Morrisons ‘not liable’ for actions of rogue employee over data leak

Morrisons cannot be held liable for the actions of an employee with a “grudge” who leaked the payroll data of almost 100,000 members of staff, Britain’s highest court has ruled.

The supermarket chain brought a Supreme Court challenge in a bid to overturn previous judgments which required it to compensate thousands of employees whose personal details were posted on the internet.

A panel of five judges has now unanimously ruled that the supermarket chain is not liable for the actions of its former auditor Andrew Skelton.

Skelton uploaded the payroll details of 98,998 of Morissons employees in January 2014. He also anonymously sent CDs containing the details to newspapers, including names, addresses, and date of births. He was subsequently sentenced to eight years in prison.

The Supreme Court’s decision was announced during an internet streaming session where president Lord Reed said Skelton leaked the data after he was given a verbal warning following disciplinary proceedings.

The judge said employers could only be held liable for the actions of employees if they were closely connected with their duties at work.

Lord Reed said: “In the present case, Skelton was not engaged in furthering Morrisons’ business when he committed the wrongdoing in question.

“On the contrary, he was pursuing a personal vendetta, seeking revenge for the disciplinary proceedings a month earlier. In these circumstances, applying the established approach to cases of this kind, his employer is not vicariously liable.”

The decision overturns previous rulings by both the High Court and Court of Appeal that deemed the supermarket chain liable for Skelton’s actions.

It has significant implications for data protection, with companies previously concerned that the Morrisons’ case could set precedent forcing them to pay out for future actions by rogue employees.

Morrisons argued that the company would be exposed to compensation claims on a potentially vast scale if it lost the case, despite being “entirely blameless”.

More than 9,000 claimants were seeking compensation for the upset and distress caused by the data breach. Lawyers had previously described their push for compensation as a David and Goliath case.