In the first ever class action for a data breach in the UK, Various claimants v Wm Morrisons Supermarket PLC, the High Court has found that WM Morrisons Supermarkets PLC was vicariously liable for a deliberate disclosure of personal data by a rogue employee who had a grudge against his employer.
The employee committed a criminal offence by his actions and was sentenced to eight years in prison. He deliberately disclosed the personal information of about 100,000 of his co-workers onto a file sharing website.
Morrisons were found liable for the employee’s actions, even though this was exactly what that employee wanted to achieve – financial and reputational damage. Morrisons is going to appeal, but unless the case is overturned, it could be extremely expensive for Morrisons. It could also have worrying consequences for other employers who find that an employee has disclosed data without their knowledge or consent.
The court found that Morrisons had appropriate measures in place to keep information secure. Although Morrisons could have had a better process for deleting information, the court also found that the lack of those procedures in place did not ultimately lead to the disclosure. So the finding of Morrisons’ liability was more policy driven, rather than because of their actions. The reason for the decision was to protect the data subjects - in this case the Morrisons’ workers who had their data shared on the internet. The court wasn’t moved by Morrisons’ arguments about the financial consequences of vicarious liability. It thought that many companies would take out insurance to cover these sorts of claims.
The new data protection laws implementing the GDPR which come in soon and increase liability for employers and data processors, will also raise the financial stakes even more. We may see more class actions for compensation against multiple defendants. This is definitely a case to watch closely on appeal.
We are running GDPR training sessions across the region in Grimsby, Lincoln, Beverley and Louth over January and February 2018. Book your place here: https://www.wilkinchapman.co.uk/events
