[2020] UKSC 12
UKSC 2018/0213
WM Morrison Supermarkets plc (Appellant) v Various Claimants (Respondents) – UKSC 2018/0213
On appeal from the Court of Appeal Civil Division (England and Wales)
In November 2013, an employee of the appellant, Mr Skelton, downloaded payroll data he was entrusted with at work onto a personal USB stick and took it home. In January 2014 he uploaded the data onto a file-sharing website and later sent it to newspapers. He was motivated by a grudge against the appellant. He was arrested, convicted of a number of offences and sentenced to 8 years’ imprisonment. Over 5,500 employees, whose personal data had been disclosed, issued a claim against the appellant claiming damages for breach of the DPA and/or for the misuse of private information and/or breach of confidence either by the appellant directly, or by Mr Skelton, in respect of whose acts the appellant was alleged to be vicariously liable.
The issues are:
(1) Whether the Data Protection Act 1988 (‘the DPA’) excludes the application of vicarious liability to a breach of that Act, or for misuse of private information or breach of confidence
(2) Whether the Court of Appeal erred in concluding that the disclosure of data by the appellant’s employee occurred in the course of his employment, for which the appellant should be held vicariously liable.
The Supreme Court unanimously allows the appeal.
More information is available on our website.
