UK court rules Morrisons liable in staff data breach case
(Reuters) — Morrisons, Britain's No. 4 supermarket group, was found liable on Friday for the actions of a former employee who stole staff pay data and published it on the internet.
The High Court ruling means some 5,518 former and current workers who brought the liability claim against Morrisons for the worry and stress caused can now seek compensation, although the supermarket said it would appeal the judgement.
They brought the claim against Morrisons, which is based in Bradford in the north of England, after the theft and publication of the data in 2014 by finance worker Andrew Skelton, who was later jailed for his offenses.
“We welcome the judgment and believe that it is a landmark decision, being the first data leak class action in the U.K.," said Nick McAleenan, a partner at JMW Solicitors, who represented the claimants.
Justice Langstaff ruled that Morrisons was not at fault in the way it protected the staff data, but it was responsible for Mr. Skelton's actions as he was its employee.
The judge said he was, however, troubled that his conclusion of "vicarious no fault liability" could render the court an accessory to furthering Mr. Skelton's aim of damaging Morrisons.
He therefore granted Morrisons leave to appeal his ruling so that a higher court could consider it.
A spokesman for Morrisons said it had worked to get the data taken down quickly, provided protection for affected colleagues and reassured them they would not be financially disadvantaged.
He said Morrisons was not aware that any employee suffered any direct financial loss and would appeal the judgement.
Read Next
-
UK financial watchdog investigates Equifax hacking
(Reuters) — Britain's markets watchdog said it has opened an investigation into the hacking of U.S. credit reporting agency Equifax, which affected nearly 700,000 UK citizens.
