Morrisons loses appeal against data breach pay-out

The Court of Appeal has kicked out Morrisons’ attempt to overturn last December’s ruling which found it legally responsible for a data breach that saw the personal details of thousands of staff members leaked online by a disgruntled employee.
The issue, which should see the company finally cough up compensation, dates back to 2014, when internal senior auditor Andrew Skelton leaked the payroll data of nearly 100,000 employees, including names, addresses, bank account details and salaries, putting it online and sending it to newspapers.
At his trial in July 2015, Bradford Crown Court heard how Skelton had been incensed when bosses accused him of using the HQ mailroom to send what they claimed were legal highs.
However, it transpired that he was simply receiving and posting goods he had bought and sold on eBay. He was found guilty and was jailed for eight years.
Some 5,518 claimants joined the legal action, brought by JMW Solicitors, which sought recompense for the significant stress they suffered due to being exposed to the risk of identity fraud and financial loss but this number could now escalate.
Morrisons said it will now launch yet another appeal, this time at the Supreme Court.
Last December, the High Court ruled that although Morrisons was not “directly liable” it was found to be “vicariously liable” for the actions of its employee.
Morrisons launched its appeal earlier this month in an attempt to reverse the ruling, refuting all legal responsibility and denying claimants of any compensation, even though the company had itself secured £170,000 worth of compensation for the breach.
At the time, JMW Solicitors data privacy law specialist Nick McAleenan said: “This is a classic David and Goliath case – the victims here are shelf stackers, checkout staff and factory workers; just ordinary people doing their jobs.”