Court decision · 1 April 2020
WM Morrison Supermarkets plc v Various Claimants
[2020] UKSC 12 · UK Supreme Court
What it means for your code
Least-privilege access and audit logs on bulk exports of personal data are your main defence against insider leaks and the liability that follows.
What happened
A disgruntled internal auditor leaked payroll data of nearly 100,000 employees online; employees sued the employer.
What was decided
The employer was not vicariously liable for the employee's deliberate leak because it was not closely connected with his authorised duties; the DPA did not exclude vicarious liability in principle.
The legal test applied
- Vicarious liability requires the wrongful act to be closely connected with the employee's authorised activities
- A disclosure motivated by a personal vendetta fell outside the course of employment
What would have changed the outcome
- Where the employer itself failed its security duties, direct liability can still arise
Read the decision at the source
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.