It isn't about 'blaming City'. Data Protection laws are there to protect the data subjects and ensure any data controller processes data fairly and with adequate security.
If this case did become of interest to the ICO, the first question they would ask is 'how did the Liverpool employees get hold of the password?'. We don't know how they knew, but it would appear to be entirely on City that they did. It doesn't matter what 'Liverpool' did, City allowed it to happen and failed to keep data they hold safe.
Both Liverpool and City reached an agreement that the matter would go no further, no data subjects complained and no action was taken by any authorities. Both sides have a lot to answer for, but everyone agrees it's done with.