Court of Appeal dismisses appeal from decision that company was
vicariously liable for data protection breach by employee
A disgruntled employee of the defendant employer leaked the
personal details (including bank account details) of almost 100,000
other employees on the internet. The employee was a senior IT
auditor and had been motivated by a grudge against his employer. At
first instance, the judge found that the employer was not directly
liable for the breach, which it had not authorised or required, and
it had not been the "data controller" at the time of the
breach. The employer had put in place adequate and appropriate
controls and there had been no indication that the employee,
although upset by recent disciplinary action, could not be trusted
to do his job. There was no appeal from that decision. However, the
judge found that the employer was vicariously liable for the breach
and the employer appealed against that decision.
