The Court of Appeal has dismissed the case against the High Court’s decision that Morrisons was vicariously liable for its employee’s misuse of data.
Back in 2014 Andrew Skelton, a former senior auditor at the supermarket giant, stole the personal data of more than 100,000 employees and posted it online. Although the individual involved was charged and jailed for the offence in 2015, Morrisons has since faced a claim of vicariously liability.
This latest decision comes despite Morrisons’ argument that it had done as much as it reasonably could to prevent the misuse of data, and that the employee had intentionally set out to cause reputational or financial damage to the supermarket.
The Court of Appeal judgment found that: “Adopting the broad and evaluative approach encouraged by Lord Toulson in Mohamud, there was a sufficient connection between the position in which Mr Skelton was employed and his wrongful conduct, put into the position of handling and disclosing the data as he was by Morrisons, to make it right for Morrisons to be held vicariously liable, whether for breach of duty under the Data Protection Act, a misuse of private information, or a breach of the duty of confidence.”
Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, represented more than 5,000 claimants who are seeking compensation and legal recourse from Morrisons over the stress and upset caused by the data breach.
“The Claimants are obviously delighted with the Court of Appeal’s ruling,” said McAleenan. “The Judges unanimously and robustly dismissed Morrisons’ legal arguments.”
“The judgment is a wake-up call for business. People care about what happens to their personal information. They expect large corporations to take responsibility when things go wrong in their own business and cause harm to innocent victims. It’s important to remember that data protection is not solely about protecting information – it’s about protecting people,” he added.
Concerns have been raised that this decision will lead to an influx of data breach cases, especially in respect of the latest General Data Protection Regulations, which are more stringent than the previous data protection rules.
Morrisons has stated that it will now take the case to the Supreme Court.
