WM MORRISON SUPERMARKETS PLC – Court Ruling (United Kingdom, 2018)

An employee wanted to take revenge on his employer, Morrisons, because he was annoyed by disciplinary proceedings and sanctions taken by the employer against him. As part of his regular job, the employee had access to payroll data which he was required to process for an annual audit. The employee copied the data onto a personal USB stick, then posted a file containing the personal details of 99,998 employees on a file-sharing website, placed links to the website elsewhere on the internet, and anonymously sent a CD containing a copy of the data to newspapers in the UK. In the letter to the newspapers, the employee purported to be a concerned person who had worryingly discovered that payroll data relating to almost 100,000 of Morrisons’ employees was available on the web. The data so disclosed consisted of the names, addresses, gender, dates of birth, phone numbers, national insurance numbers, bank sort codes, bank account numbers and salaries. The employee was charged with fraud under the Computer Misuse Act 1990 and under section 55 of the Data Protection Act 1998 (DPA) and was sentenced to a term of eight years imprisonment. Connected to the data breach, 5,518 of Morrisons’ employees subsequently sued their employer in a mass claim for damages for misuse of private information, breach of confidence and breach of statutory duty owed under section 4(4) of the DPA. The employees argued that Morrisons was primarily liable under those heads of claim but, if not, then Morrisons was to be held vicariously liable for the wrongful conduct of its employee who committed the offence. The trial court held that Morrisons did not disclosed the information or misused it and was not the data controller in respect of the information disclosed on the web. Accordingly, Morrisons owed no duty to the claimants under the DPA and was not directly liable in respect of any breach of confidence or misuse of private information. However, merely because the employee became the data controller of the information did not exclude vicarious liability. There was a sufficient connection between the employee’s position and his wrongful conduct so that Morrisons could rightly be held vicariously liable. Morrisons appealed against this decision. Inter alia, the Court of Appeal (CoA) had to decide whether: # the DPA excludes the application of vicarious liability and of causes of action for misuse of private information and breach of confidence and/or the imposition of vicarious liability for breaches of the same; # the wrongful acts of the employee occurred during his employment by Morrisons, and that Morrisons was vicariously liable for those wrongful acts. The appeal was dismissed. The causes of action for misuse of private information and breach of confidentiality are not excluded by the DPA 1998 in respect of the wrongful processing of data within the ambit of the DPA 1998. The CoA confirmed the trial judge’s analysis. The employee’s actions were not “disconnected by time, place and nature from [his] employment.” What happened was a seamless and continuous sequence of events. Morrisons was vicariously liable for the torts committed by the employee against the claimants.