Vicarious Liability For Data Breach By Rogue Employee

In the first group litigation of its kind, Morrisons Supermarkets was found to be vicariously liable for the actions of a rogue employee who, driven by a grudge against the supermarket chain, took payroll data relating to 100,000 employees and published it online. This was despite the fact that Morrisons was found to be entirely innocent of any misuse, that the employee had acted deliberately to harm his employer, had been convicted and imprisoned for his actions and that disclosure of the data had been done at home, on a Sunday outside office hours. In principle, the decision could mean that Morrisons will be liable to compensate all 5,500 employees involved in the claim. Permission has already been given for Morrisons to appeal the decision to the Court of Appeal.