An IT auditor working for Morrisons became disillusioned with his employer. In 2014, he posted a file on line containing the personal details of around 100,000 Morrison's employees. He was found guilty of fraud and imprisoned for 8 years in 2015 but this was not the end of the tale for Morrisons. About 5,000 affected employees came together to bring an action against Morrisons claiming that the supermarket should be held liable for the leak. This is known as a 'class action'. They argued that they were at increased risk of identity theft as a result of the leak as well as financial loss.
The High Court held that Morrisons was vicariously liable for the leak as the employee had been entrusted with the data and it had taken place during the course of his employment. Vicarious liability is a situation where someone can be held responsible for the acts for another.
The Court of Appeal has just upheld the above decision. The case is interesting because it is the first class action relating to a data leak in the UK. Morrisons state that they will appeal to the Supreme Court.
Employers are reminded of the importance of their business of data security and avoiding breaches.
To discuss this or any other employment related issue, contact us.