A theoretical question if I may.
Lets say I had an account on the CoJ's site and I discovered that there was a potential security risk, exaclty the same way as it happened recently and listed above.
The difference being is that I access my own personal details without my login and highlight that to the goofballs at CoJ, what are they going to do, open a case against me for hacking my own account or data?
No, you have accessed your own data.
The charge (section 85 and 86(1)) is not about how you have accessed it. It is about what you have accessed without permission.