A landmark High Court trial involving a huge leak of personal data by a former supermarket worker has potential implications for every business in the UK, a leading lawyer has warned.
The court has allowed a compensation claim by thousands of Morrisons staff whose personal details were posted on the internet.
It follows a security breach in 2014 when Andrew Skelton, a senior internal auditor at the retailer’s Bradford headquarters, leaked the payroll data of nearly 100,000 employees.
Names, addresses, bank account details and salaries were all put online and sent to newspapers.
A group of 5,518 former and current Morrisons employees said this exposed them to the risk of identity theft and potential financial loss, and that Morrisons was responsible for breaches of privacy, confidence and data protection laws.
They are seeking compensation for the upset and distress caused.
Morrisons said it could not be held liable for Skelton’s criminal misuse of the data and any other conclusion would be grossly unjust.
But the judge ruled that vicarious (indirect) liability, had been established.
In July 2015, Skelton was found guilty at Bradford Crown Court of fraud, securing unauthorised access to computer material and disclosing personal data and jailed for eight years.
The trial heard that his motive appeared to have been a grudge over a previous incident, when he was accused of dealing in legal highs at work.
Counsel Jonathan Barnes said the company had already been awarded £170,000 compensation against Skelton, and his other “victims” should be compensated too.
Anya Proops QC, for Morrisons, said Skelton had already caused serious damage to the firm, not least because it incurred more than £2million in costs. If the claim succeeded, it would open the door to the other 94,480 individuals affected.
Ms Proops said the novel issue of the extent to which a data controller/employer could be held liable under civil law in connection with the unauthorised, criminal misuse of third party data by an employee was of “huge importance” for all those who process personal data as a “data controller”.
She added: “This would obviously include not only commercial enterprises but also charities, governmental bodies, self-employed professionals, clubs, associations, non-governmental organisations and all manner of entities and persons who process data other than for domestic purposes.”