Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 12 MAY 2020

Data breach by rogue employee: UK supermarket chain not liable in class action

Gilchrist Connell
Explore more from Gilchrist Connell

Recent UK decision found that employer not vicariously liable for cyber hack by employee in a data breach class action.

AustraliaPrivacy
Nitesh Patel
Nitesh Patel
James Duffy
James Duffy
Lewis Flynn
Lewis Flynn
Author LinkedIn connections

The UK Supreme Court has recently overturned decisions of lower Courts and found that a supermarket chain is not vicariously liable for a rogue employee's cyber hack in a data breach class action.

On 1 April 2020, in WM Morrisons Supermarkets plc v Various Claimants [2020] UKSC 12, the Supreme Court overturned the Court of Appeal's 2018 judgment to uphold a first instance finding of vicarious liability against Morrisons in respect of its 2014 data leak1.

Morrisons was the first class action in the United Kingdom dealing with cyber risks and breach of data.

Facts

Morrisons operates a chain of supermarkets in the United Kingdom.

At the material time, Andrew Skelton was a senior auditor in Morrisons' internal audit team. Part of Mr Skelton's role at Morrisons involved sending payroll data to an external auditor.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Digital Duty Of Care: What Australian Businesses Need To Know

The Australian Government's proposed digital duty of care reforms would extend online safety obligations far beyond social media platforms to encompass any business operating websites, digital platforms, or AI-enabled tools. Rather than simply responding to complaints, businesses would need to proactively identify foreseeable risks and implement safeguards, with substantial penalties for non-compliance reaching up to $109.2 million for companies. The exposure draft introduces a fundamental shift from reacti
AustraliaPrivacy
Holding Redlich
Holding Redlich
Article

Transparency In Automated Decision-Making: What The OAIC Guidance Means For Your Business

Australia's privacy regulator has issued final guidance on new transparency obligations for automated decision-making systems. From December 2026, organisations using computer programs—including AI, algorithms, and everyday software—to make or inform significant decisions about individuals must disclose these practices in their privacy policies. The guidance reveals a broader compliance burden than many expect, particularly for businesses using automated tools across recruitment, pricing, credit
AustraliaPrivacy
Corrs Chambers Westgarth
Corrs Chambers Westgarth
Article

Privacy Reform In Australia: What Businesses Need To Know In 2026-2027 (Part 2)

The Australian Government has released the Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026, proposing the most significant overhaul of privacy law in years. These reforms would fundamentally change how Australian businesses handle personal information, introducing a new "fair and reasonable" test, stronger consent requirements, expanded definitions of personal information, and new rules for AI and emerging technologies.
AustraliaPrivacy
Coleman Greig Lawyers
Coleman Greig Lawyers
Article

Privacy Reform In Australia: What Businesses Need To Know In 2026-2027

Australia's privacy laws are undergoing significant reform, with new automated decision-making transparency requirements commencing in December 2026 and further substantial changes under consideration. Businesses must prepare for enhanced regulatory scrutiny, increased litigation risk through the new statutory tort for serious privacy invasions, and potential expansion of obligations to small businesses and employee records.
AustraliaPrivacy
Coleman Greig Lawyers
Coleman Greig Lawyers
Article

Australia’s Privacy Act Reforms: Fundamental Changes Proposed In New Exposure Draft

Australia's Privacy Act reform has reached a critical milestone with the release of exposure draft legislation proposing fundamental changes to how organisations handle personal information. The reforms introduce a new 'fair and reasonable' test for data collection and use, a right of erasure for large digital platforms, strengthened consent standards, a statutory controller/processor framework, restrictions on trading personal data, and enhanced data breach obligations. These changes come at a time when em
AustraliaPrivacy
Corrs Chambers Westgarth
Corrs Chambers Westgarth
Article

OAIC Guidance And How Private Sector Organisations Can Prepare

The Office of the Australian Information Commissioner has released guidance on new automated decision-making transparency requirements under the Privacy Act, commencing 10 December. Private sector organisations using AI-enabled products, recruitment technologies, fraud detection tools, pricing algorithms and other data-driven systems must now assess whether their automated systems trigger disclosure obligations in privacy policies.
AustraliaPrivacy
Holding Redlich
Holding Redlich
Article

AFCA’S New Approach To General Insurance Claims Handling: GICOP Compliance May Not Be Enough

The Australian Financial Complaints Authority has published new guidance clarifying how insurers must handle claims, including strict timeframes and expanded compensation rules. Insurers now face potential liability beyond policy limits for unreasonable delays, and may be required to compensate claimants for non-financial losses. With storm season approaching and complaint volumes rising, these changes create significant operational and financial pressure on the insurance industry.
AustraliaInsurance
Gilchrist Connell
Gilchrist Connell
Article

ASIC And APRA Corporate Plans 2026–27: What Regulated Entities Should Expect

APRA and ASIC have released their 2026–27 Corporate Plans, signalling more intensive supervision and enforcement, alongside targeted measures intended to reduce unnecessary regulatory burden. Their priorities span operational resilience, cyber security, artificial intelligence, consumer protection, insurance, superannuation, market integrity and digital assets. For regulated entities, the plans provide a practical roadmap of the areas most likely to attract supervisory attention, information requests and, where deficiencies are identified, enforcement action.
AustraliaCorporate/Commercial Law
Gilchrist Connell
Gilchrist Connell
Article

A $2 Million “sting”: First Civil Penalty For Breach Of The Duty Of Utmost Good Faith

The Federal Court has imposed a $2 million civil penalty on Hollard Insurance Partners for breaching the duty of utmost good faith in its handling of a home insurance claim. This landmark decision marks the first time an insurer has faced civil penalties under section 13(2A) of the Insurance Contracts Act 1984, following sustained delays, inadequate expert engagement, and failures to properly assess storm damage that left policyholders in temporary accommodation for over three years.
AustraliaInsurance
Gilchrist Connell
Gilchrist Connell
Article

ASIC Puts Motor Vehicle Premium Transparency Under The Spotlight

ASIC's Report 838 reveals significant transparency gaps in motor vehicle insurance premium communications, finding that renewal documents often fail to explain price changes adequately and that over 30% of consumers who contacted their insurer successfully negotiated lower premiums. The report establishes clear expectations for better practice in pricing disclosures and signals continued regulatory scrutiny of insurance pricing practices.
AustraliaInsurance
Gilchrist Connell
Gilchrist Connell
Article

Workplace Investigations And Decision Makers: What Employers Can Learn From Totino v Metro Trains

The Full Court of the Federal Court has clarified critical procedural requirements for employers managing medical incapacity terminations and defending general protections claims. This landmark decision addresses when workplace relations advisers must give evidence in proceedings and whether show cause letters constitute unlawful threats under the Fair Work Act.
AustraliaEmployment and HR
Gilchrist Connell
Gilchrist Connell