I agree that the fine is totally inadequate, but this was a statutory court fine, and he will have a criminal record: "The defendant pleaded guilty to unlawfully obtaining data in breach of s55 of the Data Protection Act 1998 when he appeared at Manchester and Salford Magistrates’ Court." However, because he was only fined, the conviction will be "spent" after twelve months, so he won't have to disclose it after the year is up.
The ICO civil monetary penalties apply to statutory data controllers, and weren't applicable to this scumbag. Whether the company had taken all necessary precautions I can't say, but the appearance is of a rogue employee, with the company acting to track down and report them.
Biting the hand that feeds IT
