Morrison Supermarket

On the first of April, the Supreme Court handed down its judgment in the appeal against the successful claim by 9,263 employees and former employees of Morrisons to hold the supermarket vicariously liable for the publication of their personal data. The data had been published by a disgruntled employee, Andrew Skelton. 

The Supreme Court stopped short of holding that vicarious liability can never arise in respect of data protection breaches. Morrisons’ argument turned on the wording of Section 13 of the Data Protection Act 1998: “an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage”, unless they can rely on the defence that they have take such care as in all the circumstances was reasonably required. The Court drew a distinction between an employer’s statutory duties under the Data Protection Act, and the common law imposition of vicarious liability for the acts of its employees. There was nothing inconsistent between the two, the DPA being silent as to whether an employer is responsible for the acts of its employee data controllers.
 

Aaron Moss