Supermarket giant Morrisons to challenge data leak court ruling

A legal battle for compensation by thousands of supermarket staff whose personal details were posted on the internet has reached the Court of Appeal.

By The Newsroom
Tuesday, 9th October 2018, 7:41 am
Updated Wednesday, 10th October 2018, 5:52 pm
PIC: Jonathan Gawthorpe
PIC: Jonathan Gawthorpe

The proceedings before three judges in London today (Oct 9) follow a ruling against Morrisons last year on the issue of liability in the first data leak class action in the UK.

Litigation was launched after a security breach in 2014 when Andrew Skelton, a senior internal auditor at the retailer’s Bradford headquarters, leaked the payroll data of more than 100,000 employees.

Information included their names, addresses, bank account details and salaries.

A group of 5,518 former and current employees said this exposed them to the risk of identity theft and potential financial loss and that Morrisons was responsible for breaches of privacy, confidence and data protection laws.

They are seeking compensation for the upset and distress caused in a case with potential implications for every individual and business in the country.

The supermarket giant said it could not be held directly or vicariously liable for the criminal misuse of the data, and that any other conclusion would be grossly unjust.

But, a High Court judge found in December that vicarious liability had been established.

Morrisons is to challenge the decision at a hearing before the Master of the Rolls Sir Terence Etherton, Lord Justice Bean and Lord Justice Flaux.

In July 2015 Skelton was found guilty at Bradford Crown Court of fraud, securing unauthorised access to computer material and disclosing personal data and jailed for eight years.

In a statement issued before the latest round of the dispute over liability, Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, who is representing the claimants, described it as a “classic David and Goliath case”.

He said Morrisons was seeking “to reverse the High Court’s findings of vicarious liability made in the claimants’ favour, thereby denying the claimants any compensation whatsoever for the considerable distress and inconvenience caused by Mr Skelton’s actions”.

He said: “It cannot be right that there is no legal recourse where employee information has been handed to one of the largest companies in the UK and then leaked on such a large scale, in such circumstances.”