Morrisons ‘faces vast leak payout’
SUPERMARKET giant Morrisons faces a potentially “vast” payout after losing a challenge against a ruling which gave the goahead for compensation claims by thousands of staff whose personal details were posted on the internet.
Three Court of Appeal judges in London announced their decision yesterday on the issue of liability in the latest round of the first data leak class action in the UK.
Litigation was launched after a security breach in 2014 when Andrew Skelton, a senior internal auditor at the retailer’s Bradford headquarters, leaked the payroll data of around 100,000 employees.
Information included names, addresses, bank account details and salaries.
A group of 5,518 former and current employees said this exposed them to the risk of identity theft and potential financial loss and that Morrisons was responsible for breaches of privacy, confidence and data protection laws.
They are seeking compensation for the upset and distress caused in a case with potential implications for every individual and business in the country.
Morrisons said it could not be held directly or vicariously liable for the criminal misuse of the data, and that any other conclusion would be grossly unjust.
But a High Court judge found in December that vicarious liability had been established.
The company challenged that finding at a recent Court of Appeal hearing before Master of the Rolls Sir Terence Etherton, Lord Justice Bean and Lord Justice Flaux.
Rejecting the appeal brought by Morrisons, the appeal judges said they agreed with the High Court judge that Morrisons was “vicariously liable for the torts committed by Mr Skelton against the claimants” and dismissed the appeal.
In July 2015, Skelton was found guilty at Bradford Crown Court of fraud, securing unauthorised access to computer material and disclosing personal data and jailed for eight years.
During the hearing, Anya Proops QC, for Morrisons, told the judges that, if the High Court decision was allowed to stand, the company was exposed to “compensation claims on a potentially vast scale”.
Ms Proops said the company, although “entirely blameless”, was potentially exposed to compensation claims not only in respect of the 5,518 but from all the individuals affected by the criminal disclosure.
After the ruling, Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, who represents the claimants, said: “This latest judgment provides reassurance to the many millions of people in this country whose own data is held by their employer. The judgment is a wake-up call for business. People care about what happens to their personal information.”
A spokesman for Morrisons said: “We are not aware that anybody suffered any direct financial loss. We believe we should not be held responsible so that’s why we will now appeal to the Supreme Court.”