UK Supreme Court Rules On Data Breach Vicarious Liability

On 1 April 2020, the United Kingdom’s Supreme Court ruled that supermarket chain Morrisons was not required to pay compensation to staff following a data breach, which affected approximately 100,000 employees.  The Court reversed the appellate court’s decision upholding  the High Court’s decision to hold Morrisons vicariously liable after a disgruntled employee, Andrew Skelton, leaked sensitive payroll information online in 2014. 

Although vicarious liability was not established in this instance, the Supreme Court judgment expressly confirms that vicarious liability applies in the context of the Data Protection Act 1998 (the “DPA”), and provides useful guidance on how vicarious liability should be approached going forward.