Currently, it is an offence punishable by a fine of up to # 5,000 on summary conviction or unlimited on conviction on
indictment,
under s 55 of the Act for
anyone «to sell or offer to sell personal data which has been (or is subsequently) obtained / procured knowingly or recklessly without the consent of the data controller».