Morrisons not liable for staff data leak, court rules

A panel of five judges unanimously ruled in favour of the retailer today, saying Morrisons was not “vicariously liable” for the actions of former employee Andrew Skelton, who disclosed staff information online and sent it to newspapers.

Skelton was charged with fraud in November 2014, convicted in July 2015 and sentenced to eight years in prison. However, thousands of affected employees brought compensation claims against Morrisons, which led to a lengthy court battle.

The court’s president Lord Reed said Skelton had leaked the data due to a “grudge” he held after the business accused him of sending packages containing legal highs from its post room.

Morrisons said: “The theft of data happened because a single employee with legitimate authority to hold the data, also held a secret and wholly unreasonable grudge against Morrisons and wanted to hurt the company and our colleagues.

“We are pleased that the supreme court has agreed that Morrisons should not be held vicariously liable for his actions when he was acting alone, to his own criminal plan and he’s been found guilty of this crime and spent time in jail.

“A court has already found that Morrisons was not responsible for any direct wrongdoing in respect of this data theft. We also know that many colleagues appreciated the way we got the data taken down quickly, provided protection for their bank accounts and reassured them that they would not, in any circumstances, be financially disadvantaged. In fact, we’ve seen absolutely no evidence of anyone suffering any direct financial loss.”

Kirsty Rogers, employment partner at law firm DWF, which represented Morrisons, said: “We are delighted to report that our client Morrisons has been successful in the landmark case in the supreme court concerning the criminal data breach committed by an employee which saw the personal data of employees put on to the internet.

“The court had already found that Morrisons had no fault-based liability and the supreme court has now ruled that Morrisons also has no no-fault vicarious liability for the malicious actions of its employee.”