The Insider Threat And Data Protection

If we were to hazard a guess at what furrows the brows of Data Protection Officers (DPOs) when considering data breach risk, following the Court of Appeal's judgment in WM Morrison Supermarkets Plc v. Various Claimants [2018] EWCA Civ 2339, the "insider threat" should be at the forefront of our minds.

Below, we offer our views on the Morrisons case and some practical tips on how to mitigate these risks.

The Morrisons litigation

The case concerned the actions of a disgruntled employee who published the details of more than 99,000 staff on a file-sharing website. He then sent a copy of the file to three newspapers. More than 5,500 staff commenced claims for damages. They also claimed that Morrisons was vicariously liable.

If you had only read the hyperbolic media coverage emerging from the Court of Appeal decision, you could be forgiven for thinking that the judgment was surprising or unusual. Whilst it may seem surprising that Morrisons should be held liable for an employee's conduct, which also amounted to a criminal offence, the legal principles in this area are designed around giving a claimant or claimants (in this case, a class of data subjects) an adequate remedy.

In a nutshell, the judgment reinforces the scope of the principle of vicarious liability under English common law. Since the Supreme Court's decision two years earlier in Mohamud v. WM Morrison Supermarkets plc [2016] AC 667, the approach has been to draw lines very broadly around the "field of activities" with which the employee is entrusted. In determining the closeness of connection between the wrongful conduct and this field of activities, the Courts are leaning towards principles of social justice which favour a payout for a claimant or claimants from the (presumably insured) defendant employer. The availability of insurance for the defendant is, as the Court of Appeal sees it at paragraph 78 of its judgment: "a valid answer to the Doomsday or Armageddon arguments put forward...on behalf of Morrisons".

Thus, in the Morrisons decision, the Court of Appeal: (1) reiterated the core principles of vicarious liability; (2) dismissed arguments to the effect that making a finding would impose an onerous burden not only on Morrisons but on future employers in the same position; and (3) followed through from the findings of fact in the High Court that there was an "unbroken chain" of events between Mr Skelton's employment and his wrongful conduct - to find Morrisons vicariously...