Company found vicariously liable for a deliberate data
protection breach by a disgruntled employee
In 2014, the personal details of almost 100,000 employees of Vm
Morrisons Supermarket Plc ("the employer") were posted on
the internet. These details included salary and bank account
details, thus exposing the employees to the risk of identity theft
and phishing attempts (in order to access their accounts).
An investigation eventually revealed that the information had
been leaked by a senior IT auditor of the employer. It appeared
that he had been motivated by a grudge against the employer, having
received a formal verbal warning following an incident involving
the use of the employer's postal system to send a legal drug.
He was convicted under the Data Protection Act 1998 ("the
DPA") and sentenced to 8 years in prison.
