The Supreme Court has handed down judgment in the UK’s first data breach group action, finding that Morrisons cannot be held vicariously liable for 2014 data breach by disgruntled employee.
The case concerned Andrew Skelton, a former senior IT auditor, who was responsible for sharing payroll data of 126,000 employees with an external auditor. Skelton, who held a grievance against the company following unrelated disciplinary proceedings in 2013, made a copy of that data and later uploaded it onto a public file sharing website. He was subsequently convicted of criminal offences arising from this conduct and was sentenced to eight years’ imprisonment.
Over 9,000 current and former employees affected by this breach brought a claim against Morrisons for distress caused by Skelton’s acts claiming damages for breach of the Data Protection Act 1998, misuse of private information and breach of confidence. The High Court held Morrisons did not have ‘primary liability’ but that it was vicariously liable for the breach. Morrisons challenged the decision but it was upheld by the Court of Appeal. Morrisons later appealed to the Supreme Court.
On 1st April 2020, a panel of five Supreme Court judges unanimously overturned the decision of the lower courts, concluding that an employer cannot be held vicariously liable when the actions of the employees are not ‘closely connected’ with their duties at work. In this instance, Skeleton was not ‘engaged in furthering his employer’s business when he committed the wrongdoing in question.’ On the contrary, ‘he was pursuing a personal vendetta.’
Whilst this decision will be welcomed by employers, they can, in principle, still be held vicariously liable for breaches of data protection legislation. Every case will turn on its facts. Employers should therefore ensure they implement robust security policies and procedures to protect against liability in this regard.
The judgment is available here.
Please do not hesitate to get in touch with Katie Major in our Commercial Litigation team or your normal Mills Selig contact to discuss.
21 Arthur Street
Belfast, BT1 4GA
T: +44 (0) 28 9024 3878