Various Claimants v WM Morrisons Supermarket Plc (Rev 1) [2017] EWHC 3113 (QB) (01 December 2017)

Various Claimants v WM Morrisons Supermarket Plc (Rev 1) [2017] EWHC 3113 (QB) (01 December 2017)

Morrisons is not directly liable under the Data Protection Act 1998, breach of confidence, or misuse of private information for the criminal acts of its employee, as it was not the data controller at the time of the breach. Liability for unauthorised disclosure by an employee acting outside authority is not absolute or strict. Vicarious liability principles may apply, subject to further determination.

Citation
[2017] EWHC 3113
Parties
Claimant: Various Claimants; Defendant: WM Morrisons Supermarket PLC
Jurisdiction
England and Wales
Judgment Date
01 December 2017
Procedural Posture
Group Action (civil Liability) / Liability Trial (quantum Reserved)
Outcome
Direct liability claim dismissed; vicarious liability to be determined.
Legal Topics
Vicarious Liability, Breach of Confidence, Misuse of Private Information, Data Protection Act 1998, Employer Liability
Data Protection Tort Law Equity Vicarious Liability Breach of Confidence Misuse of Private Information Data Protection Act 1998 Employer Liability

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 3 Authorities cited 11 Party arguments 2
Sign in to unlock

Parties

Various Claimants

Claimant

WM Morrisons Supermarket PLC

Defendant

Procedural Posture

Group Action (civil Liability) / Liability Trial (quantum Reserved)

Legal Issues

  1. 1 Is Morrisons directly liable under the Data Protection Act 1998 for the criminal disclosure of employee data by a rogue employee?
  2. 2 Is Morrisons vicariously liable for the actions of its employee under the Data Protection Act, breach of confidence, and misuse of private information?

Ratio Decidendi

Morrisons is not directly liable under the Data Protection Act 1998, breach of confidence, or misuse of private information for the criminal acts of its employee, as it was not the data controller at the time of the breach. Liability for unauthorised disclosure by an employee acting outside authority is not absolute or strict. Vicarious liability principles may apply, subject to further determination.

Court Disposition

Direct liability claim dismissed; vicarious liability to be determined.