Morrisons off the hook as employers welcome clarity on vicarious liability for data breach

Abstract

Abstract The UK Supreme Court has granted the appeal of supermarket chain WW Morrison Supermarkets plc (Morrisons), finding that the Court of Appeal had misunderstood a number of the governing principles of vicarious liability. Considering Morrisons’ liability afresh, the Supreme Court clarified that the motive and authorized acts of the wrongdoing employee are highly material to a finding of vicarious liability, whilst a causal chain of events is not. Whilst Morrisons’ victory is a welcome clarification on the law of vicarious liability, data controllers should take note: had Morrisons not been a sophisticated data controller paying particular attention to its obligations under data protection legislation, the outcome would likely have been more of a cautionary tale.