Morrisons supermarket liable for rogue employee's disclosure of co-workers' personal data online

Wm Morrison Supermarkets Plc was unsuccessful in its appeal against the High Court ruling that it was vicariously liable for an employee's deliberate disclosure online of co-workers' personal data.

The Court of Appeal found that the Data Protection Act 1998 did not exclude the common law remedy of vicarious liability for misuse of private information and breach of confidence. The employee's actions at work and the disclosure online were considered by the Court of Appeal to be an unbroken and continuous sequence of events: the steps he had taken and his attempts to hide them were all part of a plan.

With the upholding of the High Court decision, employers are exposed to being held vicariously liable for the misuse of employee personal data by a rogue employee regardless of complying with data protection legislation. The Court of Appeal suggested that the best way for employers to safeguard themselves against the actions of rogue employees is to insure against such events. As to whether insurers will cap the scope of such insurance is yet to be seen as further group actions are expected subject to a further appeal of this case being taken to the Supreme Court.