Various Claimants v Wm Morrison Supermarkets plc is an English tort law case heard in the Supreme Court, concerning vicarious liability in English law. It was the first data breach class action in the UK.
Background In 2017, 9,263 current and former employees sued Morrisons after their personal payroll data was leaked by Andrew Skelton, an internal auditor employed by the supermarket chain, who had a grudge. In 2013 he had a job of collating payroll data for external auditors, KPMG, and secretly copied it onto a USB stick. He uploaded it from a pay as you go phone to a file sharing website. This was a misuse of private information, breach of confidence and breach of the Data Protection Act 1998.D Nolan and K Oliphant, Lunney & Oliphant's Tort Law: Text and Materials (7th edn OUP 2023) ch 14, 862 In 2015, Skelton was found guilty of and jailed for fraud, securing unauthorised access to computer material and disclosing personal data. In response to the 2017 claim, Judge Langstaff found Morrisons vicariously liable for Skelton's actions in the High Court. The case then went before the Court of Appeal in 2018 and was dismissed as the judges, Lord Justice Bean and Lord Justice Flaux, held Skelton’s conduct was closely connected to his employment.
Judgment In 2020, a panel of five judges at the Supreme Court allowed an appeal and held Morrisons was not liable for Skelton's actions as his actions of publishing the data did not come under his "field of activities", and Morrisons would not have to pay compensation to the 100,000 affected employees.
See also English tort law
References