Victory for store’s staff over data leak legal fight

Morrisons set to battle on after judges allow appeal

YORKSHIRE SUPERMARKET giant Morrisons has lost a key ruling over compensation claims by thousands of staff whose personal details were posted on the internet.

Three Court of Appeal judges in London announced their decision yesterday on the issue of liability in the latest round of the UK’s first data leak class action, a case already described as a “wake-up call” for industry by a privacy law specialist.

Morrisons, which could face vast payouts, has said it is prepared to go on fighting at the Supreme Court.

Litigation began after a security breach in 2014 when Andrew Skelton, a senior internal auditor at the retailer’s Bradford headquarters, deliberately leaked the payroll data of around 100,000 employees. Information included their names, addresses, bank account details and salaries.

A group of 5,518 former and current employees said this exposed them to the risk of identity theft and potential financial loss and that Morrisons was responsible for breaches of privacy, confidence and data protection laws.

They are seeking compensation for the upset and distress caused in a case with potential implications for every individual and business in the country.

Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, who represents the claimants, said: “The judgment is a wake-up call for business. People care about what happens to their personal information. They expect large corporations to take responsibility when things go wrong in their own business and cause harm to innocent victims.

“It’s important to remember that data protection is not solely about protecting information – it’s about protecting people.”

He said the claimants were delighted with the Court of Appeal’s ruling, adding: “This case involves a significant data leak which affected more than 100,000 Mor- risons employees – checkout staff, shelf-stackers, and factory workers; hard-working people on whom Morrisons’ entire business relies.”

He said staff were obliged to hand over personal information and had every right to expect it to remain secret, and they were put at risk of fraud or identity theft.

A spokesman for Morrisons said: “A former employee of Morrisons used his position to steal data about our colleagues and then place it on the internet and he’s been found guilty for his crimes.

“Morrisons has not been blamed by the courts for the way it protected colleagues’ data but they have found that we are responsible for the actions of that former employee, even though his criminal actions were targeted at the company and our colleagues.”

He said Morrisons “worked to get the data taken down quickly”, adding: “In fact, we are not aware that anybody suffered any direct financial loss. We believe we should not be held responsible so that’s why we will now appeal to the Supreme Court.”