There are two crimes. One is theft, the other negligence.
http://www.legislation.gov.uk/ukpga/1998/29
75 matches for 'offence' on that page.
Sections 61 and 47 are particularly relevant. European data protection legislation really does have teeth, though the Commissioner has to have the will to use it.