In what at first sight may seem like a harsh decision, in the case of Various Claimants v WM Morrisons Supermarkets Plc the High Court has held that the supermarket chain was vicariously liable for an employee's disclosure of colleagues' personal data. What is more, the disclosure by the employee was intentional and occurred in response to disciplinary action taken against him the previous year.
The employee, Mr Skelton, was employed as a senior IT internal auditor and had access to sensitive and confidential information regarding his colleagues. He was subject to disciplinary action which he believed to be unjustified in June 2013. Later on that year, in November, he obtained payroll data which he was to pass on to KPMG for external audit purposes. As well as downloading the information onto a USB stick and passing it to KPMG, he also made a personal copy. In January 2014, just before Morrison's annual financial reports were announced, Mr Skelton posted the information onto a file sharing website, having used another employee's data to open an account on the site. Mr Skelton was subsequently arrested and charged with a number of offences including fraud and an offence under section 55 of the Data Protection Act. He was convicted and sentenced to 8 years in prison.
The colleagues whose data had been disclosed then raised a group civil action against Morrisons seeking compensation for breach of the company's statutory duty under section 4(4) of the DPA (which provides that a data controller must comply with the 8 data protection principles), misuse of private information and breach of confidence. The claimants argued that Morrisons was liable for its own acts and omissions and also vicariously liable for the actions of Mr Skelton.
The High Court held that there was no primary liability for Morrisons, as the Company was not the data controller at the time of the breach, but the claim for vicarious liability was upheld. Mr Skelton's actions were in the course of his employment, there being sufficient connection between the position in which he was employed and his wrongful conduct. As such, Morrisons were held to be liable.
However, the Court were conscious of the fact that Mr Skelton's aim in this case was to cause loss to Morrisons and have granted the Company the right to appeal.