Morrisons loses data leak Appeal

22nd October 2018

Morrisons has lost its appeal against the High Court’s ruling that found it legally responsible for a huge data breach affecting more than 100,000 employees.

The Court of Appeal judgment was handed down this afternoon, with three senior Judges, including the Master of the Rolls, finding the supermarket giant legally responsible for the data leak, which the Claimants say caused significant stress and upset.

The grocery heavyweight denied all legal liability and sought to reverse the High Court’s findings of vicarious liability, thereby attempting to deprive the Claimants of any form of compensation or legal recourse. The two-day Court of Appeal hearing concluded on 10th October 2018.

Today’s ruling paves the way for 5,518 Claimants to receive compensation for what was a significant data leak, which saw bank account details, dates of birth, National Insurance numbers, addresses and telephone numbers posted on the internet by Andrew Skelton, a disgruntled employee who had recently been disciplined by the company. The Court of Appeal has refused Morrisons permission to appeal to the Supreme Court.

Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, is representing the Claimants.

He said: “This case involves a significant data leak which affected more than 100,000 Morrisons employees - checkout staff, shelf-stackers, and factory workers; hard working people on whom Morrisons’ entire business relies. They were obliged to hand over sensitive personal information and had every right to expect it to remain confidential, but a copy was made and it was uploaded to the internet and they were put at risk of fraud, identity theft and a host of other problems. Unsurprisingly, this caused a huge amount of worry, stress and inconvenience.

“The Claimants are obviously delighted with the Court of Appeal’s ruling. The Judges unanimously and robustly dismissed Morrisons’ legal arguments.These shop and factory workers have held one of the UK’s biggest organisations to account and won – and convincingly so. This latest judgment provides reassurance to the many millions of people in this country whose own data is held by their employer.

“The judgment is a wakeup call for business. People care about what happens to their personal information. They expect large corporations to take responsibility when things go wrong in their own business and cause harm to innocent victims. It’s important to remember that data protection is not solely about protecting information – it’s about protecting people”.

The case is the first data leak class action in the UK.

The Claimants are represented by barristers Jonathan Barnes and Victoria Jolliffe of 5RB chambers.

Further information for employees here.

Let us contact you


COVID-19 Update - Our website and phone lines are operating as normal and our teams are on hand to deal with all enquiries. Meetings can be conducted via telephone and video conferencing.

View our Privacy Policy

Areas of Interest