Background

In the UK’s first group litigation case concerning a data breach, supermarket chain Morrisons has been held vicariously liable as an employer by the UK Court of Appeal. We previously reported on the events that led to this case, which involved the actions of one rogue employee and ultimately led to a class-action style case being taken by 5,518 Morrisons employees whose private information was published. The case concerns breaches of privacy and data protection laws, and claims were brought under the UK’s Data Protection Act 1998 (“the UK DPA”) as the data breach took place prior to the General Data Protection Regulation (“GDPR”) coming into force.

While Morrisons argued that it could not be held liable for the criminal misuse of its data, the UK Court of Appeal found that “the vicarious liability of an employer for misuse of private information by an employee and for breach of confidence by an employee has not been excluded by the “ and was therefore a viable course of action for the 5,518 Morrison employees. The court found that “if Parliament had intended such a substantial eradication of the common law and equitable rights, it might have been expected to say so expressly”.

Morrisons is now facing large compensation costs. Interestingly, the GDPR and the Irish Data Protection Act 2018 potentially allow for similar claims concerning non-material damage such as emotional distress to be brought in Irish courts. 

Can businesses do more?

It is worth noting that the Information Commissioner’s Office (“ICO”) in the UK took the view that Morrisons had not breached the UK DPA and therefore could not be fined. Morrisons was compliant with data protection legislation at the time and worked to remedy the leak quickly. Generally, businesses like Morrisons are required to have robust technical and organisational controls in place to ensure no misuse of personal information can ever occur. However, this may not be enough, and businesses should also have measures in place to guard against both internal and external privacy threats. The standard set by the Morrisons decision around rogue employees is a high one. 

Mitigating such threats may now also involve protecting data subjects against the acts of employees, including criminal acts in violation of internal policies. The court found that where an employee has acted in their position to the detriment of others, the employer that entrusted them in that position should be held accountable. The misuse of the personal data by the employee in this case was found to be within his “field of activities” as there was an “unbroken chain” of events between his work activities and the data leak.

Insurance as a solution?

Noting that where victims of a data breach would have no right to recourse other than against the perpetrator, the Court of Appeal instead suggested employers may be the most suitable party to be held accountable and that potential mitigation could be found by insuring against such “Armageddon or Doomsday” scenarios. 

What does this mean for businesses/employers?

Although this decision relates to the pre-GDPR regime in the UK, following a number of high-profile data breaches and a regulatory response, it is clear that the sensitivity and importance of personal data is at the forefront of public consciousness. Fundamentally, the decision will now require businesses to understand that their products, services, processes and policies need to be structured in a manner that puts data protection at the core. Legal and compliance functions should focus on reducing their privacy risk in order to avoid the “Armageddon or Doomsday” scenarios referred to by the Court of Appeal. 

Although the Irish legislative framework is different to the UK, businesses and enterprises should account for the possibility that the Irish courts could be guided by the Morrisons decision. As we previously reported, while Ireland has yet to allow US-style class actions, Article 80 of the GDPR does provide for a claims consolidation mechanism which could be utilised in future privacy cases. In the meantime, while Morrisons look set to appeal to the Supreme Court, the decision of the Court of Appeal is likely to be foremost in considerations of privacy compliance heading in to 2019.

Contributed by: Alex Towers & John Magee

Follow us on Twitter @WFIDEA and @WilliamFryLaw