EMERGING TECHNOLOGY ISSUES
Employers can be vicariously liable at common law for the
actions of a rogue employee who brings about an unauthorized cyber
data breach, even where the employee's motive was to harm the
employer and not to injure the third parties whose data is involved
or for personal gain.
Wm Morrison Supermarkets PLC v Various
Claimants, 2018 EWCA Civ
2339
FACTS AND ISSUES:
Skelton was employed by a supermarket company (Morrisons) as a
Senior IT Auditor. After he was formally disciplined in 2013 he
bore a grudge against the company. In 2014, in the course of his
duties, he was assigned the task of transmitting employee personal
data on a USB memory stick to the company's external auditors.
He copied this data from his employer-supplied computer onto a
personal USB stick before passing the data on to the auditor.
Subsequently, he posted the personal data of almost 100,000
Morrisons employees online. He took (unsuccessful) steps to attempt
to
