Morrison Supermarket

5 May 2020

On the first of April, the Supreme Court handed down its judgment in the appeal against the successful claim by 9,263 employees and former employees of Morrisons to hold the supermarket vicariously liable for the publication of their personal data. The data had been published by a disgruntled employee, Andrew Skelton. 

The Supreme Court stopped short of holding that vicarious liability can never arise in respect of data protection breaches. Morrisons’ argument turned on the wording of Section 13 of the Data Protection Act 1998: “an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage”, unless they can rely on the defence that they have take such care as in all the circumstances was reasonably required. The Court drew a distinction between an employer’s statutory duties under the Data Protection Act, and the common law imposition of vicarious liability for the acts of its employees. There was nothing inconsistent between the two, the DPA being silent as to whether an employer is responsible for the acts of its employee data controllers.

Aaron Moss


Aaron Moss

Call 2013


Join our mailing list to receive the latest news and event updates.



16 April 2024

Chambers is delighted to announce that Head of Chambers, Jason Beer KC is one of only…

Discover more

14 February 2022

The first hearings of the Post Office Horizon IT Inquiry commenced today.  Previously a non-statutory…

Discover more

19 December 2023

A message from Head of Chambers, Jason Beer KC, looking back at the past 12…

Discover more

Portfolio Builder

Select the practice areas that you would like to download or add to the portfolio

Download    Add to portfolio   
Title Type CV Email

Remove All


Click here to share this shortlist.
(It will expire after 30 days.)