Morrisons has been granted permission to appeal to the Supreme Court after it was held vicariously liable for a major data breach.
In 2014 Andrew Skelton, an internal auditor at the supermarket’s headquarters, posted the names, addresses, bank account details, national insurance numbers and salaries of more than 100,000 employees online. At his criminal trial, he was jailed for eight years.
In October 2018, the Court of Appeal upheld a previous High Court decision that the supermarket was vicariously liable for the breach. This meant that more than 5,500 claimants could proceed with claims for compensation against the supermarket, despite there being no proof of personal financial loss caused by the breach.
The Court of Appeal comprised three senior judges, including the Master of the Rolls, who refused the company permission to appeal to the Supreme Court at the time. However, Morrisons has applied directly to the Supreme Court, and this permission to appeal a second time has now been granted.
Nick McAleenan, partner and data privacy law specialist at JMW Solicitors, which represents the claimants, said he had every confidence that the Supreme Court decision will echo that of previous rulings.
He said: “While the decision to grant permission for a further appeal is of course disappointing for the claimants, we have every confidence that the right verdict will, once again, be reached – it cannot be right that there should be no legal recourse where employee information is handed in good faith to one of the largest companies in the UK and then leaked on such a large scale.
“This was a very serious data breach which affected more than 100,000 Morrisons employees – they were obliged to hand over sensitive personal and financial information and had every right to expect it to remain confidential. Instead, they were caused upset and distress by the copying and uploading of the information.”
The decision to hold Morrisons vicariously liable for the actions of a single employee caused some lawyers to question the decision by the Court of Appeal last year, with one calling the judgment “bewildering”. It is thought to have been the first class action case on a data leak in the UK.
