I don't think we've explicitly specified the penalty. It's something that needs to be further discussed, but we've said that should be subject to sanctions.
Our recommendation nine suggests that the offences section be expanded. On data breach notification, our recommendation is that there be tough penalties for that and not simply injunctive relief, which is appropriate for other kinds of problems.