The English Court of Appeal has dismissed an appeal in Various Claimants v. Wm Morrison Supermarkets PLC, agreeing with the English High Court’s first instance decision that the supermarket chain was vicariously liable for a deliberate and malicious data breach by an employee.
Facts
Morrisons, a UK-based supermarket chain, had instructed S, a senior IT auditor employed by Morrisons, to transfer 99,998 employees’ payroll information to the company’s external auditor, KPMG. S had previously been subject to a formal warning in respect of his misuse of company postal facilities, leaving S with a “grudge” against the company. S duly transferred the payroll data to KPMG via an encrypted USB stick but also copied the data onto another USB stick for his own use.