As you may all recall, back in 2013 Andrew Skelton, a Senior Internal Auditor, did not take kindly to being disciplined and in what can only be considered as an act of revenge, when tasked with transmitting payroll data to KPMG, instead posted the personal data of almost 100,000 Morrisons employees online and sent it to UK newspapers.
Skelton was subsequently arrested and imprisoned for 8 years. Much to Morrisons’ chagrin, more than 5,000 of its employees brought a claim against the supermarket chain for compensation as a result of the data breach.
The claim was heard in the High Court and subsequently by the Court of Appeal, both of which found that Morrisons was vicariously liable for the data breach by Skelton. Morrisons further appealed.
In a unanimous ruling, the Supreme Court allowed Morrison’s appeal, finding that the online disclosure of the employee data was not part of Skelton’s “field of activities”, as it was not an act he was authorised to do. Skelton’s unauthorised disclosure was not so closely connected with his ordinary duties that it could be said that the act was made whilst in the ordinary course of his employment. The fact that his employment meant he had the opportunity to commit the data breach was not sufficient to regard Morrisons as vicariously liable. It was found that Skelton was not furthering Morrisons’ business when he made the unlawful disclosure, but “on the contrary was pursuing a personal vendetta”.
Whilst this Judgment will be welcome news to employers, it is apparent that this case turned on its own specific facts. Remember, Skelton made the disclosures on a non-working day, from home using his own equipment. Therefore whilst helpful, employers shouldn’t take this case as indicating that they will not be liable for the data protection breaches of their employees in the future.
If you would like to discuss the topics raised in this article, or any other employment related topic, please contact Alexandria Evans on firstname.lastname@example.org or 01904 561 444.
Please note this information is provided by way of example and may not be complete and is certainly not intended to constitute legal advice. You should take bespoke advice for your circumstances.