If an organisation should register under the Data Protection Act (for some or all of its activities) but does not, then the registrar cannot enforce the principles of good practice on which the Act is based, and individuals are wholly deprived of their rights established by the Act, including, for instance, the (qualified) right to obtain a copy of their personal data and to correct this information, if necessary.
All that the registrar can do in those circumstances, if appropriate, is to prosecute the organisation for non-registration (a criminal offence). In this context it is perhaps worth pointing out that the intelligence services are not government departments and, therefore, could be prosecuted by the registrar.
Data Protection News
Cap Gemini UK plc
London SW8Reuse content