The University of East Anglia broke the law but nothing can be done as the complaint was made outwith the six month limit. According to The Times today ‘The ICO is now seeking to change the law to allow prosecutions if a complaint is made more than six months after a breach.’