Civil servants face being jailed for gross failures to safeguard citizens’ personal information under a clampdown following the disappearance of two discs that held the child benefit records of 25 million people.

Ministers have accepted proposals to create criminal penalties to cover the most serious breaches of data protection law after current powers were criticised as being too weak.

Government sources told The Times that the offence of wilfully abusing data could carry a maximum term of two years’ imprisonment rather than a fine under plans being considered.

Alistair Darling, the Chancellor, told MPs that there would be new sanctions under the Data Protection Act for the most serious breaches of the Act’s principles.

Q&A: how can I protect myself?

Advice for anyone who fears their personal data may be misused by fraudsters after Britain's worst ever security breach

• Government under pressure over taxman's giant blunder

Related Internet Links

• Online security: full coverage

BACKGROUND

• Police step in as other CDs have gone astray

• Moment’s blunder puts half the country at risk

• Data watchdog seeks dawn-raid powers

• New data law 'urgently needed'

Related Links

• Gordon Brown’s Winter of Disc Content

• Record fine for Norwich Union error

• Information and Knowledge

Legislation is likely to be pushed through Parliament next year to toughen penalties and increase the powers of the Information Commissioner, the independent regulator for data protection law.

The Chancellor, who is responsible for Revenue & Customs — the department that lost the discs in October — said that Richard Thomas, the Information Commissioner, would be given powers to conduct spot checks across the public sector. Powers to carry out unannounced inspections were extended at the time, but only to Whitehall ministries.

Further changes will be considered in a consultation being conducted by Mr Thomas and Mark Wallport, of the Wellcome Trust, into the handling of personal data across the public and private sectors.

The call for tougher penalties was the chief recommendation of a review of data handling at Whitehall conducted by Sir Gus O’Donnell, the Cabinet Secretary, after the discs went missing.

He said: “Legislative steps should be taken to enhance the ability of the Information Commissioner to provide external scrutiny of arrangements. The Government should commit in principle to the introduction of new sanctions under the Data Protection Act for the most serious breaches of its principles.”

Under current law, civil servants can escape prosecution because the Information Commission has the power only to issue an enforcement notice demanding improvements in the event of a breach, however serious. It is only if the notice is ignored or its requirements not fully implemented that the commissioner can prosecute.

Mr Thomas has been pressing for another criminal offence to cover reckless breaches of data security. The commissioner welcomed the promise of extra powers but demanded that the office be “properly resourced”.

The Chancellor also published a review on how and why the child benefit records were downloaded on to discs by Revenue & Customs officials. They were to be sent by courier to government auditors but did not arrive.

The interim review by Kieran Poynter, chairman of PricewaterhouseCoopers, outlined new rules for Revenue & Customs officials handling personal data but said that it was too soon to say exactly what led to the records going missing.

Staff have been banned from storing sensitive data on discs unless it is encrypted and computers have been disabled to stop them from being used to download data. When records are sent out on discs or in other forms in future they must be sent by secure couriers and in tamper-proof packaging.

Mr Poynter’s final report will not be ready until late spring as he goes through thousands of e-mails to check which officials knew that the discs had been requested. In a statement to MPs, the Chancellor did not repeat his original claim that a junior Revenue & Customs official was to blame, although Mr Poynter said that he had seen no evidence that his original account was inaccurate.

Figures obtained by the Conservatives last month showed that there were 2,111 data protection breaches in the past year at Revenue & Customs.

Emergency checks are being carried out on all security staff at the Home Office after the department admitted that an illegal immigrant was employed to guard its headquarters.

The discovery came days after Jacqui Smith, the Home Secretary, told MPs that one tenth of 40,000 non-Europeans licensed by the Security Industry Authority as doorkeepers were immigrants with no right to work.

The man, a Nigerian employed by a sub-contractor since May last year, is thought to have been working as a doorman. He had no access to files or ministerial offices. He has been arrested and is subject to deportation action.

Meanwhile, police were investigating the disappearance of 1.5kg (3.3lb) of cocaine, with a street value of £75,000, from a lock-up in Coventry. David Hartnett, acting chairman of Revenue & Customs, said that he did not know whether the drug had been sent to a court, destroyed or stolen or whether the paperwork had not been completed properly.

Times Recommends

• Oh no, Mr Darling: you have failed
• BBC survives dogfight over Kennel Club expose
• Where the Rosetta belongs can’t be set in stone