Fears that Britain was slipping into a surveillance society were heightened yesterday as Brussels initiated legal action after declaring that UK laws guaranteeing data protection were “structurally flawed” and well below the European standard.

The criticism arose after the European Commission investigated the use of “behavioural advertising technology” by British internet service providers, which it found was illegal under European — but not British — law.

“I call on the UK authorities to change their national laws and ensure that national authorities are duly empowered and have proper sanctions at their disposal to enforce EU legislation on the confidentiality of communications,” Viviane Reding, the European Commissioner for Information Society and Media, said.

A Commission statement yesterday said that Brussels had sent several letters to the British authorities since last July asking why the Government had not taken action against BT after the company used Phorm technology — a covert method of targeting advertising based on user browsing habits — to secretly monitor the internet activity of 30,000 broadband customers in trials between 2006 and 2007.

“Following an analysis of the answers received, the Commission has concerns that there are structural problems in the way the UK has implemented EU rules ensuring the confidentiality of communications,” the Commission said.

Brussels criticised the Government for putting consumers at risk by failing to implement adequate safeguards against data loss. A series of high-profile incidents, including the loss by Revenue & Customs in 2007 of two CDs containing the personal details of 25 million people — showed that protection of personal data in the UK was “not done in a way a citizen would expect”, an EU official, who wished to remain anonymous, said.

“We’re not satisfied that the UK is adequately protecting citizens’ data,” a Commission spokesman said. “There is a structural problem. We wouldn’t use that word unless we believed it was a serious case.”

He added: “Unlike in European law it is often harder in the UK to prove that data has been misused. Even if that happens, there are no serious measures. Other countries have fines and can even impose a criminal offence.”

The Commission pointed out that the UK had no regulatory body charged with controlling the monitoring of communications by private companies.

Richard Thomas, the Information Commissioner, does not have any power to enforce the Regulation of Investigatory Powers Act, which governs interception, and the Office of the Surveillance Commissioners can only investigate interceptions by public authorities. In February Mr Thomas told The Times that his office required more powers to investigate private companies suspected of data breaches. He also criticised the Government for introducing a series of laws that risked “hard-wiring surveillance” into the British way of life.

The Government has two months to respond to the “infringement proceedings” — the first stage of a legal process that could end up in the European Court of Justice for an alleged breach of the EU Data Protection Directive.

Despite complaints from those affected by the trials, and privacy campaigners, the Government took no action against BT or Phorm. City of London Police dropped its investigation last year, saying the scheme was legal as customers had “implicitly consented” to be monitored.