The UK Supreme Court issues judgment on data protection and vicarious liability
Morrisons workers whose payroll details were leaked by a disgruntled employee will not receive compensation, the Supreme Court has ruled. The supermarket giant is not liable after an internal auditor leaked payroll data of about 100,000 workers as "revenge", judges decided. The decision overturned a landmark class action case by 9,000 employees who claimed as a result of the breach they were "upset and distressed". The claimants' lawyer said he was "hugely disappointed".
In July 2015, Mr Skelton was jailed for eight years after being convicted at Bradford Crown Court of fraud, securing unauthorised access to computer material and disclosing personal data. In a statement, the supermarket said: "We are pleased that the Supreme Court has agreed that Morrisons should not be held vicariously liable for his actions when he was acting alone, to his own criminal plan, and he's been found guilty of this crime and spent time in jail."
The UK Supreme Court issued, on 1 April 2020, its judgment ('the Judgment') in WM Morrison Supermarkets plc (Appellant) v. Various Claimants (Respondents), the employees of Morrisons,  allowing the appeal of Wm Morrison Supermarkets Plc, and holding that Morrisons is not vicariously liable for its employee's disclosure of personal data through files uploaded via personal mobile phone. Furthermore, a question was raised as to whether the Data Protection Act 1998 ('the Act') excludes vicarious liability for statutory torts committed by an employee data controller under the Act, the misuse of private information, and breach of confidence.
In particular, the Judgment states that since the Act neither expressly nor impliedly indicates otherwise, the principle of vicarious liability applies to the breach of the obligations which it imposes, and to the breach of obligations arising at common law or in equity, committed by an employee who is a data controller in the course of their employment. However, in the present case, Morrisons was not held vicariously liable for the employee's conduct.