Morrisons staff win landmark data leak case

MORRISONS may have to compensate thousands of its employees whose personal details were leaked by a disgruntled worker after a court ruled the supermarket was liable in a landmark legal case.

Supermarket employees brought a claim against Morrisons after former senior auditor Andrew Skelton stole their data, including home addresses, bank details and salaries, and posted them online in 2014. A High Court judge found in favour of the 5,518 Morrisons employees and said that the supermarket was “vicariously liable”, meaning a compensation claim for “upset and distress” could go ahead. The decision now has potential implications for any organisation that suffers a significant data breach.

“Although this case is being seen as the first data protection class action, Morrisons has lost on the very old employment law principle of vicarious liability,” said Jo Sanders, partner at Harbottle & Lewis. “This has a very harsh effect for any business which falls victim to a crime perpetrated by a rogue employee, yet can still be held to blame.” Mr Justice Langstaff ruled that Morrisons was not at fault in terms of its data protection policy and gave the supermarket immediate grounds to appeal after saying he was “troubled” that the outcome of the case could “render the court an accessory in furthering [Mr Skelton’s] criminal aims”.

Morrisons will be immediately appealing against the decision with the Court of Appeal.