Just a thought, but there have been several offences committed under the DPA98.
The obvious one is the failure to implement proper safeguards to protect the data. I suggest this is the lesser of the crimes. As the Government says, you cannot legislate against this form of human endeavour.
The second, and far more serious offence, IMHO, is the retention of data beyond the period when it would have been reasonable to retain such data. This is clearly a systemic failure going on for more than 10 years.
Clearly no one saw the need to do a filter sort and archive or delete data. I suppose they would argue the need to retain information on a 16 year old as he may eventually return and reapply many years down the line. But to retain the data on an active list or out of archive!