Sports Calendar

A body could be fined an unlimited sum in the High Court for breaching the DPA.

Sources at the ICO acknowledged this morning that the existing laws would probably hand HMRC what amounts to a “get out of jail free” card, which will see it avoid serious legal sanctions.

This is despite Richard Thomas, the Information Commissioner, telling the BBC this morning that it was “almost certain” that the Government had breached data protection laws.

Lawyers agreed with that assessment.

Q&A: how can I protect myself?

Advice for anyone who fears their personal data may be misused by fraudsters after Britain's worst ever security breach

• Government under pressure over taxman's giant blunder

Related Internet Links

• Online security: full coverage

BACKGROUND

• Police step in as other CDs have gone astray

• Moment’s blunder puts half the country at risk

• Data watchdog seeks dawn-raid powers

• New data law 'urgently needed'

Related Links

• Guide to the dangers of ID theft

• Who can you sue if lost data is misused?

• Richard Thomas: sharply critical

Sarah Needham, a Macfarlanes solicitor, said: “Companies evade financial sanctions for data breaches in the UK unless they are also regulated by other regulators.

“For example, the Financial Services Authority [FSA] has its own regime to punish data breaches.”

In February the FSA, the City watchdog, fined Nationwide £980,000 for data protection breaches involving the theft of a laptop containing customer data from an employee's home.

Lawyers noted that the ICO suffered from a lack of resources.

Alex Brown, a partner with Simmons & Simmons, said: “The ICO does not have enough people to handle the number of complaints it faces.”

In the past year the ICO has looked to shame companies with poor data protection standards into making improvements, he added.

“It was hooked on to the power of negative publicity,” he said.

Jonathan Armstrong, a partner at Eversheds, said: “The danger is that new legislation is introduced but it is not policed. A lack of consideration to legal requirements is the real issue here.”

Gus Hosein, of Privacy International, a non-governmental body that advocates for data protection laws, said that the UK was "the bad boy in the Western world when it comes to data protection. It is the furthest behind."

He said that Britain trailed far behind countries such as Germany and Canada in legislation on the issue, while 34 of America's 50 states have laws that force companies to inform the public of data breaches.

Dr Hosein said that the decision to entrust data policy to the Home Office had hampered progressive legislation in the UK.

"The Home Office can only think of ID cards when it comes to information security," he said. "That is far from the best approach."

Times Recommends

• Minister in talks with Saudis to protect creditors
• Premier Inn hits back in £29-a-room row
• Bankers hit back at 'populist' bonus supertax