Morrisons loses data leak appeal

Bradford-headquartered supermarket Morrisons has lost its appeal against the High Court’s ruling that found it legally responsible for a huge data breach affecting more than 100,000 employees.

The Court of Appeal judgement was handed down this afternoon, with three senior Judges, including the Master of the Rolls, finding the supermarket giant legally responsible for the data leak, which the Claimants say caused significant stress and upset.

The ruling follows a December hearing which found that Morrisons was liable for the actions of a former member of its staff who stole the data of thousands of employees and posted it online.

More than 5,500 staff brought a claim against the company after internal auditor Andrew Skelton stole the data, including salary, National Insurance and bank details, of nearly 100,000 staff.

The High Court ruling allows the claimants, 1,000 of whom are in Yorkshire, to seek compensation from the supermarket over the breach of data security in 2014. The case was the first data leak class action in the UK.

Skelton was jailed for eight years in 2015 after being found guilty at Bradford Crown Court of fraud.

The grocery heavyweight denied all legal liability and sought to reverse the High Court’s findings of vicarious liability. The two-day Court of Appeal hearing concluded on 10 October.

The ruling paves the way for the 5,518 Claimants to receive compensation for what was a significant data leak.

Morrisons has released the following statement: “A former employee of Morrisons used his position to steal data about our colleagues and then place it on the internet and he’s been found guilty for his crimes. Morrisons has not been blamed by the courts for the way it protected colleagues’ data but they have found that we are responsible for the actions of that former employee, even though his criminal actions were targeted at the company and our colleagues.

“Morrisons worked to get the data taken down quickly, provide protection for those colleagues and reassure them that they would not be financially disadvantaged. In fact, we are not aware that anybody suffered any direct financial loss. We believe we should not be held responsible so that’s why we will now appeal to the Supreme Court.”

Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, is representing the Claimants. After the hearing, he said: “This case involves a significant data leak which affected more than 100,000 Morrisons employees – checkout staff, shelf-stackers, and factory workers; hard working people on whom Morrisons’ entire business relies. They were obliged to hand over sensitive personal information and had every right to expect it to remain confidential, but a copy was made and it was uploaded to the internet and they were put at risk of fraud, identity theft and a host of other problems. Unsurprisingly, this caused a huge amount of worry, stress and inconvenience.

“The Claimants are obviously delighted with the Court of Appeal’s ruling. The Judges unanimously and robustly dismissed Morrisons’ legal arguments.  These shop and factory workers have held one of the UK’s biggest organisations to account and won – and convincingly so. This latest judgement provides reassurance to the many millions of people in this country whose own data is held by their employer.”

Click here to sign up to receive our new South West business news...
Close