Morrisons’ workers lose landmark Class Action, but boost UK data rights in the process
The Supreme Court has handed down its judgment in WM Morrison Supermarkets PLC v Various Claimants, a landmark data privacy case that saw the grocery giant sued by its own employees following a massive data breach in 2014.
The case concerned the disclosure onto the internet of payroll information belonging to 100,000 Morrisons employees by Andrew Skelton, a disgruntled internal auditor at Morrisons.
A Partner and data rights specialist at JMW Solicitors, represented the Claimants. They said: “My clients entrusted their personal information to their employer, Morrisons, in good faith. When their information was subsequently uploaded to the internet by a fellow employee, it caused an enormous amount of upset and distress to tens of thousands of people.
“The Supreme Court’s decision now places my clients, the backbone of Morrisons’ business, in the position of having no legal avenue remaining to challenge what happened to them.
“My Clients are of course hugely disappointed by the decision, which contradicts two earlier unanimous findings in their favour.
“The Supreme Court effectively decided that where a wrongdoer leaks data with the specific intention to harm their employer, the employer may not be held vicariously responsible. The Claimants, of course, respect the decision, but the troubling part of this conclusion is that the wrongdoer in this case also wanted to damage his own colleagues, not just Morrisons, and he did so in dramatic fashion.
“However, importantly, the Supreme Court also ruled that the Claimants had won part of the appeal. For the first time, the Supreme Court has established the legal principle that employers can now be legally responsible for data breaches caused by their employees - under the law of vicarious liability. This is very significant because most data breaches are caused by human error. This ruling enhances the protection of data for millions of people in this country who are obliged to hand over their own information to businesses every single day. It will raise standards.
“Morrisons’ staff have lost their claim, but through their legal action they have enhanced the data rights of everyone in the UK.”