Employers breathe a sigh of relief following the Supreme Court decision in Morrisons

Published

Mar 31 2020

Written By

Partner
UK

I am based in London and co-head Bird & Bird's International Privacy and Data Protection Group. I enjoy providing practical advice and solutions to complex legal issues.

Stephanie Creed

Senior Associate
UK

I am an associate in the International HR Services group based in London, providing strategic and practical solutions for a wide range of contentious and non-contentious employment matters.

Practices

Countries

In a unanimous decision on 1 April 2020, the Supreme Court reversed the Court of Appeal’s decision that found Morrisons vicariously liable for a data breach committed by a rogue employee. The Supreme Court held that the Court of Appeal “misunderstood the principles governing vicarious liability in a number of relevant respects”.

1. Background

As a reminder, the Morrisons data breach was the result of the deliberate and criminal actions of a disaffected former employee – Andrew Skelton. Having exploited his legitimate access to Morrisons’ systems, Mr Skelton stole and unlawfully published the personal data of almost 100,000 Morrisons employees on a file sharing website, then later sent a copy of the same data anonymously to three newspapers. The published data included names, addresses, gender, dates of birth, telephone numbers, national insurance numbers, bank account details and salary details. Once Morrisons was alerted to the breach, it quickly took steps to take down the website and alerted the police. The ICO investigated but ultimately decided that no enforcement action was appropriate at…