Anyone who loses out financially as a result of mistakes at HM Revenue and Customs is likely to be compensated by their bank – but if they have the appetite they could also sue the Revenue.

The Data Protection Act 1988 is structured around eight broad principles. Principle seven states that a body which holds information about an individual must take appropriate technical and organisational precautions to protect against unauthorised processing or loss of the data.

Section 13 of the Act says that any individual who suffers a loss because of a breach of the principles in the Act – including principle seven – is entitled to compensation from the body that holds the data.

Tim Pitt-Payne, a barrister at 11KBW chambers and visiting professor of information law at Northumbria University, believes that Alastair Darling - through statements made to the Commons yesterday and on the BBC this morning - has “pretty much admitted” that the Revenue breached principle seven.

Q&A: how can I protect myself?

Advice for anyone who fears their personal data may be misused by fraudsters after Britain's worst ever security breach

• Government under pressure over taxman's giant blunder

Related Internet Links

• Online security: full coverage

Background

• Police step in as other CDs have gone astray

• Moment’s blunder puts half the country at risk

• Data watchdog seeks dawn-raid powers

• New data law 'urgently needed'

Related Links

• Pressure on Government over taxman's blunder

• Data watchdog seeks dawn-raid powers

• Q&A: how can I protect myself?

This makes the Revenue liable to anyone to who suffers a loss through their error.

Unless it can be shown that a Revenue employee deliberately conspired to release the data, neither the individual responsible, nor his boss, nor ultimately David Gray or any other senior Revenue staffer can be held personally liable. The Revenue itself is at fault.

The problem – as often in litigation – is that anyone who attempts to sue the Revenue must be able to identify their loss - and prove that it was a result of the Revenue’s mistake.

According to Mr Payne, that loss must be actual and financial. “You can’t sue the Revenue just for the stress, anxiety or worry of knowing or fearing that your personal details had been lost and you might become a victim of identity fraud,” he said.

However, if you can prove a financial loss – such as money missing from a bank account – and you can show it is likely that the money was stolen because of the Revenue’s mistake, you can make a claim against the Revenue. (Once you have proven a financial loss, you can claim additional compensation for anxiety or stress, but you cannot claim on the basis of anxiety/stress alone.)

Proving a financial loss is relatively simple. If your bank statement shows an unauthorised withdrawal of £1,000 - you have a loss. In most cases, the bank is likely to replace the money and so the Revenue could claim that no loss has actually been suffered.

But suppose there are circumstances in which the bank does not immediately repay the £1,000 – here we have a quantifiable loss. It is in cases like this that individuals would be able to sue the Revenue but they still need to pass the second test: proving the loss was the Revenue’s fault.

This is more difficult but not impossible. In the absence of, for instance, police evidence tying the lost disks to an individual’s bank account, the Revenue may argue that identity fraud is commonplace and there is no direct link – or causality – between the lost disks and your own financial loss.

However, this sort of compensation claim would be made in a civil rather than a criminal court and so the burden of proof is lower. So although it is up to the individual to prove the link between the disks and their loss, they need only show that it is likely to have happened “on the balance of probabilities” that is, more likely than not.

Sarah Webb, partner and expert in information law at Russell Jones & Walker, believes that if an individual who has never previously suffered from identity fraud becomes a victim in the next few weeks or months, then even without police evidence, a court could be persuaded that the Revenue is likely to have been responsible and will award damages.

In short, Ms Webb, believes, it could be worth a try.

Rob Murray, a partner at litigation law firm Cohen, Milstein Hausfeld & Toll, said he had already received an inquiry from a member of the public considering their legal rights in the event of a loss. "We are investigating a number of possible causes of action which may exist or arise,” he said.

Explore UK News

• Crime News

• Education News

• Health News

• Science News

• Scotland News

Times Recommends

• 20mph limit to cut urban road deaths
• Great grades not needed to be a good doctor
• The survivors' tales