Bristol University could face criminal prosecution and compensation claims under the 1998 Data Protection Act after it sold a computer containing confidential police files on child abuse victims and alleged perpetrators.
The files contained names and addresses. Journalists have already tracked down those named. The error was discovered when the purchaser checked the hard disk.
Jonathan Bamford, assistant commissioner with the Information Commissioner, whose job it is to enforce the act, said: "We are making inquiries into what has happened at Bristol - although we have received no formal complaint."
He said that if the university was judged to be the data controller, it had a duty under the act to keep the material secure and could face prosecution if it did not improve its procedures.
Mr Bamford also said that the act gave strong powers to individuals damaged by the release of confidential information to claim compensation.
"Just imagine a situation where the names of alleged perpetrators got into the hands of the News of the World. Their publication could have serious consequences for individuals whose claims would then be high," he said.
The university said this week: "An old computer was lent to a postgraduate student and part-time tutor, who apparently sold it in 1999 without authorisation. At the time the loan was made, it was not known that the computer's hard disk contained confidential information that had been used in an important research project conducted in 1997-98."
The university said that its policy that all personal and sensitive data should be removed from any computer disposed of had been breached.
It added: "This is a matter of great concern and the university is urgently reviewing procedures to prevent anything similar happening again."
A spokeswoman for Avon and Somerset Constabulary, the source of some of the data, said that when they handed over the material, the force complied fully with the 1984 Data Protection Act then in force. "A full inquiry with all parties concerned is under way to see how this occurred," she said.
Joan Orme, professor of social work at Glasgow University and chair of the joint university council social work and education committee, said: "We have drawn up an ethics code to deal precisely with these sorts of issues. It is important in many areas of research that we have individual names, for example, when there is a need to do interviews."
Mr Bamford said: "There are no blanket rules on the release of names. Each case has to be judged on its own merits."
But he said researchers needed to be prepared to explore research methods that made the release of names unnecessary.