Virgin Trains East Coast did not break data protection law when it released CCTV footage of Jeremy Corbyn looking for a seat on a train in August last year, the information watchdog has ruled.
But the operator "should have taken better care" to obscure other passengers' faces, according to the Information Commissioner's Office (ICO).
Virgin had "no reason to publish pictures of anyone else on the train" and this was a breach of the Data Protection Act, the ICO found.
The watchdog stopped short of formal regulatory action against the train firm to reflect "the exceptional circumstances of the breach".
The so-called Traingate controversy began when Mr Corbyn was filmed sitting on the floor of a carriage and claiming he was unable to find a seat on the "ram-packed" service from London to Newcastle in August last year.
Virgin then released CCTV footage showing the Labour leader walking past an array of empty seats.
Sir Richard Branson, who co-owns the rail operator with Stagecoach, got involved in the row by posting a link to the images on his Twitter account.
Mr Corbyn later insisted he had wanted two seats together so he could talk to his wife.