Employee's deliberate disclosure of co-workers' personal data

    Contact us:

    My Name is:

    My Email Address is:

    My Telephone Number is:

    A summary of my enquiry and what I am looking to achieve is:

    In Wm Morrison Supermarkets Plc v Various Claimants [2018] EWCA Civ 2339, the Court of Appeal dismissed an appeal by Wm Morrison Supermarkets Plc (Morrisons) against a High Court ruling that it was vicariously liable for an employee’s deliberate disclosure of co-workers’ personal data on the internet.

    This is the first group litigation after a data breach in the UK and Morrisons is liable in damages to 5,518 claimants.

    Damages will be calculated under the Data Protection Act 1998 and could have been much higher under the GDPR.

    This decision will have serious implications for employers who may be vicariously liable for misuse of employee personal data by a rogue employee even if they are otherwise compliant with data protection legislation.

    There is concern that this could be the first in a wave of class actions by employees and customers after a data breach.

    Morrisons has indicated its intention to appeal this judgment to the Supreme Court.

    PLC Practical Law 30.10.18