UK Data Protection: Class Action Clouds Gather Over Employers As Morrisons Loses Appeal

UK supermarket Morrisons has lost its appeal against the decision of Mr Justice Langstaff that it was vicariously liable in damages to over 5,000 employees and ex-employees for the unlawful disclosure by a rogue employee, an internal IT auditor with a grudge, of payroll data comprising the personal data of almost 100,000 employees.

In another eagerly awaited decision, the Court of Appeal in October rejected Morrisons' case that the Data Protection Act 1998 provided a comprehensive statutory scheme which excluded liability on an employer for the wrongful processing of personal data by an employee.

There have frequently been numerous cases in which employers were held vicariously liable, as here, for torts committed away from the workplace; and, in the court's view, the employee's tortious acts in sending the claimants' data to third parties were within the field of activities assigned to him by Morrisons.

Further, the Court of Appeal held, it was clearly established that an employer may be vicariously liable for deliberate wrongdoing by an employee. Motive was irrelevant and the Court of Appeal did not accept there should be an exception to the irrelevance of motive where the motive was, by causing harm to a third party, to cause financial or reputational damage to the employer.

Implications

The prospect of a class action for a data breach has loomed ominously over data controllers in the UK in recent years, particularly since the Court of Appeal in Vidal-Hall v Google [2015] EWCA Civ 311 confirmed that compensation can be claimed for distress alone without also having to prove financial harm.

In the UK, data controllers have found some comfort in the recent High Court ruling in Richard Lloyd v Google LLC [2018] EWHC 2599 (QB) insofar as the judge in that case was not prepared to accept that breach of statutory duty or commission of the tort of misuse of private information in and of themselves gave rise to a claim for damages, irrespective of any harm.

But in many cases...