WM Morrison Supermarkets Plc v. Various Claimants
[2018] EWCA Civ 2339
In the Court of Appeal, Civil Division
Case Number A2/2018/0090
Before Lord Justice Bean, the Master of the Rolls and Lord Justice Flaux
Decided October 22, 2018

Relevancy of the case: Vicarious liability of a company when one of its auditors leaked the personal data of over 100,000 employees

Statutes and Provisions Involved

• The Computer Misuse Act 1990
• The Data Protection Act 1995 (Section 4(4), 55)

Relevant Facts of the Case

• A senior auditor at the claimant company leaked the personal data of nearly 100,000 employees working in that company.
• Around 5000 employees sued the company, seeking damages for the act of the auditor. They contended that the company was vicariously liable for the act committed by the auditor.
• Justice Langstaff passed the order in the favour of the employees, leading to the company filing for appeal against the High Court’s judgment.

Prominent Arguments by the Counsels

• The appellant’s counsel argued that the appellant is not directly responsible for the actions since they were not the ones to leak the employees’ personal data. Vicarious liability is a common law principle that is not applicable if the governing statute says otherwise. Here, the Data Protection Act does not advocate for vicarious liability. The auditor’s actions were motivated by a vendetta that went against his course of employment.
• The respondents’ counsel argued that the claimant has breached the Data Protection Act and is directly responsible. The DPA does not explicitly remove vicarious liability. In this case, the appellant is vicariously responsible for the auditor’s action.

Opinion of the Bench

• The appellant’s arguments are unconvincing. The leak happened during the auditor’s course of employment. Such a massive leak of personal data would raise questions about employer integrity and commitment.

Final Decision

• The court held that the appellant is vicariously liable for the auditor’s wrongdoings and dismissed the appeal.

Aarya Tyagi, an undergraduate student at the Institute of Law, Nirma University, Ahemadabad, prepared this case summary during his internship with The Cyber Blog India in May/June 2024.