Say Alice makes a GDPR Subject Access Request of a data controller, and in response receives some of Bob's Personally Identifiable Information, does the Alice then become a data controller with responsibilities to Bob? Looking at the exemptions on the ICO site it does not seem that "Domestic purposes" would really cover it, as there is a connection to "professional or commercial activity" in that the data was received from such a commercial entity.
The case in question involves the response to a SAR made to a large nationally famous company. This contained a number of PDF files with embedded metadata that appears to be the name, contact email and browser user agent string of the individuals who produced the document. Considering the level of professionalism on display concerning this SAR it is quite possible the company is unaware that they are distributing this PII, but equally it is possible that they are doing it so as to restrict the possible uses this data can be put to, for example I would not want to share these online because of the expose of others PII. It is impossible to do anything with these documents without "processing" this data, it is read automatically as the documents are opened.