The personal financial data of millions of taxpayers could be sold to private firms under laws being drawn up by HM Revenue & Customs in a move branded "dangerous" by tax professionals and "borderline insane" by a senior Conservative MP.

Despite fears that it could jeopardise the principle of taxpayer confidentiality, the legislation would allow HMRC to release anonymised tax data to third parties including companies, researchers and public bodies where there is a public benefit. According to HMRC documents, officials are examining "charging options".

The government insists that there will be suitable safeguards on personal data. But the plans, being overseen by the Treasury minister David Gauke, are likely to provoke serious worries among privacy campaigners and MPs in the wake of public concern about the government's Care.data scheme – a plan to share "anonymised" medical records with third parties.

The Care.data initiative has now been suspended for six months over fears that people could be identified from the supposedly anonymous data, which turned out to contain postcodes, dates of birth, NHS numbers, ethnicity and gender.

HMRC's chequered record on data is likely to come under scrutiny given historical scandals involving the loss of personal information about 25 million child benefit claimants and 15,000 bank customers.

Critics fear the data could include details about income, tax arrangements and payment history and would carry a risk that people could be identified. Even the perception that this could happen may lead to a breakdown in trust between HMRC and taxpayers, the Chartered Institute of Taxation warned.

Ross Anderson, a professor of security engineering at Cambridge University, said the information could be highly useful to credit rating agencies, advertisers, and retailers wanting to practise price discrimination.

He also raised concerns about any government claims to have made data fully anonymous.

"This is going to be a big battleground," he said. "If they were to make HMRC information more available, there's an awful lot of people who would like to get their hands on it. Anonymisation is something about which they lied to us over medical data … If the same thing is about to be done by HMRC, there should be a much greater public debate about this."

The Tory MP David Davis, a former minister and shadow home secretary, described the proposal as "borderline insane", adding: "The Treasury lists no credible benefits and offers a justification based on an international agreement that does not lead other governments to open up their tax database," he said. "The officials who drew this up clearly have no idea of the risks to data in an electronic age. Our forefathers put these checks and balances in place when the information was kept in cardboard files, and data was therefore difficult to appropriate and misuse.

"It defies logic that we would remove those restraints at a time when data can be collected by the gigabyte, processed in milliseconds and transported around the world almost instantaneously."

HMRC has not made clear exactly what bits of data it would share and with whom, but it has a wealth of information about people living in Britain. Its director of risk and intelligence said in 2012: "We have more data than the British Library."

The government has strict rules about what can be released outside HMRC, with a near total ban on data sharing unless it is beneficial for the organisation's internal work. But despite the restrictions, HMRC has quietly launched a pilot programme that has released data about VAT registration for research purposes to three private credit ratings agencies: Experian, Equifax and Dun & Bradstreet.

To comply with the law, the private ratings agencies, which determine credit scores for millions of people and businesses, have been contracted to act on behalf of HMRC and are "therefore treated as part of the department" – giving them access to tax data about businesses that would otherwise be confidential.

The government's plans to change the law to allow the sale of anonymised individual tax data and release of the VAT register were buried in documents as part of the autumn statement and recent budget.

Emma Carr, of Big Brother Watch, said the government should not try to sneak the plans through without a public debate. She said: "The ongoing claims about anonymous data overlook the serious risks to privacy of individual level data being vulnerable to reidentification."

During the consultation process officials acknowledged there were "concerns around the dangers of individual identities being disclosed inadvertently" but they believe the data can be appropriately protected.

Stephen Coleclough, president of the Chartered Institute of Taxation, said HMRC had failed to grasp the "worrying and dangerous" implications of what would be made into law.

"We are concerned that even the strictest safeguards and deterrents may not prevent misuse of the data, or identification of the underlying taxpayer," he said. "There are already examples of aggregate data being provided at such a granular level which would enable identification of the relevant individuals, and we are anxious that any broadening of HMRC's powers of disclosure will inevitably lead to the identification of individuals, and a consequential breakdown in trust between HMRC and taxpayers, not to mention contravention of legislation such as the Human Rights Act."

The Treasury confirmed it was proceeding with plans to legislate to make aggregated and anonymised data more widely available, as set out in an HMRC document that said: "The government has decided to proceed with the proposal to remove the legal restrictions that currently limit HMRC's ability to share anonymised individual level data for the purpose of research and analysis and deliver public benefits wider than HMRC's own functions, but they accept that this must be done only where there are sufficient safeguards in place to protect taxpayer confidentiality.

"HMRC is committed to protecting its customers' information. We shall be consulting further on implementing the proposals for sharing anonymised data, and would only take forward specific measures where there was a clear public benefit and subject to suitable safeguards."

• This article was amended on 19 April 2014. In the original, an error in the editing process resulted in comments by Stephen Coleclough being mistakenly attributed to Ross Anderson