By Sheila Mckenzie-
Legal representatives for Morrisons have tried to convince the Supreme Court that the lower courts made “errors of law” and reached the “wrong answer” on the question of liability that found them vicariously liable for a data breach by a disgruntled employee.
The argument presented to the Supreme Court on Wednesday was to overturn a ruling which gave the go-ahead for compensation claims by thousands of employees whose personal details were posted online. The case involves the conduct of an employee, Andrew Skelton, a pay roll auditor who divulged staff information on the internet and also sent it to newspapers, “because of a grudge against Morrisons in order to damage Morrison’s reputation”.
Legal representatives for Morrisons insist that it cannot be held directly or vicariously liable for the criminal misuse of the data, and that any other conclusion would be grossly unjust. Previous rulings in both the High Court and Court of Appeal have been unfavourable to the company . Both ruled that Morrison is “vicariously liable” for Skelton’s actions.
Lord Skelton Pannick QC, of Blackstone Chambers, told the Supreme Court that Skelton’s wrongdoing was not within the field of activity assigned to him by Morrisons. There was not a sufficiently close connection between Skelton’s wrongful conduct and what he was employed to do to justify a ruling of vicarious liability.
Pannick said, had access to the payroll data for ‘a specific and limited purpose’ and ‘downloading the data onto his personal USB stick was well outside the scope of his job functions’.
He continued: ‘Even if the court were to conclude that the act of downloading the data was within his field of activity we say the act of disclosing the data two and four months later…cannot sensibly be said to be within his field of activity – far less to be closely connected to his job function’.
The latest round of the litigation at the Supreme Court follows a blow for Morrisons at the Court of Appeal in October last year, when three leading judges upheld a 2017 High Court finding on the issue of liability.
Legal action was launched after a security breach in 2014 when Skelton, a senior internal auditor at the retailer’s Bradford headquarters, leaked the payroll data of around 100,000 employees. Information published included their names, addresses, bank account details and salaries.
Lawyers for more than 9,000 claimants have described the action as a “classic David and Goliath case”.In July 2015, Skelton was found guilty at Bradford Crown Court of fraud, securing unauthorised access to computer material and disclosing personal data, and was jailed for eight years.
Lord Pannick told the justices at a hearing in London that Skelton remains in prison, with a release date in January.
”