.jpg)
Top British grocery chain Wm Morrison Supermarkets Plc (Morrisons) will have to compensate over 5,000 claimants if it loses a third time in a landmark data breach case.
The company’s legal battle, which is the first data protection class action in the UK, has suffered an appeal defeat which puts Morrisons closer to the prospect of a massive payout – no thanks to its senior IT auditor Andrew Skelton who compromised his colleagues’ payroll information in 2014.
The leak involved confidential details, which Skelton posted on data-sharing websites and sent to newspapers, of about 100,000 Morrisons employees. In 2015 the rogue worker was handed an eight-year imprisonment for his actions, but that didn’t stop 5,518 of the staff from going after the supermarket chain.
Last December it was ruled that Morrisons was vicariously liable – a decision upheld by the Court of Appeal this week. The firm, however, is taking the case further.
“Morrisons has not been blamed by the courts for the way it protected colleagues’ data, but they have found that we are responsible for the actions of that former employee, even though his criminal actions were targeted at the company and our colleagues,” the BBC quoted the company as stating following the appeal judgement. “Morrisons worked to get the data taken down quickly, provide protection for those colleagues, and reassure them that they would not be financially disadvantaged.
“In fact, we are not aware that anybody suffered any direct financial loss. We believe we should not be held responsible, so that’s why we will now appeal to the Supreme Court.”
JMW Solicitors’ Nick McAleenan, on the other hand, cited the claimants’ delight over the ruling.
“These shop and factory workers have held one of the UK’s biggest organisations to account and won – and convincingly so,” the report quoted him as saying. “This latest judgement provides reassurance to the many millions of people in this country whose own data is held by their employer.”
