This week, in what is very much a sign of the times we find ourselves living in, the Supreme Court handed down its long-awaited judgment in the high profile Morrisons data breach litigation via live stream.
By way of recap, the case was a class action brought by staff of WM Morrison Supermarkets plc (Morrisons) against their employer for breach of the (now superseded) Data Protection Act 1998 (DPA), misuse of private information and breach of confidence. The claim was brought after the employees' personal data had been leaked online by Andrew Skelton, an embittered employee in Morrisons' internal audit division. Mr Skelton's actions were enough to put him in jail and to cause six years' worth of legal trouble for Morrisons, culminating in this week's verdict.
The initial action in the High Court resulted in a finding that, whilst Morrisons was not primarily liable for any of the alleged causes of action, it was vicariously liable for Mr Skelton's own breach of statutory duty under the DPA, his misuse of private information, and his breach of confidence, because his actions had been conducted in the course of his employment. Mr Skelton's liability for breach of the DPA arose from the fact that, at the time when he leaked the personal data of Morrisons' staff online, he did so from his own personal USB memory stick which he had loaded the data onto from a work laptop. The High Court held that this made him a data controller in his own right in respect of the leaked data. On appeal by Morrisons, the High Court's judgment was essentially upheld, save that there was no pleaded claim against Morrisons on the ground of vicarious liability for Mr Skelton's breach of the DPA.
What did the Supreme Court decide?
The Supreme Court considered two issues:
- Was Morrisons vicariously liable for the acts of Mr Skelton?
- If so, did the DPA exclude the imposition of vicarious liability (i) for statutory torts committed by an employee data controller under the DPA; and (ii) for misuse of private information and breach of confidence (this was very much a side issue as the Supreme Court had already made its decision on vicarious liability in the negative at this point, but it decided to address the question all the same).