At the Supreme Court, Morrisons pops data breach liability win into its trolley – but it's not a get-out-of-compo free card for businesses

At the Supreme Court, Morrisons pops data breach liability win into its trolley – but it's not a get-out-of-compo free card for businesses

Vicarious liability now applies to intentional leaks, top court says


Morrisons supermarket is not liable for the actions of a disgruntled employee who deliberately leaked nearly 100,000 employees' payroll data online, the Supreme Court has ruled.


Grudge-bearing auditor


The case was brought over the actions of Andrew Skelton, a Morrisons auditor, who in 2014 was supposed to be transferring payroll data via encrypted USB stick to KPMG. Holding a grudge after being disciplined for abusing company postage to run his side hustle (a protein powder mail-order biz), Skelton made a separate copy of 99,998 employees' payroll information, dumped it online using Tor to cover his tracks and posted CDs of it to three newspapers.


He timed the breach to coincide with Morrisons' annual results in the hope of damaging its public image. The Bradford Telegraph and Argus refused to publish any news ..

Support the originator by clicking the read the rest link below.