The data protection principles
The seventh principle
Appropriate technical and organisational measures shall be taken against
unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data...
Interpretation of the principles in Part I
9 Having regard to the state of technological development and the cost of
implementing any measures, the measures must ensure a level of security
(a) the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage as are mentioned in the seventh principle, and
(b) the nature of the data to be protected.
My contact gives a lot of other reasons why a law suit could work, but they are very technical so I won't bore you with them here. But while the thought of 25 million taxpayers suing the government amuses me, I suppose we'd better remember that they would, in effect, be suing themselves. After all all, it's the PBT (poor bloody taxpayer) mwho's end up paying the fine or damages.