MPs are considering changes to the law that would make chief executives directly responsible for safeguarding the public’s personal data and make the improper or careless treatment of personal information a criminal offence.

The toughening of data laws, which is likely to be fiercely opposed by companies that deal with large amounts of personal data, such as banks, search engines and telecoms groups, is likely to follow a presentation by Richard Thomas, the Information Commissioner, to the Justice Committee of the House of Commons.

His call for radical changes to data law has been strengthened by the recent HM Revenue & Customs data breach, in which details of 25 million Britons were lost in the post.

Mr Thomas’s demands include the imposition of a US-style reporting duty on “major organisations” in the UK. The legislation would also include a requirement for certified confirmation from a company’s chief executive that safeguards have been put in place to protect personal data.

Paula Barrett, a partner at Eversheds, the law firm, said: “This has strong echoes of the Sarbanes Oxley legislation in the US, which led to a frenzy of audit activity.” She added that the broad phraseology that Mr Thomas has suggested for the laws should “send shivers” through company bosses. Following the Revenue fiasco, Mr Thomas said that “alarm bells must ring in every boardroom”.

Sarbanes Oxley has been criticised in the US for weighing unduly on American companies and has deterred companies from listing in New York. Experts have suggested that a revamped data regime in the UK could see companies relocate data centres overseas to avoid inflated costs. The UK is seen as liberal on data security standards. Already the Government is being investigated by the European Commission for failing to implement the Data Protection Act strenuously enough.

Mr Thomas wants any failure to adhere to the eight principles of the Act, which is based on a European directive, to be made a criminal offence if a company or individual acts “knowingly and recklessly” and the breach results in a consumer suffering “damage and distress”. That would mean charges could be brought not only if companies lose data but also if, for example, they fail to process it only “for limited purposes”.

However, experts doubt that Mr Thomas will achieve all his demands. Ms Barrett said: “The wave of public outrage that has met the HMRC disk loss and the Prime Minister’s reaction has given considerable strength to Mr Thomas’s plea for more powers to sanction noncompliance with the Data Protection Act.”

Following the Revenue’s data breach - the most serious in a string of similar incidents - the Prime Minister said the Information Commissioner would be given the power to raid Government departments suspected of breaching data laws.

Mr Thomas, who has developed a reputation among industry analysts as a “shrewd operator”, wants the additional power to launch dawn raids on companies. He is also asking for the power to require organisations to have an independent report on their compliance with data laws.

Under his proposals, companies would also be obliged to report security breaches to the Information Commissioner and the individuals affected.

Times Recommends

• Toyota recalls 437,000 cars including Lexus
• Myners says bonuses are bleeding pension funds
• Japanese company faked safety reports on seats