Staff in line for payouts after Morrisons loses data leak appeal

Morrisons could face a hefty compensation bill after the supermarket lost an appeal against a ruling that it is liable for a former employee leaking personal information about 100,000 members of staff.

The ruling, which paves the way for 5,518 claimants to receive compensation, is the UK’s first data protection class action. It comes after workers’ personal details were leaked online by a senior IT employee, Andrew Skelton, in 2014.

Information including salaries, national insurance numbers, dates of birth and bank account details were also sent to a number of newspapers.

Skelton was jailed for eight years in July 2015 for his actions.

The Bradford-based business is set to appeal against the court of appeal ruling, in a landmark case that could prompt companies to limit workers’ access to data.

The supermarket denied all legal liability and sought to reverse the high court’s findings of vicarious liability.

Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, who is representing the workers, said: “The jdges unanimously and robustly dismissed Morrisons’ legal arguments. These shop and factory workers have held one of the UK’s biggest organisations to account and won – and convincingly so.

“The judgment is a wake-up call for business. People care about what happens to their personal information. They expect large corporations to take responsibility when things go wrong in their own business and cause harm to innocent victims. It’s important to remember that data protection is not solely about protecting information – it’s about protecting people.”

A spokesman for Morrisons said: “A former employee of Morrisons used his position to steal data about our colleagues and then place it on the internet and he’s been found guilty for his crimes.

“Morrisons has not been blamed by the courts for the way it protected colleagues’ data but they have found that we are responsible for the actions of that former employee, even though his criminal actions were targeted at the company and our colleagues.

“Morrisons worked to get the data taken down quickly, provide protection for those colleagues and reassure them that they would not be financially disadvantaged. In fact, we are not aware that anybody suffered any direct financial loss. We believe we should not be held responsible so that’s why we will now appeal to the supreme court.”