Virgin's decision to publish CCTV images of Jeremy Corbyn—after the Labour leader claimed he was travelling on a "completely ram-packed" train—didn't breach data protection law, the UK's privacy watchdog has ruled.

However, the Information Commissioner's Office confirmed on Wednesday that Virgin Trains did break data law by failing to obscure the faces of other passengers who were travelling on the same East Coast service from London.

Following a lengthy probe of Virgin's seemingly unprecedented release of CCTV images—one of which showed Corbyn passing through an empty carriage that appeared to have lots of reserved seats—the regulator concluded that the train operator had "legitimate interest" to publish stills from the footage it had of the Labour leader.

"It would not have been possible to achieve Virgin's legitimate interests without publishing Mr Corbyn's image," said the ICO's head of enforcement, Steve Eckersley. "Virgin could only show that there were empty seats on Mr Corbyn's journey if they showed Mr Corbyn on that journey."

The watchdog added that Corbyn had "different expectations" about his privacy while on the train because he had made a video during the journey in August last year. The politician had complained:

This is a problem that many passengers face every day on the trains, commuters and long distance travellers. Today this train is completely ram-packed. The staff on the train are absolutely brilliant, working really hard to help everybody. The reality is there's not enough trains, we need more of them.

Virgin had legitimate interest, under the UK's Data Protection Act, to "respond in kind," the ICO said. But the train operator screwed up, in its apparent haste to publish the CCTV images, by failing to obscure the identity of other passengers on the service.

"In order to give its side of the story, Virgin had no reason to publish pictures of anyone else on the train," Eckersley said. "By doing so, it infringed on the privacy of passengers who were simply minding their own business and would not reasonably have expected their pictures to be published."

Despite the boob, Virgin hasn't been slapped with formal regulatory action because the ICO believed it to be a "one-off incident" that hadn't led to "serious distress or detriment" for the three passengers identified in the CCTV images—none of whom complained directly to the watchdog.

Mr Corbyn & team walked past empty unreserved seats then filmed claim train was ‘ram-packed’ https://t.co/R5hawIpQek pic.twitter.com/22t8EkjW5l — Richard Branson (@richardbranson) August 23, 2016

In light of the investigation, Virgin has agreed to bolster its data protection training across the company. "It will amend its CCTV policy to take account of exceptional circumstances and ensure it has easy access to pixelation services should the need arise again," Eckersley said. "We did not deem it proportionate to use our regulatory stick on this occasion."

Ars sought comment from Virgin Trains, but it hadn't responded at time of publication.

Update

After publication of this story, Virgin Trains told Ars: "We welcome the ICO's report which acknowledges the unique nature of the incident, and confirms that no regulatory action is needed. We have co-operated fully with the ICO's investigation and have already implemented the improvements to our procedures that we suggested."

It didn't, however, apologise for revealing the identity of some of its passengers in its very public spat with Corbyn.