Morrisons loses first UK data class action and must pay up

DataIQ News

Morrisons has secured the dubious honour of losing the first ever UK data leak class action after the High Court ruled that the supermarket chain must pay compensation to over 5,000 Morrisons staff - past and present - over the 2014 data breach caused by a disgruntled employee.

The case centred on the actions of auditor Andrew Skelton, who was handed an eight-year prison sentence last July after being found guilty of exposing the company’s payroll database – including 100,000 staff names, addresses and bank details – in revenge for being disciplined.

In December last year, Morrisons was awarded £170,000 in compensation from Skelton, having made a legal claim for losses which it suffered. But Mr Justice Langstaff rejected the supermarket's argument that the company could not be held directly or vicariously liable for Skelton's criminal misuse of the data.

Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, who represented the 5,518 claimants, hailed it as a landmark victory.

He said: "We welcome the judgment and believe that it is a landmark decision, being the first data leak class action in the UK. Every day, we entrust information about ourselves to businesses and organisations. We expect them to take responsibility when our information is not kept safe and secure.

"The consequences of this data leak were serious. It created significant worry, stress and inconvenience for my clients. Data breaches are not a trivial or inconsequential matter. They have real victims. At its heart, the law is not about protecting data or information – it is about protecting people."

The other 94,480 staff - who were not involved in the class action - will now be able to make a claim.