Can an employer be held liable when an employee intentionally breaches data protection laws? According to a recent High Court case, the answer is yes.
In the case of Various claimants v Wm Morrisons Supermarket PLC, the Court ruled that the supermarket was vicariously liable for the criminal actions of a rogue employee who deliberately disclosed co-workers’ personal data online. The personal data included bank and salary, plus addresses and National Insurance numbers. The argument against Morrisons was that they had failed to prevent the breach.
This case is the first example of group litigation for a breach of the Data Protection Act 1998 to come before the High Court, and the ruling could result in a large compensation payout for the claimants. As this judgment relates only to the question of liability, a separate decision on compensation is to follow. In the meantime, Morrisons has indicated it will take the case to the Court of Appeal.
The High Court judgment could have interesting implications for data protection and vicarious liability for employers. It will be interesting to see whether the decision is upheld at appeal.