Morrisons Case Decision: ‘Goliath' Beats 9,000 ‘Davids' To Avoid Crippling Data Breach Compensation Claim

On 1 April 2020, the Supreme Court handed down judgment¹ in an eagerly awaited appeal by Morrisons Supermarket, ruling that it was not liable for the criminal acts of a rogue employee. The court's unanimous decision will have data controllers everywhere breathing a sigh of relief.

The Facts

In July 2013, Andrew Skelton, a senior Morrisons' auditor, was subjected to internal disciplinary proceedings by the company but kept his job. Following those proceedings, Skelton was said to harbour an irrational grudge against Morrisons. Four months later, Skelton was entrusted with the company's payroll data to assist Morrisons' external auditor, KPMG. Prior to obtaining the payroll data (which included names, bank details, home addresses, dates of birth and the gender of thousands of  employees), Skelton had familiarised himself with the anonymity software 'Tor' and equipped himself with an 'untraceable' mobile phone. Having done so, he copied the employees' personal data