Morrisons wins data breach Supreme Court Appeal

West Yorkshire based supermarket chain Morrisons has successfully appealed against the decision that it was liable for a serious data breach which was committed by a disgruntled employee.

Andrew Skelton was employed by Morrisons as a senior internal auditor.  Following disciplinary action against him he leaked the payroll data of almost 100,000 employees in revenge. Mr Skelton was subsequently convicted following his actions and sentenced to an eight year prison term.

9,000 Morrison employees brought a group action against their employer for the data breach.

In a welcome decision for employers the Supreme Court decided that the actions of Mr Skelton in disclosing the data online were not part of his “field of activities”, as it was not an act he was authorised to do.

The court decided that employers should only be liable for the actions of employees if they were “closely connected” with their duties at work.

In a statement Morrisons stated “We are pleased that the Supreme Court has agreed that Morrisons should not be held vicariously liable for his (Mr Skelton’s) actions when he was acting alone, to his own criminal plan and he’s been found guilty of this crime and spent time in jail”.

The claims of 9,000 Morrison employees have now failed. Whilst this outcome is a case businesses will welcome it must be remembered this was a very unique case and highlights the importance of ensuring that businesses have their GDPR systems and obligations firmly in place.

Other large group actions for data breaches are already progressing in the courts and we have no doubt that both individuals and groups of employees will attempt to recover compensation for data breaches in the future.

It is therefore vital businesses continue to ensure they have undertaken and continue to review their data protection system.

Should you require advice on any data protection issue please contact our expert regulatory team at Chadwick Lawrence on nicholasworsnop@chadlaw.co.uk or nilso@chadlaw.co.uk.