“Supreme Court limits employer liability for rogue employee data breaches”
Andrew Skelton, a Morrisons employee, deliberately leaked payroll data of nearly 100,000 colleagues online after being disciplined by the company. He had been authorised to handle the data for legitimate business purposes but misused it in revenge against his employer.
Whether an employer can be held vicariously liable for an employee's deliberate and unauthorised disclosure of personal data when the employee was acting on a personal vendetta against the employer.
The Supreme Court unanimously allowed Morrisons' appeal, holding that the company was not vicariously liable for Skelton's actions as he was pursuing a personal vendetta rather than acting in the course of his employment.
This decision provides important clarity on the boundaries of vicarious liability in the digital age, protecting employers from automatic liability for deliberate data breaches by vengeful employees while maintaining the established close connection test.
You're reading the free summary of Various Claimants v Morrisons. Create a free account to unlock the full reasoning, the cited authorities and the verbatim judgment — plus structured briefs for 412,000+ UK judgments.
No card required. Free forever.
OSCOLA Citation
Various Claimants v WM Morrison Supermarkets plc [2020] UKSC 12, [2020] AC 989
Multiple official and mirror sources — pick whichever loads cleanly on your network.
Falls back to Google for old citations BAILII catalogues separately
Common Room
0 comments · About the Common Room →
No comments yet — start the discussion.
Voted-best comments help future students and feed Caselaw's AI study tools.