Morrisons faces ‘vast’ payout over data leak

MORRISONS could face a “vast” payout after losing a challenge against a ruling that opened the gate to compensation claims by thousands of staff whose personal details were posted online.

The case centres on a 2014 breach when Andrew Skelton, a senior internal auditor at the retailer’s Bradford HQ, leaked payroll data of about 100,000 employees, including names, addresses, bank account details and salaries.

A group of 5,518 former and current employees are seeking compensation for the upset and distress caused, holding the supermarket giant responsible for breaches of privacy, confidence and data protection laws.

In 2015, Skelton was jailed for eight years at Bradford Crown Court for fraud, securing unauthorised access to computer material and disclosing personal data.

Morrisons claimed it could not be held directly or vicariously liable for the criminal misuse of the data.

But in 2017 a High Court judge found vicarious liability had been established.

Morrisons appealed the ruling, claiming it was “blameless” but would potentially be exposed to claims not only from the 5,518 but from all individuals affected by the criminal disclosure.

It argued there was no dispute that “Skelton effected his criminal disclosure as an act of vengeance” to damage the company.

Yesterday the appeal was dismissed in a ruling that has implications for other firms.

Nick McAleenan, a data privacy law specialist at JMW Solicitors, who represents the claimants, said: “These shop and factory workers have held one of the UK’s biggest organisations to account and won. This judgment provides reassurance to many millions of people in this country whose own data is held by their employer.

“The judgment is a wakeup call for business. People care about what happens to their personal information.

“They expect large corporations to take responsibility when things go wrong in their own business and cause harm to innocent victims.”

A Morrisons spokesman said the company would appeal to the Supreme Court.

He said: “We are not aware that anybody suffered any direct financial loss.”