Morrisons appealing over staff data leak compensation

A legal battle for compensation by thousands of Morrisons staff whose personal details were posted online by a disgruntled employee has reached the Court of Appeal.

The High Court ruled last year that the supermarket was liable for the release of information and its employees were entitled to compensation.

The case is the first data leak class action in the UK.

The proceedings are due to take place on Tuesday.

Morrisons’ appeal has significant implications for other organisations, who could also be found liable to pay compensation for the acts of rogue employees.

• Morrisons liable for staff data leak
• Data leak: Morrisons worker jailed

In 2014 Andrew Skelton, then a senior internal auditor at Morrisons’ Bradford headquarters, leaked the payroll data of more than 100,000 employees, including their names, addresses, bank account details and salaries.

A court subsequently heard that he harboured a “considerable grudge” against the company after he was accused of dealing drugs known as legal highs at work.

In July 2015 Skelton was found guilty of fraud and disclosing personal data and jailed for eight years.

Morrisons spent more than £2m on measures to tackle the breach.

But last year the High Court ruled the supermarket was vicariously liable as, despite Skelton’s criminality, he was acting in the course of his employment when he leaked the information online.

This meant a group of more than 5,000 former and current employees, exposed to the risk of identity theft and potential financial loss, were entitled to compensation.

‘David and Goliath’

The supermarket said it could not be held directly or vicariously liable for the criminal misuse of the data and is to challenge the decision at a hearing on Tuesday.

Nick McAleenan, of JMW Solicitors, who is representing the claimants, described the dispute as a “classic David and Goliath case”.

He said by seeking to reverse the High Court ruling, Morrisons was denying the claimants any compensation for “the considerable distress and inconvenience caused by Mr Skelton’s actions”.

“It cannot be right that there is no legal recourse where employee information has been handed to one of the largest companies in the UK and then leaked on such a large scale, in such circumstances,” he said.