Morrisons, the supermarket chain, has been held liable for a
disgruntled employee's willful breach of data protection
legislation.
Mr Skelton was employed by Morrisons as a senior IT internal
auditor. This role gave him access to sensitive personal data
relating to the company's staff. He also sold a legal slimming
drug on the internet in his spare time. In summer 2013, Morrisons
subjected Mr Skelton to a disciplinary procedure on the basis that
his use of the company's post room to send the slimming drug
had caused alarm when fellow employees thought it was an illicit
substance. Mr Skelton remained in his role despite this.
In November 2013, Mr Skelton was asked to send sensitive
payroll-related employee data to KPMG (Morrisons' external
auditors). Mr Skelton downloaded the encrypted data on to his work
computer before copying it on to a new USB stick for KPMG. He then
made a copy for himself on a personal USB stick. In January 2014,
using the files he had
