Supermarket giant Morrisons is to appeal a ruling which could see it pay out “vast” sums of compensation to staff in the first data leak class action in the UK.
The Bradford-based retailer lost its case at the Court of Appeal on Monday, after it argued it was not responsible for the breach, which saw the personal information of 100,000 employees published on the internet.
Information included names, addresses, bank account details and salaries, and the leak is said to have cost Morrisons £2 million to rectify. A senior auditor at the company was later jailed for the breach following a criminal trial.
Some 5,000 employees affected by the 2014 breach were part of the class action against the supermarket. They are seeking compensation for the upset and distress caused, in a case that could have implications for every individual and business in the country.
Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, which represented the claimants, said the case involved a host of staff in roles like shelf-stacking, for whom the leak caused “a huge amount of worry”.
He said: “The claimants are obviously delighted with the Court of Appeal’s ruling. The Judges unanimously and robustly dismissed Morrisons’ legal arguments.
“These shop and factory workers have held one of the UK’s biggest organisations to account and won – and convincingly so.
“This latest judgment provides reassurance to the many millions of people in this country whose own data is held by their employer.”
Morrisons said it could not be held directly or vicariously liable for the criminal misuse of the data.
An earlier “landmark” judgment in December 2017 found in favour of the group of staff.
Morrisons said in a statement on Monday that the firm would now appeal the latest ruling at the Supreme Court, Britain’s highest legal authority.
A spokesperson for Morrisons said: “A former employee of Morrisons used his position to steal data about our colleagues and then place it on the internet and he’s been found guilty for his crimes.
“Morrisons has not been blamed by the courts for the way it protected colleagues’ data but they have found that we are responsible for the actions of that former employee, even though his criminal actions were targeted at the company and our colleagues.
“Morrisons worked to get the data taken down quickly, provide protection for those colleagues and reassure them that they would not be financially disadvantaged.
“In fact, we are not aware that anybody suffered any direct financial loss. We believe we should not be held responsible so that’s why we will now appeal to the Supreme Court.”
Andrew Skelton, a senior auditor with legitimate access to Morrisons full payroll records, was sentenced in 2015 to eight years in prison for the leak following a criminal trial.