MPs are considering changes to data protection laws that would make chief executives directly responsible for keeping the public’s personal information safe and make the improper use of data a criminal offence.

The Information Commissioner, the head of the body charged with protecting personal data, addressed the Justice Committee of the House of Commons this week and set out demands for sweeping changes to the UK’s data regime.

Richard Thomas’s hand has been strengthened by the recent HM Revenue & Customs fiasco, in which details of 25 million Britons were lost in the post.

Lawyers said parts of his proposals resembled aspects of America's Sarbanes Oxley legislation and that the broad wording of his demands should "send shivers" through company bosses.

In the wake of the HMRC fiasco, Mr Thomas has already given warning that "alarm bells must ring in every boardroom”.

His demands include the imposition of a US-style reporting duty on "major organisations" in the UK. The legislation would include a requirement for certified confirmation from a company’s chief executive that safeguards have been put in place to protect personal data.

Paula Barrett, a partner at the international law firm Eversheds, said: “This has strong echoes of the Sarbanes Oxley legislation in the US, which has led to a frenzy of audit activity.”

Sarbanes Oxley has been criticised in the US for weighing unduly on American companies and has deterred companies from listing in New York. Companies that deal in vast amounts of customer data, such as banks and telecoms groups, would face the greatest burden should the proposals be passed into law.

Mr Thomas has also demanded that a failure to adhere to any of the eight principles of the Data Protection Act be made a criminal act if a company acted "knowingly and recklessly" and the breach resulted in a consumer suffering "damage and distress".

That would mean that charges could be brought against holders of data that pass it to other groups or against companies that fail to process data "for limited purposes" only.

Ms Barrett added: “The wave of public outrage that has met the HMRC disc loss and the Prime Minister’s reaction has given considerable strength to Mr Thomas's plea for more powers to sanction non-compliance with the Data Protection Act.”

Following the news of the HMRC data breach – the most serious in a string of similar incidents by the department – the Prime Minister said the Information Commissioner's Office would be given the power to raid government departments suspected of breaching protection laws.

Mr Thomas also wants the power to launch dawn raids on companies suspected of breaking laws. He is also asking for the power to require organisations to have an independent report on their compliance with data laws carried out.

He also wants companies to be obliged to report security breaches to the Information Commissioner and the individuals affected if there is significant risk of damage.

Times Recommends

• Minister in talks with Saudis to protect creditors
• Premier Inn hits back in £29-a-room row
• Bankers hit back at 'populist' bonus supertax