Manchester law firm at centre of legal battle which could cost supermarket millions
A Manchester law firm is at the centre of a landmark case which is likely to cost supermarket Morrisons millions of pounds.
Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, represented staff at the supermarket who were affected by a huge data breach.
Morrisons lost its appeal against the High Court’s ruling that found it legally responsible for the breach which affected more than 100,000 employees.
The ruling will pave the way for 5,518 claimants to receive compensation and is the UK’s first data protection class action.
The action came after workers’ personal details were leaked online by former IT employee Andrew Skelton in 2014.
Skelton was sent to prison for eight years in 2015 for his actions.
The leak has resulted in a lengthy legal battle and the Court of Appeal has ruled in favour of the Morrisons staff.
Three senior judges found the supermarket giant legally responsible for the data leak, which the claimants say caused significant stress and upset.
The supermarket denied all legal liability and sought to reverse the High Court’s findings of vicarious liability.
Today’s ruling paves the way for 5,518 Claimants to receive compensation for what was a significant data leak, which saw bank account details, dates of birth, National Insurance numbers, addresses and telephone numbers posted online.
Nick McAleenan
Nick McAleenan said: “This case involves a significant data leak which affected more than 100,000 Morrisons employees – checkout staff, shelf-stackers, and factory workers; hard working people on whom Morrisons’ entire business relies.
“They were obliged to hand over sensitive personal information and had every right to expect it to remain confidential, but a copy was made and it was uploaded to the internet and they were put at risk of fraud, identity theft and a host of other problems.
“Unsurprisingly, this caused a huge amount of worry, stress and inconvenience.
“The Claimants are obviously delighted with the Court of Appeal’s ruling. The judges unanimously and robustly dismissed Morrisons’ legal arguments.
“These shop and factory workers have held one of the UK’s biggest organisations to account and won – and convincingly so. This latest judgment provides reassurance to the many millions of people in this country whose own data is held by their employer.
“The judgment is a wakeup call for business. People care about what happens to their personal information.
“They expect large corporations to take responsibility when things go wrong in their own business and cause harm to innocent victims. It’s important to remember that data protection is not solely about protecting information – it’s about protecting people.”
A spokesperson for Morrisons said: “A former employee of Morrisons used his position to steal data about our colleagues and then place it on the internet and he’s been found guilty for his crimes.
“Morrisons has not been blamed by the courts for the way it protected colleagues’ data but they have found that we are responsible for the actions of that former employee, even though his criminal actions were targeted at the company and our colleagues.
“Morrisons worked to get the data taken down quickly, provide protection for those colleagues and reassure them that they would not be financially disadvantaged. In fact, we are not aware that anybody suffered any direct financial loss.
“We believe we should not be held responsible so that’s why we will now appeal to the Supreme Court.”
