Morrisons wins Supreme Court appeal after huge data leak by an employee with 'grudge'

Supermarket Morrisons is not liable for a huge data leak by an employee affecting 100,000 members of staff, the Supreme Court ruled today.

Previous judgements had found Morrisons "vicariously liable" for the criminal actions of former auditor Andrew Skelton.

Skelton, an auditor who had "an irrational grudge" against Morrisons after a reprimand, posted the payroll details of around 100,000 Morrisons employees on the internet in January 2014.

Posing as a concerned member of the public, he then sent copies of the data to British newspapers, who alerted Morrisons.

Skelton was subsequently sentenced to eight years in prison.

But more than 9,000 claimants sought compensation for the upset and distress caused to them by the leak.

And their lawyers have previously described the action as a “classic David and Goliath case”.

Overturning the 2017 and 2019 judgements in claimants' favour on Wednesday morning, Lord Reed said that employees could only be held accountable for employees' actions if they were closely connected with their work duties.

Speaking via video link, Lord Reed said this was not true in Morrisons' case.

He added: “On the contrary, he was pursuing a personal vendetta, seeking revenge for the disciplinary proceedings a month earlier.

“In these circumstances, applying the established approach to cases of this kind, his employer is not vicariously liable.”

The employee information leaked by Skelton included names, addresses, bank account details and salaries.