Morrisons acquitted in data leak claim....

On 1 April, the Supreme Court overruled the lower courts and held that Morrisons were not vicariously liable for the data breach by a senior IT auditor employed by the supermarket giant in 2014. By way of quick background, Mr Skelton was employed by Morrisons and for a variety of personal reasons he leaked the personal details (including payroll) of nearly 100,000 employees. This led to a class action by nearly 5000 people against the company. In two lower court decisions, the courts held that Morrisons were responsible and hence vicariously liable for the acts of its former employee (who was sent to prison for 8 years as a consequence of his actions).

The Supreme Court unanimously held that the decision of the lower courts had erred in their judgements and misinterpreted issues of this kind. They held that Mr Skelton's actions were linked to a personal vendetta against the company and were not undertaken by him in the course of carrying out his duties.

View: commonsense has prevailed. The original decision against Morrisons was at best erroneous and at worst - perverse. The original decision seemed to be more about finding someone with deep pockets liable rather than a fair and balanced recognition of how far the law on vicariously liability should stretch. Employees invariably have access to vast amounts of data and companies can only take so many steps to protect this data against unlawful disclosure. The acts of Mr Skelton were well outside the ambit of his duties and there was nothing to suggest that Morrisons could have taken steps that would have prevented his actions. Thankfully - balance of justice has been regained.