Morrisons loses appeal on data breach that hit 100,000

In the first data leak class action in the UK, the Court of Appeal ruled that Morrisons was legally responsible for the leak.

Morrisons had denied legal liability and sought to reverse a High Court’s finding of vicarious liability.

According to JMW Solicitors, the ruling paves the way for 5,518 claimants to receive compensation for their bank account details, dates of birth, National Insurance numbers and other personal information being posted online.

The payroll data was leaked by Andrew Skelton, a disgruntled employee who had been disciplined by Morrisons. He was jailed for eight years in 2015.

JMW Solicitors partner and data privacy law specialist Nick McAleenan said: “This case involves a significant data leak which affected more than 100,000 Morrisons employees – checkout staff, shelf stackers and factory workers; hard working people on whom Morrisons’ entire business relies.

“They were obliged to hand over sensitive personal information and had every right to expect it to remain confidential, but a copy was made and it was uploaded to the internet and they were put at risk of fraud, identity theft and a host of other problems. Unsurprisingly, this caused a huge amount of worry, stress and inconvenience.

“The claimants are obviously delighted with the Court of Appeal’s ruling. The judges unanimously and robustly dismissed Morrisons’ legal arguments. The judgment is a wake-up call for business.”

A spokesman for Morrisons said the supermarket now planned to appeal to the Supreme Court.

He said: “A former employee of Morrisons used his position to steal data about our colleagues and then place it on the internet and he’s been found guilty for his crimes.

“Morrisons has not been blamed by the courts for the way it protected colleagues’ data but they have found that we are responsible for the actions of that former employee, even though his criminal actions were targeted at the company and our colleagues.

”Morrisons worked to get the data taken down quickly, provide protection for those colleagues and reassure them that they would not be financially disadvantaged. In fact, we are not aware that anybody suffered any direct financial loss. We believe we should not be held responsible, so that’s why we will now appeal to the Supreme Court.”