The loss by HM Revenue & Customs (HMRC) of two CDs containing details of 7.5 million families - 25 million individuals - begs the question of who can be found liable if the data falls into the wrong hands?

Hopefully, like so much lost post, the CDs will never surface, but there can be no doubt that the substantial element of family information contained within the datasets will make the CDs of unprecedented interest to people - traffickers, in particular. These criminals need a large number of robust identities to help settle illegal immigrants and imported sex workers. To them, the CDs provide details of children about to reach majority over the next 18 years and it's a potential time bomb for the security of the identity of our nation's children for a very long time to come.

There is one piece of information that is not contained within the CDs which identity fraudsters require to obtain (lawfully) the birth certificates of victims, and (unlawfully) their passports. That is 'place of birth'. We should all be on our guard that if someone emails, phones or corresponds with us to request place of birth information, that single phrase should immediately light up a blazing beacon of caution.

Most commentators suspect that the data may be used to impersonate creditworthy consumers for financial crime. In that event, the banks already voluntarily agree to indemnify their customers in case of loss, under the Banking Code. They are not legally obliged to do so. The Government's assurance given yesterday to the banking sector that it will indemnify any losses incurred by the potential HMRC data breach, is no doubt a comforting one for the banks and also for their customers.

In law, consumers have the right to compensation under the Data Protection Act 1998 for any abuse of their personal data. If a consumer exercised that right against the HMRC, it's possible that the HMRC could claim Crown immunity. Crown immunity is a general protection against prosecution given to the Queen and 'her departments'. Crown immunity has long been subject to erosion. It doesn't grant protection to individuals from prosecution, nor from civil actions. A test case against the HMRC's Data Controller or even against the civil servant who posted the CDs would undoubtedly open a can of worms. Or, a case for compensation could be taken to the European Courts.

If Crown immunity is used in defence, the Government would effectively be saying that whilst all of us should abide by Data Protection law, it doesn't need to. The Nationwide Building Society was recently fined £1 million by the Financial Services Authority for the loss of 11 million records, but the HMRC will not be fined for this, more substantial, loss, so there is already an imbalance of consequence.

With the very large condition that the CDs must firstly fall into the wrong hands and, secondly, the data be abused, the HMRC is then culpable to compensation claims from consumers. As this is the second data loss by the HMRC in almost as many weeks, the HMRC will find it difficult to claim that this is a one-off human error. Ultimately, a cynical view is that any compensation paid for by HMRC will be collected back in increased taxes, so the consumer will end up paying.

Prevention is the key to avoiding losses from identity theft and Lawpack's Self-Help Identity Theft Kit not only shows how to reduce becoming a victim of impersonation fraud, but it also shows how to obtain credit report monitoring and victim assistance services entirely for free. The many tips contained within the Kit cost nothing to implement and will significantly reduce the risk of identity theft.

Further information
Internet fraudsters hit every ten seconds
ID theft subscriptions: Are they worth the money?
Protect yourself by buying Barry's Indentity Theft Kit