Offenders Act 2012 (Fines on Summary Conviction) Regulations 2015 on 12 March 2015. The Regulations allow for an unlimited fine where individuals are convicted under section 55 (offence of obtaining or disclosing personal data without the consent of the data controller).

http://www.legislation.gov.uk/uksi/2015/664/pdfs/uksi_20150664_ en.pdf